How does Bean Validation (`@Valid` + `@NotNull`/`@Size`) actually get triggered on a REST request?

Annotating a `@RequestBody` parameter with `@Valid` tells Spring MVC to run the object through the Bean Validation provider (Hibernate Validator) right after deserialization, checking every constraint annotation on its fields. If any fail, Spring throws `MethodArgumentNotValidException` before your controller method body even runs, which you then handle via `@ExceptionHandler` to shape the 400 response.