DMVCFramework — Minimal API

Routes are anonymous methods registered on a route group, not methods of a controller class. Same engine, same serializer, same ActiveRecord as the controller-based API — only the routing layer differs.

Everything below is copied from sources/MVCFramework.MinimalAPI.pas, sources/MVCFramework.Filters.pas and the samples. Do not invent names — the DSL does not follow ASP.NET spelling (there is no MapGroup, no app.Use, no OkResponse).

When in doubt about an API — verify it, never guess

Never invent an identifier or answer from memory. If you need a signature this skill does not cover, ask the user for the path to their DelphiMVCFramework checkout and read sources/ (and the matching samples/ project); failing that, read the official repository — sources · samples. If you still cannot verify it, say so. Where a skill and a sample disagree, the sample wins.

Delphi Language Target

Delphi 11 Alexandria or later — inline var declarations and for var loops are fine, and this skill's examples use them. Do not use Delphi 13 Florence-only syntax (NameOf, inline if expressions). For the language and the RTL themselves — version gating, lifetime, strings, generics, threading — load the delphi skill.

When to use

• New service where a controller class per resource adds no value
• Route-level filters/composition (auth per group, versioned prefixes)
• Web app with lambda handlers rendering TemplatePro views (.AsWeb)

Use the controller-based API (skill dmvcframework) when you want class-level inheritance or OnBeforeAction hooks. The filters (§6) work on both.

REQUIRED REFERENCE — dmvcframework-security. Any endpoint that accepts input from a client (body, query string, header, cookie, upload, URL) must follow it: access control and IDOR, mass assignment, SQL injection, XSS, CSRF, path traversal, uploads, security headers, JWT, secrets. Invoke it whenever you write or review such an endpoint — not only when the user says "security".

0. STOP — start from a wizard project

Never create the project from scratch. Never hand-write the .dpr bootstrap.

The IDE wizard ships two Minimal API presets — Minimal API RESTful and Minimal API WebApp — and both generate a correct, compiling project with the routing already wired. Your job is to add routes to it.

Step 1 — detect it. The user is expected to have run the wizard and started the agent from inside the project folder. A Minimal API wizard project has:

*.dpr              Boot + RegisterServices + RunServer  (Indy Direct by default; a WebModule here means WebBroker/ISAPI/Apache — also fine)
BootConfigU.pas    dotEnv + LoggerPro
EngineConfigU.pas  ConfigureEngine — view engine, exception handler, HTTP filters
RoutesU.pas        ConfigureRoutes — YOUR ROUTES GO HERE (one example: GET /api/v1/hello)
ServicesU.pas      DI registrations: RegisterServices (on by default)
bin/.env           port and settings

Read RoutesU.pas and EngineConfigU.pas before writing anything, and follow their conventions. On Delphi 12 and later the user can add a route group or a service from the IDE: right-click the project in the Project Manager → DMVCFramework → New Minimal API Route Group... / New Service...; when they prefer that, tell them which item to use instead of writing the files yourself.

Step 2 — if there is no wizard project, stop. Do not scaffold one. Tell the user:

This skill works on a project generated by the DMVCFramework IDE wizard, and I do not see one here. Please create it first:

Delphi IDE → File → New → Other → Delphi Projects → DelphiMVCFramework → New DMVCFramework Application

Pick Minimal API RESTful (or Minimal API WebApp for HTML pages). Accept the defaults — the server backend is Indy Direct. Compile and run it once. Then cd into the project folder, start me there, and tell me which routes to add.

Then wait.

The host may be WebBroker (ISAPI, Apache) — that is fine. Keep it, do not migrate it, do not suggest migrating it. Everything above the host is identical on every backend. See dmvcframework, reference/servers.md.

The section below documents the bootstrap the wizard generates, so you can read it — not so you can retype it.

1. Bootstrap — what the wizard generated

// Project.dpr — already written by the wizard. Do not recreate it.
begin
  IsMultiThread := True;
  MVCSerializeNulls := True;
  Boot;                                          // BootConfigU: dotEnv + LoggerPro
  RegisterServices(DefaultMVCServiceContainer);  // ServicesU
  DefaultMVCServiceContainer.Build;              // mandatory
  RunServer(dotEnv.Env('dmvc.server.port', 8080));
end.

procedure RunServer(APort: Integer);
var
  lEngine: TMVCEngine;
  lServer: IMVCServer;
begin
  lEngine := TMVCEngine.Create(
    procedure(Config: TMVCConfig)
    begin
      Config[TMVCConfigKey.DefaultContentType] := TMVCMediaType.APPLICATION_JSON;
    end);
  try
    ConfigureEngine(lEngine);        // EngineConfigU: view engine, exception handler, HTTP filters
    ConfigureRoutes(lEngine.Root);   // RoutesU: takes a TMVCRouteGroup<TObject>, NOT the engine
    lServer := TMVCServerFactory.CreateIndyDirect(lEngine);
    lServer.RunAndWait(APort);
  finally
    lEngine.Free;
  end;
end;

ConfigureRoutes signature used by the wizard/showcase projects:

procedure ConfigureRoutes(const ARoot: TMVCRouteGroup<TObject>);

Ordering rule: a classic middleware (deprecated in 3.5 — write a filter, §6) must be added before the first MapXxx call. The minimal-API dispatcher is installed lazily on the first Map and short-circuits matching routes — middlewares added after it never run for minimal routes. The engine-wide filters and bundles (AEngine.Use(...)) go in ConfigureEngine, which runs before ConfigureRoutes.

2. Route registration DSL

Everything hangs off a group. There are no Map* methods on TMVCEngine.

// TMVCEngine helpers (MVCFramework.MinimalAPI)
function Root: TMVCRouteGroup<TObject>;                      // = Prefix('')
function Prefix(const APrefix: string): TMVCRouteGroup<TObject>; overload;
function Prefix<T: class>(const APrefix: string; const AData: T;
                          const AOwnership: TMVCGroupDataOwnership = gdoEngine): TMVCRouteGroup<T>; overload;
// TMVCEngine (MVCFramework): one verb, the argument's type picks the overload
function Use(const AFilter: TMVCHTTPFilter): TMVCEngine; overload;
function Use(const AFilter: TMVCEndpointFilter): TMVCEngine; overload;   // every route, controllers too
function Use(const ABundle: IMVCFilterBundle): TMVCEngine; overload;

TMVCRouteGroup<T> — a record with value semantics:

function Prefix(const APath: string): TMVCRouteGroup<T>;             // nested; inherits filters + rkWeb
function Use(const AFilter: TMVCEndpointFilter): TMVCRouteGroup<T>; overload;
function Use(const ABundle: IMVCFilterBundle): TMVCRouteGroup<T>; overload;  // endpoint part here, HTTP part on the engine
function AsWeb: TMVCRouteGroup<T>;                                    // web route: hidden from OpenAPI
function AsApi: TMVCRouteGroup<T>;                                    // default
function MapGet   (const APath: string; const AHandler: TMVCMinimalFunc): TMVCRouteHandle;
function MapPost  (...) : TMVCRouteHandle;
function MapPut   (...) : TMVCRouteHandle;
function MapPatch (...) : TMVCRouteHandle;
function MapDelete(...) : TMVCRouteHandle;
function MapMethods(const AVerbs: array of TMVCHTTPMethodType; const APath: string;
                    const AHandler: TMVCMinimalFunc): TMVCRouteHandle;

Each Map* (and MapMethods) has generic overloads for 1 to 4 typed handler arguments: MapGet<T1>, MapGet<T1,T2>, MapGet<T1,T2,T3>, MapGet<T1,T2,T3,T4>. Always write the type arguments — lWeb.MapGet<TWebContext>('/', function(Ctx: TWebContext): IMVCResponse ...). Delphi does not infer them from the anonymous method: without them the call fails with E2250 There is no overloaded version of 'MapGet'. The plain MapGet(APath, AHandler) takes only a handler with no arguments.

Value-semantics trap: Use/Prefix/AsWeb return a new group. lGroup.Use(AuthorizeEndpointFilter()); on its own line is a no-op. Chain it or reassign: lGroup := lGroup.Use(AuthorizeEndpointFilter()); With a bundle it is worse than a no-op: lGroup.Use(JWTAuthenticationBundle(...)); alone registers the login on the engine and loses the check of the group.

A filter without arguments needs (): Use(AuthorizeEndpointFilter()), AEngine.Use(ETagHTTPFilter()), AEngine.Use(SecurityHeadersHTTPFilter()). Without them Delphi passes the function itself, not the filter it returns: E2250 There is no overloaded version of 'Use'.

No HTTP filter on a group. lGroup.Use(CORSHTTPFilter('*')) does not compile (E2250): an HTTP filter runs before routing, so it cannot run for one group. Register it on the engine. A route (TMVCRouteHandle.Use) takes an endpoint filter only.

Path syntax = standard DMVC: ($id), with optional constraint ($id:int). Constraints: int, int64, float, bool, guid, date, sqids. A failed constraint means the route simply does not match (→ 404 or the next route). An unknown constraint name raises EMVCException when the route is registered, at startup. Trailing wildcard: ($slug:*) captures the rest of the path, slashes included, as a string.

Route metadata — TMVCRouteHandle (returned by every Map*)

lRoutes.MapGet('/customers', ...)
  .WithName('customers.list')        // unique engine-wide; duplicate/empty raises EMVCMinimalAPI
  .WithSummary('List customers')
  .WithDescription('...')
  .WithTags(['customers'])
  .WithDeprecated
  .Produces<TCustomer>
  .WithOpenAPI(oavHidden)            // hide from the spec
  .Use(RequireRoleEndpointFilter('admin'));        // route-scoped filter, runs after the group's

3. Handler signatures

The only accepted shapes — all return IMVCResponse, max 4 args, no procedure:

TMVCMinimalFunc              = reference to function: IMVCResponse;
TMVCMinimalFunc<T1>          = reference to function(Arg1: T1): IMVCResponse;
TMVCMinimalFunc<T1,T2>       = reference to function(Arg1: T1; Arg2: T2): IMVCResponse;
TMVCMinimalFunc<T1,T2,T3>    = reference to function(Arg1: T1; Arg2: T2; Arg3: T3): IMVCResponse;
TMVCMinimalFunc<T1,T2,T3,T4> = reference to function(Arg1: T1; Arg2: T2; Arg3: T3; Arg4: T4): IMVCResponse;

4. Parameter binding — driven by the argument TYPE

Resolution order (TMVCMinimalArgResolver.Resolve<T>):

Two rules that surprise everyone:

1. Only interfaces get DI. A concrete class argument is never a service — it is body/query/group data.
2. A primitive argument binds to a route segment, not to a query param. ?page=2 will not land in a bare Integer arg. Use a record with [MVCFromQueryString].

Objects bound as arguments are owned by the framework and freed after the handler. Never free them.

Records — field-level binding

type
  TCustomerSearch = record
    [MVCFromQueryString('q', '')]      Query: string;
    [MVCFromQueryString('page', 1)]    Page: Integer;
    [MVCFromQueryString('tag')]        Tags: TArray<string>;   // repeated ?tag=a&tag=b
    [MVCFromHeader('X-Tenant')]        Tenant: string;
    [MVCFromCookie('sid', '')]         SessionId: string;
    City: string;                      // no attribute → route segment, then query string, by field name
  end;

  TCreateCustomer = record
    [MVCFromBody]                      Customer: TCustomer;    // class field ← JSON body
  end;

• [MVCFromContentField('name')] — form-urlencoded / multipart field. TArray<string> gives multi-value; any other TArray<System.*> raises.
• [MVCFromFile('field')] only renames the form field for a TMVCFormFile / TArray<TMVCFormFile> field — the binding itself is by type.

TMVCFormFile: FieldName, FileName, ContentType, Size: Int64, ContentStream: TStream (request-owned — do not free), ContentAsBytes, ContentAsString(AEncoding), SaveToFile(APath).

5. Return values — standalone response builders

Handlers must return IMVCResponse. The builders are standalone functions (not controller methods, and not named OkResponse/NotFoundResponse — that is the controller-side naming):

Ok;  Ok(Body: TObject; Owns: Boolean = True);  Ok(Message: string);
Created(Location, Message);  Created(Location, Body, Owns);
NoContent;  Accepted;  NotModified;
NotFound / BadRequest / Unauthorized / Forbidden / Conflict /
  UnsupportedMediaType / UnprocessableEntity / InternalServerError   // each ×3 overloads
Redirect(Location);  Redirect(Location, Permanent, PreserveMethod = False);
Status(Code);  Status(Code, Message);  Status(Code, Body, Owns);
ProblemDetails(StatusCode, Title, Detail = '', Instance = '');

• Ok(TObject) serializes and frees the object (Owns = True) — works for TObjectList<T>, entities, TJsonObject.
• Ok(string) wraps the string as {"message": "..."}.
• ProblemDetails(...) is the RFC 7807 object itself, sent as application/problem+json (on 3.5.0-rc7 and earlier it came out wrapped in {"data": ...} as application/json).
• Records cannot be returned. There is no Ok(record) overload — build a class or a TJsonObject.
• The result is mutable: Result := Ok(lData); Result.StatusCode := 201;
• HTML: RenderView (§7) for a template; Html(const AHtml: string) for a small fragment with no template (an HTMX swap target) — it sends the string as is, nothing escaped, so encode any untrusted value in it.

6. Filters — two kinds, do not mix them up

TMVCEndpointFilterNext = reference to function: IMVCResponse;
TMVCEndpointFilter     = reference to function(const AContext: TWebContext;
                           const ANext: TMVCEndpointFilterNext): IMVCResponse;

TMVCHTTPFilterNext     = reference to procedure;
TMVCHTTPFilter         = reference to procedure(const AContext: TWebContext;
                           const ANext: TMVCHTTPFilterNext);

Skipping ANext() short-circuits the chain. Nested Prefix inherits the parent's filters. The base types are declared in MVCFramework (the names stay valid from MVCFramework.MinimalAPI).

Filter bundles (IMVCFilterBundle, MVCFramework, re-exported by MVCFramework.MinimalAPI): filters that go together — an HTTP part and an endpoint part, each in its order — registered by one Use. On a group, lGroup.Use(B) puts the endpoint part on the group and the HTTP part on the engine; on the engine, lEngine.Use(B) puts both engine-wide. The same bundle instance on two sibling groups is allowed (HTTP part once); on the engine and on a group, on a group and a group nested in it, or twice on the engine, it raises EMVCConfigException at the second Use. A bundle with no endpoint part (FileServerBundle) on a group raises too: use it on the engine. Build one with TMVCFilterBundle.Create([HTTP filters], [endpoint filters]); an endpoint filter held in a variable inside [...] is called instead of passed (E2035) — write [TMVCEndpointFilter(lFilter)].

Custom endpoint filter — the whole shape:

function RequireLoginEndpointFilter(const ARedirectTo: string): TMVCEndpointFilter;
begin
  Result :=
    function(const Ctx: TWebContext; const Next: TMVCEndpointFilterNext): IMVCResponse
    begin
      if Ctx.Session['user'].IsEmpty then
        Result := Redirect(ARedirectTo)
      else
        Result := Next();
    end;
end;

Ready-made filters (MVCFramework.Filters)

A filter's name ends in EndpointFilter (engine, group or route) or HTTPFilter (engine only); a function that builds a bundle ends in Bundle (engine or group). All of them are registered with Use.

EndpointFilters — AuthorizeEndpointFilter · RequireRoleEndpointFilter(Role) / RequireRoleEndpointFilter(Roles: TArray<string>) (any-of) · BasicAuthEndpointFilter(Validator, Realm) / BasicAuthEndpointFilter(Handler, Realm) (pass the realm with a validator, and write TAuthentication.Create as IMVCAuthenticationHandler for a handler: otherwise the overloads do not resolve, E2250) · CSRFEndpointFilter(...) · MemorySessionEndpointFilter(TimeoutMinutes = 0; Flags = [scfHttpOnly]) · FileSessionEndpointFilter(TimeoutMinutes, Folder, Flags) · SessionEndpointFilter(Factory) · CORSEndpointFilter(...) (matched routes only: it does not answer a preflight — use CORSHTTPFilter)

HTTPFilters — StaticFilesHTTPFilter(Prefix, RootFolder, Mode = sfmFiles, DefaultDocument = 'index.html') (sfmSPA for a single-page app) / StaticFilesHTTPFilter(TMVCStaticFilesOptions) · CompressionHTTPFilter(Threshold = 1024) · ETagHTTPFilter · CORSHTTPFilter(Origins = '*', AllowsCredentials = False, ...) · RateLimitHTTPFilter(Max = 60, WindowSeconds = 60) / RateLimitHTTPFilter(TMVCRateLimitOptions) · IPBlockHTTPFilter(...) · RequestLogHTTPFilter · SecurityHeadersHTTPFilter · ShutdownHTTPFilter(...) · AnalyticsHTTPFilter(...) · TraceHTTPFilter(...) · RedirectHTTPFilter(...) · RangeMediaHTTPFilter(URLPath, DocumentRoot) · MemorySessionHTTPFilter / FileSessionHTTPFilter / SessionHTTPFilter · request guards BearerAuthHTTPFilter, AllowedOriginHTTPFilter, AllowedHostHTTPFilter, AllowedMethodsHTTPFilter · CSRFHTTPFilter

Bundles — FileServerBundle(URLPrefix, DocumentRoot, Mode = fsmFiles) / FileServerBundle(TMVCFileServerOptions): the files of StaticFilesHTTPFilter (MIME type, Last-Modified/304, default document, path traversal refused) plus 206 Partial Content for a GET or HEAD with a Range header (a HEAD gets the headers only). fsmSPA: a GET/HEAD with no route gets index.html, so an API keeps its routes on the same prefix. The options (TMVCFileServerOptions.Default) add DefaultDocument, Charset, Flags ([fsfRanges] by default; fsfCaseSensitivePrefix), MediaTypesCustomizer, Rules. An HTTP part only: register it on the engine (on a group it raises). · MVCFramework.Filters.Authentication — JWTAuthenticationBundle(Handler, ClaimsSetup, Secret, LoginURL = '/login') / JWTAuthenticationBundle(TMVCJWTAuthenticationOptions), JWTCookieAuthenticationBundle(Handler, ClaimsSetup, Secret, Cookie, LoginURL = '/login', LogoutURL = '/logout') / JWTCookieAuthenticationBundle(TMVCJWTCookieAuthenticationOptions), BasicAuthenticationBundle(Handler, Realm), CustomAuthenticationBundle(Handler, LoginURL) (the options, the blacklist and the refresh token: dmvcframework skill, Filters) · MVCFramework.Filters.OIDC — OIDCAuthenticationBundle(TMVCOIDCOptions)

Companion units (the core unit pulls in no FireDAC, SwagDoc or Redis): MVCFramework.Filters.ActiveRecord — ActiveRecordEndpointFilter(ConnectionDefName), DatabaseSessionEndpointFilter, ActiveRecordHTTPFilter, DatabaseSessionHTTPFilter · MVCFramework.Filters.OpenAPI — OpenAPIHTTPFilter(Engine, Info, '/openapi.json') / OpenAPIHTTPFilter(Engine, Info, [Sources], '/openapi.json') (your IMVCOpenAPISources, after the routes and the controllers) · MVCFramework.Filters.Swagger — SwaggerHTTPFilter(Engine, Info, URL, JWTDescription, Authentications = [], ...): with JWTAuthenticationBundle pass [sauBearer] (TMVCSwaggerAuthentications), because the filter finds a JWT on its own only in the deprecated middleware · MVCFramework.Filters.Redis — RateLimitRedisHTTPFilter · MVCFramework.JWT.RefreshToken.Filters — RefreshTokenHTTPFilter (the refresh endpoint alone, for a login of your own).

A login route of your own (it issues the tokens itself): TMVCJWTAuthenticationOptions with LoginURL := '' gives a bundle with the check only (plus the blacklist and the refresh URL when set); ClaimsSetup stays nil. The login route must be outside the check: a Minimal API route is always checked (OnRequest is not asked), so put this bundle on the group it protects — lApi.Prefix('/admin').Use(JWTAuthenticationBundle(lJWTOptions)) — and map the login on a group without it. Engine-wide, the check would cover the login route too. A refresh store, when used, is one global instance for the process (see dmvcframework, Filters).

Authentication on a group

An authentication bundle on the group: the check (endpoint part) covers the group's routes, the login needs no route and goes on the engine by itself (as the wizard generates it, in Routes.RootU):

// var lJWTOptions: TMVCJWTAuthenticationOptions;
// POST /api/v1/admin/login (jwtusername / jwtpassword) answers {"token": "..."};
// every route on lAdmin needs the token
lJWTOptions := TMVCJWTAuthenticationOptions.Default;
lJWTOptions.Handler := TAuthentication.Create;
lJWTOptions.ClaimsSetup := procedure(const JWT: TJWT)
  begin
    JWT.Claims.Issuer := dotEnv.Env('JWT_ISSUER', 'MyApp');
    JWT.Claims.ExpirationTime := Now + OneHour;
    JWT.Claims.NotBefore := Now - OneMinute * 5;
    JWT.Claims.IssuedAt := Now;
  end;
lJWTOptions.Secret := dotEnv.Env('JWT_SECRET');      // no fallback for the key
lJWTOptions.LoginURL := '/api/v1/admin/login';
lJWTOptions.ClaimsToCheck := [TJWTCheckableClaim.ExpirationTime, TJWTCheckableClaim.NotBefore, TJWTCheckableClaim.IssuedAt];
lAdmin := lApi.Prefix('/admin')
  .Use(JWTAuthenticationBundle(lJWTOptions))
  .Use(RequireRoleEndpointFilter('admin'));

The short form, JWTAuthenticationBundle(TAuthentication.Create, lClaimsSetup, dotEnv.Env('JWT_SECRET'), '/api/v1/admin/login'), checks the expiration only. The same bundle, kept in a variable (lAuth: IMVCFilterBundle), can go on two groups: its login is registered once.

On a route, the handler's OnRequest is not asked (authentication is always required) and OnAuthorization gets '' as controller and 'VERB pattern' as action. The login answers any verb: CORSHTTPFilter or RateLimitHTTPFilter that must cover it are HTTP filters registered on the engine before it.

7. Web mode — TemplatePro + HTMX

// EngineConfigU
AEngine.SetViewEngine(TMVCTemplateProViewEngine);
AEngine.UseExceptionHandler('error', 'MyApp');
// config keys: ViewPath, DefaultViewFileExtension, ViewCache

Mark the group .AsWeb (excludes it from OpenAPI) and add a session filter:

var lWeb := ARoot.AsWeb.Use(MemorySessionEndpointFilter(30, SessionCookieFlags(dotEnv.Env('SESSION_COOKIE_SECURE', True))));  // as the wizard

lWeb.MapGet<TWebContext>('/customers',
  function(Ctx: TWebContext): IMVCResponse
  var
    lCustomers: TObjectList<TCustomer>;
  begin
    lCustomers := GetCustomers;
    try
      ViewData['customers'] := lCustomers;
      // HTMX asks for the table only; a normal request gets the whole page
      if Ctx.Request.IsHTMX and not Ctx.Request.HXIsBoosted
         and not Ctx.Request.HXIsHistoryRestoreRequest then   // uses MVCFramework.HTMX
        Result := RenderView('customers/table')
      else
        Result := RenderView('customers/index');
    finally
      lCustomers.Free;               // ViewData owns nothing
    end;
  end);

Ambient web globals (valid only inside a minimal-API request, otherwise EMVCMinimalAPI):

function ViewData: TMVCViewDataObject;
function RenderView(const AViewName: string): IMVCResponse;
function RenderView(const AViewName: string; const AOnBeforeRender: TMVCSSVBeforeRenderCallback): IMVCResponse;
function RenderViews(const AViewNames: TArray<string>; const AUseCommonHeadersAndFooters: Boolean = True): IMVCResponse;

ViewData is the only ambient helper by design — session, request, HTMX state must come in as a typed TWebContext argument. There is no TMVCEngine.WebRoot / WebPrefix (some old sample comments say otherwise; they are stale).

Session: read/write Ctx.Session['user'], end with Ctx.SessionStop. Page vs fragment: the handler above; the template pair, TemplatePro and HTMX are in dmvcframework-webapp.

Content negotiation: if an rkApi and an rkWeb route share verb+path, the winner is scored on Accept/Content-Type (web wins on text/html, api on application/json). Ties → first registered.

8. Validation

• Bound classes: validated automatically if the class carries ≥1 validator attribute or descends from TMVCValidatable — after deserialization, before the handler runs.
• Bound records: validated unconditionally (ValidateRecord); fields with validator attributes are checked. Error keys are field names; no OnValidate, no nesting, and cross-field validators (MVCCompareField, …) get no owner object and do not check — use a class for rules that span two fields.
• Failure raises EMVCValidationException → rendered as RFC-7807 ProblemDetails with 422 (binding errors → 400: EMVCMinimalAPI for a route/query value, EMVCException for malformed JSON). The body has "detail": "Validation failed for fields: Email, FirstName" plus an "errors" object with the per-field messages ({"Email": "...", ...}). errors arrived after 3.5.0-rc7: on rc7 and earlier only detail is there.
• Validators read properties of a class (fields of a record); on a NullableXxx property only MVCRequired checks anything.
• HTML form posts (Ctx.Request.ContentFields) are not validated for you: copy the fields into an object, validate, re-render with formModel/formErrors and 422.

The full attribute list, the error-map response, the form re-render pattern and custom validators are in the dmvcframework skill, reference/validation.md.

type
  TCreateCustomerReq = record
    [MVCRequired] [MVCMinLength(2)]  FirstName: string;
    [MVCRequired]                    LastName: string;
    [MVCEmail]                       Email: string;
  end;

9. Worked example

procedure ConfigureRoutes(const ARoot: TMVCRouteGroup<TObject>);
begin
  var lApi := ARoot.Prefix('/api');

  lApi.MapGet<TCustomerSearch, ICustomerService>('/customers',
    function(Search: TCustomerSearch; Svc: ICustomerService): IMVCResponse   // record + DI interface
    begin
      Result := Ok(Svc.Search(Search.Query, Search.Page));                   // TObjectList → owned & freed
    end).WithName('customers.list').Produces<TCustomer>;

  lApi.MapGet<Integer, ICustomerService>('/customers/($id:int)',
    function(ID: Integer; Svc: ICustomerService): IMVCResponse               // primitive ← route segment
    var
      lCustomer: TCustomer;
    begin
      lCustomer := Svc.GetByID(ID);
      if lCustomer = nil then
        Exit(NotFound('Customer not found'));
      Result := Ok(lCustomer);
    end);

  lApi.MapPost<TCreateCustomerReq, ICustomerService>('/customers',
    function(Req: TCreateCustomerReq; Svc: ICustomerService): IMVCResponse   // record → validated
    var
      lID: Integer;
    begin
      lID := Svc.Create(Req.FirstName, Req.LastName, Req.Email);
      Result := Created('/api/customers/' + lID.ToString, 'Customer created');
    end);

  // admin group — filters applied to every route below. AuthorizeEndpointFilter needs a user: an authentication
  // bundle before it (.Use(JWTAuthenticationBundle(...))), or BearerAuthHTTPFilter in EngineConfigU (the wizard's non-JWT admin group)
  var lAdmin := lApi.Prefix('/admin').Use(AuthorizeEndpointFilter()).Use(RequireRoleEndpointFilter('admin'));

  lAdmin.MapDelete<Integer, ICustomerService>('/customers/($id:int)',
    function(ID: Integer; Svc: ICustomerService): IMVCResponse
    begin
      Svc.Delete(ID);
      Result := NoContent;
    end);
end;

10. Common mistakes

11. Key units

12. Reference samples