How would you use a Pydantic response_model to enforce output structure?

WHAT THIS TESTS: The interviewer wants to know if you understand the boundary between your internal data representation and your external API contract. FastAPI uses Pydantic models to enforce that boundary automatically. The core concept is data filtering and type-safe serialization: you should never return raw ORM objects or internal dictionaries directly to the client. Instead, you define an explicit output schema that contains only the fields you are willing to expose. FastAPI will then take the data returned by your path operation function, validate it against that schema, and serialize it, dropping any extra fields that are not declared in the response model. This prevents accidental leaks of sensitive fields like hashed passwords, internal IDs, or metadata.

A GOOD ANSWER COVERS: First, create a separate Pydantic model for the response, such as UserOut, that omits sensitive fields like password_hash entirely. Second, declare that model as the response_model on the path operation decorator, for example @app.get with response_model set to UserOut. Third, return the richer internal object or dictionary from the function; FastAPI will automatically filter out fields that are not present in the response model and will coerce types to match the schema. Fourth, mention that this approach keeps your internal models free from presentation concerns and makes the API contract explicit and versionable.

COMMON WRONG ANSWERS: A major red flag is saying you would manually delete keys from a dictionary before returning it, such as removing password_hash from a user dict. This is brittle and easy to bypass during refactoring. Another wrong answer is returning the ORM model directly without any Pydantic layer, which couples your database schema to your API and risks exposing hidden columns. Some candidates suggest using response_model_exclude on the decorator to blacklist fields; while this works, it is less maintainable than a dedicated output model because it scatters security logic across decorators rather than centralizing it in a typed schema.

LIKELY FOLLOW-UPS: The interviewer might ask what happens if the returned object contains fields not declared in the response model, and the correct answer is that FastAPI filters them out by default. They might also ask about the difference between response_model and the function return type annotation; you should explain that response_model controls serialization and OpenAPI docs, while the return type annotation is mainly for editor support and can be broader. Another follow-up is how to handle nested relationships; the answer is to define nested Pydantic output models and use them consistently.

ONE CONCRETE EXAMPLE: Imagine you have an internal SQLAlchemy User model with id, email, hashed_password, and is_admin. You define a Pydantic class named UserResponse with id as an integer and email as a string. Then you write a GET endpoint for users/me with response_model set to UserResponse. Inside the function you return the SQLAlchemy user object directly. FastAPI uses Pydantic to construct a UserResponse from that object, ignoring hashed_password and is_admin automatically. If you later add an internal field like mfa_secret, it is never exposed because the API contract is defined by UserResponse, not by the database table.

Source: fastapi.tiangolo.com