Anything that crosses a trust boundary must be validated or authenticated. Most threats cluster on these lines.
Trust boundary
A line in a diagram where data passes between parts that trust each other differently, for example from the internet into your API.