A Data Transfer Object (DTO) is a separate class or schema that defines exactly what an API endpoint accepts or returns. It is completely decoupled from the database model.

Create distinct DTOs for each direction and each operation:

• UserCreateRequest — fields allowed when creating a user (name, email, password)

• UserUpdateRequest — fields allowed when updating a user (name, bio, avatar)

• UserPublicResponse — fields returned to other users (name, bio, avatar only)

• UserPrivateResponse — fields returned to the user themselves (name, bio, email, settings)

The database model (which contains passwordHash, isAdmin, resetToken) is never directly serialized into any API response.

Think of the database model as a filing cabinet with everything in it. A DTO is a photocopy of only the pages you're allowed to share. You never hand someone the whole cabinet — you hand them the photocopy.