What should an API validate first?

Check request syntax at the boundary, then check business invariants before changing state. Return a consistent error shape with a field or code clients can act on. Avoid silently coercing values unless that behavior is part of the contract.