I prefer to do something like this,

1.the rest end point will receive an request with data then,

2.business service class is called with the data

3. Validate the data if invalid throw an exception with proper description, eg:

   throw new InvalidArgumentException("invalid objet Id");

4. On controller if above exception is thrown then return 400 bad request with error description eg

   {"ok":false, "error":"invalid_argument","msg":"invalid objet Id"}

By doing this way the business class can be used anywhere and response can be handled accordingly

I prefer to do something like this:

1. The rest end point will receive an request with data then,
2. Business service class is called with the data
3. Validate the data if invalid throw an exception with proper description, e.g.: throw new InvalidArgumentException("invalid objet Id");
4. On controller if above exception is thrown then return 400 Bad Request with error description e.g.: {"ok":false, "error":"invalid_argument","msg":"invalid objet Id"}

By doing this way the business class can be used anywhere and response can be handled accordingly.