Response models filter output data

Declare a return type on each path operation, such as -> list[Item], and FastAPI uses it to validate the returned data — invalid output means your app code is broken, so it returns a server error instead of incorrect data — to add a JSON Schema for the response to the OpenAPI path operation, feeding the automatic docs and client code generation tools, to serialize the result to JSON with Pydantic, and, most importantly, to limit and filter the output data to what the type defines, which is particularly important for security. When you must return data that does not exactly match the declared type — a dictionary or database object declared as a Pydantic model — use the path operation decorator's response_model parameter instead of the return type annotation; it works in @app.get(), @app.post(), @app.put(), @app.delete(), and the other path operations. Never store or return a plain user password; the tutorial's fix is an input model (UserIn) carrying the password and a separate output model (UserOut) without it. Scope: FastAPI. Reviewed October 4, 2026.