diff --git a/customer-api-provider/pom.xml b/customer-api-provider/pom.xml
index 3985879..8a725ee 100644
--- a/customer-api-provider/pom.xml
+++ b/customer-api-provider/pom.xml
@@ -56,6 +56,10 @@
       <artifactId>rest-assured</artifactId>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>io.quarkus</groupId>
+      <artifactId>quarkus-hibernate-validator</artifactId>
+    </dependency>
   </dependencies>
 
   <build>
diff --git a/customer-api-provider/src/main/java/de/schulung/sample/quarkus/Customer.java b/customer-api-provider/src/main/java/de/schulung/sample/quarkus/Customer.java
index ae2fb12..ff7165f 100644
--- a/customer-api-provider/src/main/java/de/schulung/sample/quarkus/Customer.java
+++ b/customer-api-provider/src/main/java/de/schulung/sample/quarkus/Customer.java
@@ -2,6 +2,8 @@
 
 import jakarta.json.bind.annotation.JsonbProperty;
 import jakarta.json.bind.annotation.JsonbTransient;
+import jakarta.validation.constraints.Pattern;
+import jakarta.validation.constraints.Size;
 import lombok.AllArgsConstructor;
 import lombok.Getter;
 import lombok.NoArgsConstructor;
@@ -19,9 +21,11 @@ public class Customer {
   // readonly property
   @Setter(onMethod_ = @JsonbTransient)
   private UUID uuid;
+  @Size(min = 3, max = 100)
   private String name;
   @JsonbProperty("birth_date") // TODO -> use snake_case globally?
   private LocalDate birthdate;
+  @Pattern(regexp = "active|locked|disabled")
   private String state;
 
 }
diff --git a/customer-api-provider/src/main/java/de/schulung/sample/quarkus/CustomersResource.java b/customer-api-provider/src/main/java/de/schulung/sample/quarkus/CustomersResource.java
index 7582f0a..604f3dd 100644
--- a/customer-api-provider/src/main/java/de/schulung/sample/quarkus/CustomersResource.java
+++ b/customer-api-provider/src/main/java/de/schulung/sample/quarkus/CustomersResource.java
@@ -1,5 +1,6 @@
 package de.schulung.sample.quarkus;
 
+import jakarta.validation.Valid;
 import jakarta.ws.rs.*;
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.Response;
@@ -33,7 +34,7 @@ public Collection<Customer> getCustomers() {
   @POST
   @Consumes(MediaType.APPLICATION_JSON)
   @Produces(MediaType.APPLICATION_JSON)
-  public Response createCustomer(Customer customer) {
+  public Response createCustomer(@Valid Customer customer) {
     customer.setUuid(UUID.randomUUID());
     customers.put(customer.getUuid(), customer);
     final var location = UriBuilder.fromResource(CustomersResource.class)
diff --git a/customer-api-provider/src/test/java/de/schulung/sample/quarkus/CustomerApiTests.java b/customer-api-provider/src/test/java/de/schulung/sample/quarkus/CustomerApiTests.java
index 9a0a58c..0819bd8 100644
--- a/customer-api-provider/src/test/java/de/schulung/sample/quarkus/CustomerApiTests.java
+++ b/customer-api-provider/src/test/java/de/schulung/sample/quarkus/CustomerApiTests.java
@@ -92,6 +92,42 @@ void shouldCreateCustomer() {
         .body("birth_date", is(equalTo("2000-10-04")));
     }
 
+    @Test
+    void shouldNotCreateCustomerWithInvalidName() {
+      given()
+        .when()
+        .contentType(ContentType.JSON)
+        .body("""
+          {
+              "name": "T",
+              "birth_date": "2000-10-04",
+              "state": "active"
+          }
+          """)
+        .accept(ContentType.JSON)
+        .post("/customers")
+        .then()
+        .statusCode(400);
+    }
+
+    @Test
+    void shouldNotCreateCustomerWithInvalidState() {
+      given()
+        .when()
+        .contentType(ContentType.JSON)
+        .body("""
+          {
+              "name": "Tom Mayer",
+              "birth_date": "2000-10-04",
+              "state": "gelbekatze"
+          }
+          """)
+        .accept(ContentType.JSON)
+        .post("/customers")
+        .then()
+        .statusCode(400);
+    }
+
   }
 
   @Nested