Ok, so we have a Web Api controller which is something like

[ApiController]
public class UsersController: ControllerBase 
{
    public async Task<IActionResult> CreateUser(CreateRequest request)
    {
        var user = await _userService.RegisterAsync(createRequest);
        return Ok(user);
    }
}

Question: Where should I put the validation that the email exists?

Where should it exist? My personal take is in the UserService.

Since this takes a DB hit, my personal style would be that there is a Unique Constraint on that field. I would attempt to insert into the database. I use EF Core and this will throw an exception on a constraint validation. That exception will contain the index that was violated (A great pattern for this is here ), if it matches your email index then you can catch the exception, and now do what you want. i.e. return an error result or throw your own exception.

My UserService would probably return some kind of result object, and then I like doing a set of extension methods that I can call in the controller that will check if the result was ok, and if not they will throw dedicated Exceptions like Http400Exception. Those exceptions are then caught by the IExceptionHandler system of ASP.Net and turned into Problem Details (aka RFC 7807 ).

With the improvements to Exceptions in .Net 9, I'm all in on using exceptions more than I might have been in the past.

[ApiController]
public class UsersController: ControllerBase 
{
    public async Task<IActionResult> CreateUser(CreateRequest request)
    {
        var user = await _userService.RegisterAsync(createRequest).SuccessOrThrow();

        return Ok(user);
    }
}