@Body() with no argument injects the entire raw parsed body with no validation. @Body('field') extracts a single field from the body without validating it. @Body() with a DTO class combined with ValidationPipe is the correct production pattern — it validates, transforms, and strips unknown properties before the handler runs.
@Body() with no arg — use only for untyped webhooks or fully dynamic payloads.
@Body('field') — useful for simple single-field extractions but provides no validation.
@Body() with DTO class + ValidationPipe — always the correct approach for production endpoints.
Global ValidationPipe with whitelist: true strips unknown properties before the handler receives the body.
With transform: true, the body is converted to a typed DTO class instance, not just a plain object.