moved the validation logic from REST layer to Data Access layer