What does `[ApiController]` change for an ASP.NET Core controller, especially around routing, binding, and validation errors?

I treat these conventions as part of the externally observable API. Changing nullable annotations, validation attributes, JSON options, parameter types, or binding attributes can turn a formerly accepted request into an automatic 400 before the action executes. That means logs placed only inside the action miss the failure, and filters or metrics need to observe the framework boundary deliberately. I distinguish malformed input, syntactically valid but rule-breaking input, current-state conflicts, authorization failures, and unexpected exceptions instead of mapping every rejection to 400. Contract tests send real HTTP requests through the pipeline and assert status, content type, problem type or code, field paths, and safe details. OpenAPI should describe the same required fields and responses, but runtime tests remain the proof because conventions, custom filters, and serializer settings can drift from generated documentation.