From 95af4c9de18ebbb686ec2b1291dbf0fa980c9450 Mon Sep 17 00:00:00 2001
From: Tomas Cohen Arazi <tomascohen@theke.io>
Date: Mon, 29 May 2023 12:10:51 -0300
Subject: [PATCH] Bug 33556: Avoid relying on $c->validation

Talking to the OpenAPI plugin maintainer, he mentioned the use of $c->validation->output should be avoided as the plugin is not designed to have a stable behavior there, and he even thought of just removing the method.

That method returns an internal data structure the plugin uses to validate things, and then updates the request itself.

Take the following example:

GET /patrons/123
x-koha-embed: checkouts,library

without the OpenAPI plugin, requesting the header like this:

$c->req->headers->header('x-koha-embed')

would return a scalar, the string 'checkouts,library'.

When using the plugin, and with `x-koha-embed` being defined as collectionFormat: csv, that header is entirely replaced by an arrayref.

That's how the plugin works and how it is expected to be used. So we need to replace the uses of $c->validation format, with normal Mojo usage to avoid future headaches.

This patch changes:
* $c->validation->param => $c->param
* $c->validation->param('body') => $c->req->json

To test:
1. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/*.t
=> SUCCESS: Tests pass!
2. Apply this patches
3. Repeat 1
=> SUCCESS: Tests still pass!
4. Sign off :-D

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
---
 Koha/REST/V1/Acquisitions/Orders.pm           | 37 +++-----------
 Koha/REST/V1/Acquisitions/Vendors.pm          | 17 ++++---
 Koha/REST/V1/AdvancedEditorMacro.pm           | 46 +++++++++--------
 Koha/REST/V1/ArticleRequests.pm               | 14 ++---
 .../REST/V1/Auth/Identity/Provider/Domains.pm | 33 ++++++------
 Koha/REST/V1/Auth/Identity/Providers.pm       | 12 ++---
 Koha/REST/V1/Auth/Password.pm                 |  2 +-
 Koha/REST/V1/AuthorisedValues.pm              |  4 +-
 Koha/REST/V1/Authorities.pm                   |  6 +--
 Koha/REST/V1/BackgroundJobs.pm                |  5 +-
 Koha/REST/V1/Biblios.pm                       | 51 ++++++++++---------
 Koha/REST/V1/Biblios/ItemGroups.pm            | 22 ++++----
 Koha/REST/V1/Biblios/ItemGroups/Items.pm      | 12 ++---
 Koha/REST/V1/CashRegisters/Cashups.pm         | 12 ++---
 Koha/REST/V1/Checkouts.pm                     | 13 ++---
 Koha/REST/V1/Cities.pm                        | 13 +++--
 Koha/REST/V1/Clubs/Holds.pm                   |  4 +-
 Koha/REST/V1/Config/SMTP/Servers.pm           | 10 ++--
 Koha/REST/V1/Holds.pm                         | 46 ++++++++---------
 Koha/REST/V1/Illbackends.pm                   |  2 +-
 Koha/REST/V1/ImportBatchProfiles.pm           | 25 ++++-----
 Koha/REST/V1/ImportRecordMatches.pm           |  7 ++-
 Koha/REST/V1/Items.pm                         | 23 +++++----
 Koha/REST/V1/Libraries.pm                     | 18 +++----
 Koha/REST/V1/OAuth.pm                         |  6 +--
 Koha/REST/V1/Patrons.pm                       | 16 +++---
 Koha/REST/V1/Patrons/Account.pm               | 31 ++++-------
 Koha/REST/V1/Patrons/Attributes.pm            | 23 ++++-----
 Koha/REST/V1/Patrons/Holds.pm                 |  5 +-
 Koha/REST/V1/Patrons/Password.pm              |  8 +--
 Koha/REST/V1/Patrons/Password/Expiration.pm   |  5 +-
 Koha/REST/V1/Quotes.pm                        | 19 +++----
 Koha/REST/V1/ReturnClaims.pm                  | 14 ++---
 Koha/REST/V1/SearchFilter.pm                  | 14 +++--
 Koha/REST/V1/Stage.pm                         |  7 ++-
 Koha/REST/V1/Suggestions.pm                   | 13 ++---
 Koha/REST/V1/Tickets.pm                       | 19 ++++---
 Koha/REST/V1/TransferLimits.pm                | 11 ++--
 Koha/REST/V1/TwoFactorAuth.pm                 |  4 +-
 39 files changed, 289 insertions(+), 340 deletions(-)

diff --git a/Koha/REST/V1/Acquisitions/Orders.pm b/Koha/REST/V1/Acquisitions/Orders.pm
index a9c4f8007c..0155a38922 100644
--- a/Koha/REST/V1/Acquisitions/Orders.pm
+++ b/Koha/REST/V1/Acquisitions/Orders.pm
@@ -95,7 +95,7 @@ Controller function that handles retrieving a single Koha::Acquisition::Order ob
 sub get {
     my $c = shift->openapi->valid_input or return;
 
-    my $order = Koha::Acquisition::Orders->find( $c->validation->param('order_id') );
+    my $order = Koha::Acquisition::Orders->find( $c->param('order_id') );
 
     unless ($order) {
         return $c->render(
@@ -105,11 +105,9 @@ sub get {
     }
 
     return try {
-        my $embed = $c->stash('koha.embed');
-
         return $c->render(
             status  => 200,
-            openapi => $order->to_api({ embed => $embed })
+            openapi => $c->objects->to_api( $order ),
         );
     }
     catch {
@@ -127,7 +125,7 @@ sub add {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $order = Koha::Acquisition::Order->new_from_api( $c->validation->param('body') );
+        my $order = Koha::Acquisition::Order->new_from_api( $c->req->json );
         $order->store->discard_changes;
 
         $c->res->headers->location(
@@ -136,7 +134,7 @@ sub add {
 
         return $c->render(
             status  => 201,
-            openapi => $order->to_api
+            openapi => $c->objects->to_api( $order ),
         );
     }
     catch {
@@ -160,7 +158,7 @@ Controller function that handles updating a Koha::Acquisition::Order object
 sub update {
     my $c = shift->openapi->valid_input or return;
 
-    my $order = Koha::Acquisition::Orders->find( $c->validation->param('order_id') );
+    my $order = Koha::Acquisition::Orders->find( $c->param('order_id') );
 
     unless ($order) {
         return $c->render(
@@ -170,12 +168,12 @@ sub update {
     }
 
     return try {
-        $order->set_from_api( $c->validation->param('body') );
+        $order->set_from_api( $c->req->json );
         $order->store()->discard_changes;
 
         return $c->render(
             status  => 200,
-            openapi => $order->to_api
+            openapi => $c->objects->to_api( $order ),
         );
     }
     catch {
@@ -192,7 +190,7 @@ Controller function that handles deleting a Koha::Patron object
 sub delete {
     my $c = shift->openapi->valid_input or return;
 
-    my $order = Koha::Acquisition::Orders->find( $c->validation->param('order_id') );
+    my $order = Koha::Acquisition::Orders->find( $c->param('order_id') );
 
     unless ($order) {
         return $c->render(
@@ -215,23 +213,4 @@ sub delete {
     };
 }
 
-=head2 Internal methods
-
-=head3 table_name_fixer
-
-    $q = $c->table_name_fixer( $q );
-
-The Koha::Biblio representation includes the biblioitem.* attributes. This is handy
-for API consumers but as they are different tables, converting the queries that mention
-biblioitem columns can be tricky. This method renames known column names as used on Koha's
-UI.
-
-=cut
-
-sub table_name_fixer {
-    my ( $self, $q ) = @_;
-    $q =~ s/biblio\.(?=isbn|ean|publisher)/biblio.biblioitem./g;
-    return $q;
-}
-
 1;
diff --git a/Koha/REST/V1/Acquisitions/Vendors.pm b/Koha/REST/V1/Acquisitions/Vendors.pm
index eb0d4112e2..5ac4833931 100644
--- a/Koha/REST/V1/Acquisitions/Vendors.pm
+++ b/Koha/REST/V1/Acquisitions/Vendors.pm
@@ -62,10 +62,12 @@ Controller function that handles retrieving a single Koha::Acquisition::Booksell
 sub get {
     my $c = shift->openapi->valid_input or return;
 
-    my $vendor = Koha::Acquisition::Booksellers->find( $c->validation->param('vendor_id') );
+    my $vendor = Koha::Acquisition::Booksellers->find( $c->param('vendor_id') );
     unless ($vendor) {
-        return $c->render( status  => 404,
-                           openapi => { error => "Vendor not found" } );
+        return $c->render(
+            status  => 404,
+            openapi => { error => "Vendor not found" }
+        );
     }
 
     return try {
@@ -88,7 +90,7 @@ Controller function that handles adding a new Koha::Acquisition::Bookseller obje
 sub add {
     my $c = shift->openapi->valid_input or return;
 
-    my $vendor = Koha::Acquisition::Bookseller->new_from_api( $c->validation->param('body') );
+    my $vendor = Koha::Acquisition::Bookseller->new_from_api( $c->req->json );
 
     return try {
         $vendor->store;
@@ -115,8 +117,8 @@ sub update {
     my $vendor;
 
     return try {
-        $vendor = Koha::Acquisition::Booksellers->find( $c->validation->param('vendor_id') );
-        $vendor->set_from_api( $c->validation->param('body') );
+        $vendor = Koha::Acquisition::Booksellers->find( $c->param('vendor_id') );
+        $vendor->set_from_api( $c->req->json );
         $vendor->store();
         return $c->render(
             status  => 200,
@@ -132,7 +134,6 @@ sub update {
         }
 
         $c->unhandled_exception($_);
-
     };
 
 }
@@ -147,7 +148,7 @@ sub delete {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $vendor = Koha::Acquisition::Booksellers->find( $c->validation->param('vendor_id') );
+        my $vendor = Koha::Acquisition::Booksellers->find( $c->param('vendor_id') );
 
         unless ( $vendor ) {
             return $c->render(
diff --git a/Koha/REST/V1/AdvancedEditorMacro.pm b/Koha/REST/V1/AdvancedEditorMacro.pm
index 472d4ce87c..093b078605 100644
--- a/Koha/REST/V1/AdvancedEditorMacro.pm
+++ b/Koha/REST/V1/AdvancedEditorMacro.pm
@@ -66,12 +66,12 @@ Controller function that handles retrieving a single Koha::AdvancedEditorMacro
 sub get {
     my $c = shift->openapi->valid_input or return;
     my $patron = $c->stash('koha.user');
-    my $macro = Koha::AdvancedEditorMacros->find({
-        id => $c->validation->param('advancededitormacro_id'),
-    });
+    my $macro  = Koha::AdvancedEditorMacros->find( $c->param('advancededitormacro_id') );
     unless ($macro) {
-        return $c->render( status  => 404,
-                           openapi => { error => "Macro not found" } );
+        return $c->render(
+            status  => 404,
+            openapi => { error => "Macro not found" }
+        );
     }
     if( $macro->shared ){
         return $c->render( status => 403, openapi => {
@@ -97,7 +97,7 @@ sub get_shared {
     my $c = shift->openapi->valid_input or return;
     my $patron = $c->stash('koha.user');
     my $macro = Koha::AdvancedEditorMacros->find({
-        id => $c->validation->param('advancededitormacro_id'),
+        id => $c->param('advancededitormacro_id'),
     });
     unless ($macro) {
         return $c->render( status  => 404,
@@ -120,13 +120,15 @@ Controller function that handles adding a new Koha::AdvancedEditorMacro object
 sub add {
     my $c = shift->openapi->valid_input or return;
 
-    if( defined $c->validation->param('body')->{shared} && $c->validation->param('body')->{shared} == 1 ){
+    my $body = $c->req->json;
+
+    if( defined $body->{shared} && $body->{shared} == 1 ){
         return $c->render( status  => 403,
                            openapi => { error => "To create shared macros you must use advancededitor/shared" } );
     }
 
     return try {
-        my $macro = Koha::AdvancedEditorMacro->new_from_api( $c->validation->param('body') );
+        my $macro = Koha::AdvancedEditorMacro->new_from_api( $body );
         $macro->store->discard_changes;
         $c->res->headers->location( $c->req->url->to_string . '/' . $macro->id );
         return $c->render(
@@ -148,12 +150,14 @@ Controller function that handles adding a new shared Koha::AdvancedEditorMacro o
 sub add_shared {
     my $c = shift->openapi->valid_input or return;
 
-    unless( defined $c->validation->param('body')->{shared} && $c->validation->param('body')->{shared} == 1 ){
+    my $body = $c->req->json;
+
+    unless( defined $body->{shared} && $body->{shared} == 1 ){
         return $c->render( status  => 403,
                            openapi => { error => "To create private macros you must use advancededitor" } );
     }
     return try {
-        my $macro = Koha::AdvancedEditorMacro->new_from_api( $c->validation->param('body') );
+        my $macro = Koha::AdvancedEditorMacro->new_from_api( $body );
         $macro->store->discard_changes;
         $c->res->headers->location( $c->req->url->to_string . '/' . $macro->id );
         return $c->render(
@@ -175,7 +179,7 @@ Controller function that handles updating a Koha::AdvancedEditorMacro object
 sub update {
     my $c = shift->openapi->valid_input or return;
 
-    my $macro = Koha::AdvancedEditorMacros->find( $c->validation->param('advancededitormacro_id') );
+    my $macro = Koha::AdvancedEditorMacros->find( $c->param('advancededitormacro_id') );
 
     if ( not defined $macro ) {
         return $c->render( status  => 404,
@@ -183,7 +187,9 @@ sub update {
     }
     my $patron = $c->stash('koha.user');
 
-    if( $macro->shared == 1 || defined $c->validation->param('body')->{shared} && $c->validation->param('body')->{shared} == 1 ){
+    my $body = $c->req->json;
+
+    if( $macro->shared == 1 || defined $body->{shared} && $body->{shared} == 1 ){
         return $c->render( status  => 403,
                            openapi => { error => "To update a macro as shared you must use the advanced_editor/macros/shared endpoint" } );
     } else {
@@ -194,8 +200,7 @@ sub update {
     }
 
     return try {
-        my $params = $c->req->json;
-        $macro->set_from_api( $params );
+        $macro->set_from_api( $body );
         $macro->store->discard_changes;
         return $c->render( status => 200, openapi => $macro->to_api );
     }
@@ -213,21 +218,22 @@ Controller function that handles updating a shared Koha::AdvancedEditorMacro obj
 sub update_shared {
     my $c = shift->openapi->valid_input or return;
 
-    my $macro = Koha::AdvancedEditorMacros->find( $c->validation->param('advancededitormacro_id') );
+    my $macro = Koha::AdvancedEditorMacros->find( $c->param('advancededitormacro_id') );
+
+    my $body = $c->req->json;
 
     if ( not defined $macro ) {
         return $c->render( status  => 404,
                            openapi => { error => "Object not found" } );
     }
 
-    unless( $macro->shared == 1 || defined $c->validation->param('body')->{shared} && $c->validation->param('body')->{shared} == 1 ){
+    unless( $macro->shared == 1 || defined $body->{shared} && $body->{shared} == 1 ){
         return $c->render( status  => 403,
                            openapi => { error => "You can only update shared macros using this endpoint" } );
     }
 
     return try {
-        my $params = $c->req->json;
-        $macro->set_from_api( $params );
+        $macro->set_from_api( $body );
         $macro->store->discard_changes;
         return $c->render( status => 200, openapi => $macro->to_api );
     }
@@ -245,7 +251,7 @@ Controller function that handles deleting a Koha::AdvancedEditorMacro object
 sub delete {
     my $c = shift->openapi->valid_input or return;
 
-    my $macro = Koha::AdvancedEditorMacros->find( $c->validation->param('advancededitormacro_id') );
+    my $macro = Koha::AdvancedEditorMacros->find( $c->param('advancededitormacro_id') );
     if ( not defined $macro ) {
         return $c->render( status  => 404,
                            openapi => { error => "Object not found" } );
@@ -280,7 +286,7 @@ Controller function that handles deleting a shared Koha::AdvancedEditorMacro obj
 sub delete_shared {
     my $c = shift->openapi->valid_input or return;
 
-    my $macro = Koha::AdvancedEditorMacros->find( $c->validation->param('advancededitormacro_id') );
+    my $macro = Koha::AdvancedEditorMacros->find( $c->param('advancededitormacro_id') );
     if ( not defined $macro ) {
         return $c->render( status  => 404,
                            openapi => { error => "Object not found" } );
diff --git a/Koha/REST/V1/ArticleRequests.pm b/Koha/REST/V1/ArticleRequests.pm
index af6884174e..4419bca673 100644
--- a/Koha/REST/V1/ArticleRequests.pm
+++ b/Koha/REST/V1/ArticleRequests.pm
@@ -42,7 +42,7 @@ Controller function that handles cancelling a Koha::ArticleRequest object
 sub cancel {
     my $c = shift->openapi->valid_input or return;
 
-    my $article_request = Koha::ArticleRequests->find( $c->validation->param('article_request_id') );
+    my $article_request = Koha::ArticleRequests->find( $c->param('article_request_id') );
 
     unless ( $article_request ) {
         return $c->render(
@@ -51,8 +51,8 @@ sub cancel {
         );
     }
 
-    my $reason = $c->validation->param('cancellation_reason');
-    my $notes  = $c->validation->param('notes');
+    my $reason = $c->param('cancellation_reason');
+    my $notes  = $c->param('notes');
 
     return try {
 
@@ -80,7 +80,7 @@ Controller function that handles cancelling a patron's Koha::ArticleRequest obje
 sub patron_cancel {
     my $c = shift->openapi->valid_input or return;
 
-    my $patron = Koha::Patrons->find( $c->validation->param('patron_id') );
+    my $patron = Koha::Patrons->find( $c->param('patron_id') );
 
     unless ( $patron ) {
         return $c->render(
@@ -91,7 +91,7 @@ sub patron_cancel {
 
     # patron_id has been validated by the allow-owner check, so the following call to related
     # article requests covers the case of article requests not belonging to the patron
-    my $article_request = $patron->article_requests->find( $c->validation->param('article_request_id') );
+    my $article_request = $patron->article_requests->find( $c->param('article_request_id') );
 
     unless ( $article_request ) {
         return $c->render(
@@ -100,8 +100,8 @@ sub patron_cancel {
         );
     }
 
-    my $reason = $c->validation->param('cancellation_reason');
-    my $notes  = $c->validation->param('notes');
+    my $reason = $c->param('cancellation_reason');
+    my $notes  = $c->param('notes');
 
     return try {
 
diff --git a/Koha/REST/V1/Auth/Identity/Provider/Domains.pm b/Koha/REST/V1/Auth/Identity/Provider/Domains.pm
index 0cdc7ec140..8ab5304a92 100644
--- a/Koha/REST/V1/Auth/Identity/Provider/Domains.pm
+++ b/Koha/REST/V1/Auth/Identity/Provider/Domains.pm
@@ -44,8 +44,7 @@ sub list {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $identity_provider_id = $c->validation->param('identity_provider_id');
-        my $provider         = Koha::Auth::Identity::Providers->find($identity_provider_id);
+        my $provider = Koha::Auth::Identity::Providers->find( $c->param('identity_provider_id') );
 
         unless ($provider) {
             return $c->render(
@@ -78,8 +77,7 @@ sub get {
 
     return try {
 
-        my $identity_provider_id = $c->validation->param('identity_provider_id');
-        my $provider         = Koha::Auth::Identity::Providers->find($identity_provider_id);
+        my $provider = Koha::Auth::Identity::Providers->find( $c->param('identity_provider_id') );
 
         unless ($provider) {
             return $c->render(
@@ -93,8 +91,7 @@ sub get {
 
         my $domains_rs = $provider->domains;
 
-        my $identity_provider_domain_id = $c->validation->param('identity_provider_domain_id');
-        my $domain                  = $c->objects->find( $domains_rs, $identity_provider_domain_id );
+        my $domain = $c->objects->find( $domains_rs, $c->param('identity_provider_domain_id') );
 
         unless ($domain) {
             return $c->render(
@@ -122,8 +119,8 @@ sub add {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $params = $c->validation->param('body');
-        $params->{identity_provider_id} = $c->validation->param('identity_provider_id');
+        my $params = $c->req->json;
+        $params->{identity_provider_id} = $c->param('identity_provider_id');
         Koha::Database->new->schema->txn_do(
             sub {
                 my $domain = Koha::Auth::Identity::Provider::Domain->new_from_api( $params );
@@ -160,11 +157,12 @@ Controller method for updating an identity provider domain.
 sub update {
     my $c = shift->openapi->valid_input or return;
 
-    my $identity_provider_id        = $c->validation->param('identity_provider_id');
-    my $identity_provider_domain_id = $c->validation->param('identity_provider_domain_id');
-
     my $domain = Koha::Auth::Identity::Provider::Domains->find(
-        { identity_provider_id => $identity_provider_id, identity_provider_domain_id => $identity_provider_domain_id } );
+        {
+            identity_provider_id        => $c->param('identity_provider_id'),
+            identity_provider_domain_id => $c->param('identity_provider_domain_id')
+        }
+    );
 
     unless ($domain) {
         return $c->render(
@@ -181,7 +179,7 @@ sub update {
         Koha::Database->new->schema->txn_do(
             sub {
 
-                $domain->set_from_api( $c->validation->param('body') );
+                $domain->set_from_api( $c->req->json );
                 $domain->store->discard_changes;
 
                 return $c->render(
@@ -204,11 +202,12 @@ Controller method for deleting an identity provider.
 sub delete {
     my $c = shift->openapi->valid_input or return;
 
-    my $identity_provider_id        = $c->validation->param('identity_provider_id');
-    my $identity_provider_domain_id = $c->validation->param('identity_provider_domain_id');
-
     my $domain = Koha::Auth::Identity::Provider::Domains->find(
-        { identity_provider_id => $identity_provider_id, identity_provider_domain_id => $identity_provider_domain_id } );
+        {
+            identity_provider_id        => $c->param('identity_provider_id'),
+            identity_provider_domain_id => $c->param('identity_provider_domain_id')
+        }
+    );
 
     unless ($domain) {
         return $c->render(
diff --git a/Koha/REST/V1/Auth/Identity/Providers.pm b/Koha/REST/V1/Auth/Identity/Providers.pm
index fd8a80fae4..aeefb0320e 100644
--- a/Koha/REST/V1/Auth/Identity/Providers.pm
+++ b/Koha/REST/V1/Auth/Identity/Providers.pm
@@ -66,8 +66,7 @@ sub get {
 
     return try {
 
-        my $identity_provider_id = $c->validation->param('identity_provider_id');
-        my $provider = $c->objects->find( Koha::Auth::Identity::Providers->new, $identity_provider_id );
+        my $provider = $c->objects->find( Koha::Auth::Identity::Providers->new, $c->param('identity_provider_id') );
 
         unless ( $provider ) {
             return $c->render(
@@ -100,7 +99,7 @@ sub add {
         Koha::Database->new->schema->txn_do(
             sub {
 
-                my $body = $c->validation->param('body');
+                my $body = $c->req->json;
 
                 my $config   = delete $body->{config};
                 my $mapping  = delete $body->{mapping};
@@ -147,8 +146,7 @@ Controller method for updating an identity provider.
 sub update {
     my $c = shift->openapi->valid_input or return;
 
-    my $identity_provider_id = $c->validation->param('identity_provider_id');
-    my $provider = Koha::Auth::Identity::Providers->find( $identity_provider_id );
+    my $provider = Koha::Auth::Identity::Providers->find( $c->param('identity_provider_id') );
 
     unless ( $provider ) {
         return $c->render(
@@ -165,7 +163,7 @@ sub update {
         Koha::Database->new->schema->txn_do(
             sub {
 
-                my $body = $c->validation->param('body');
+                my $body = $c->req->json;
 
                 my $config   = delete $body->{config};
                 my $mapping  = delete $body->{mapping};
@@ -211,7 +209,7 @@ Controller method for deleting an identity provider.
 sub delete {
     my $c = shift->openapi->valid_input or return;
 
-    my $provider = Koha::Auth::Identity::Providers->find( $c->validation->param('identity_provider_id') );
+    my $provider = Koha::Auth::Identity::Providers->find( $c->param('identity_provider_id') );
     unless ( $provider ) {
         return $c->render(
             status  => 404,
diff --git a/Koha/REST/V1/Auth/Password.pm b/Koha/REST/V1/Auth/Password.pm
index 9c99fd230c..6ed7073921 100644
--- a/Koha/REST/V1/Auth/Password.pm
+++ b/Koha/REST/V1/Auth/Password.pm
@@ -40,7 +40,7 @@ Controller method that checks a patron's password
 
 sub validate {
     my $c = shift->openapi->valid_input or return;
-    my $body   = $c->validation->param('body');
+    my $body   = $c->req->json;
     my $userid = $body->{userid} // '';
     my $patron = Koha::Patrons->find({ userid => $userid });
 
diff --git a/Koha/REST/V1/AuthorisedValues.pm b/Koha/REST/V1/AuthorisedValues.pm
index 56ce3277e6..3a4706f668 100644
--- a/Koha/REST/V1/AuthorisedValues.pm
+++ b/Koha/REST/V1/AuthorisedValues.pm
@@ -36,9 +36,7 @@ This routine returns the authorised values for a given category
 sub list_av_from_category {
     my $c = shift->openapi->valid_input or return;
 
-    my $category_name = $c->validation->param('authorised_value_category_name');
-
-    my $category = Koha::AuthorisedValueCategories->find($category_name);
+    my $category = Koha::AuthorisedValueCategories->find($c->param('authorised_value_category_name'));
 
     unless ($category) {
         return $c->render(
diff --git a/Koha/REST/V1/Authorities.pm b/Koha/REST/V1/Authorities.pm
index 52244d025d..a671c81d1c 100644
--- a/Koha/REST/V1/Authorities.pm
+++ b/Koha/REST/V1/Authorities.pm
@@ -40,7 +40,7 @@ Controller function that handles retrieving a single authority object
 sub get {
     my $c = shift->openapi->valid_input or return;
 
-    my $authority = Koha::Authorities->find( { authid => $c->validation->param('authority_id') } );
+    my $authority = Koha::Authorities->find( { authid => $c->param('authority_id') } );
     unless ( $authority ) {
         return $c->render(
             status  => 404,
@@ -109,7 +109,7 @@ Controller function that handles deleting an authority object
 sub delete {
     my $c = shift->openapi->valid_input or return;
 
-    my $authority = Koha::Authorities->find( { authid => $c->validation->param('authority_id') } );
+    my $authority = Koha::Authorities->find( { authid => $c->param('authority_id') } );
 
     if ( not defined $authority ) {
         return $c->render(
@@ -203,7 +203,7 @@ Controller function that handles modifying an authority object
 sub update {
     my $c = shift->openapi->valid_input or return;
 
-    my $authid = $c->validation->param('authority_id');
+    my $authid = $c->param('authority_id');
     my $authority = Koha::Authorities->find( { authid => $authid } );
 
     if ( not defined $authority ) {
diff --git a/Koha/REST/V1/BackgroundJobs.pm b/Koha/REST/V1/BackgroundJobs.pm
index 4db1ea3f3f..eb672dbc9c 100644
--- a/Koha/REST/V1/BackgroundJobs.pm
+++ b/Koha/REST/V1/BackgroundJobs.pm
@@ -38,7 +38,8 @@ sub list {
 
     return try {
 
-        my $only_current = delete $c->validation->output->{only_current};
+        my $only_current = $c->param('only_current');
+        $c->req->params->remove('only_current');
 
         my $bj_rs = Koha::BackgroundJobs->new;
 
@@ -66,7 +67,7 @@ sub get {
 
     return try {
 
-        my $job_id = $c->validation->param('job_id');
+        my $job_id = $c->param('job_id');
         my $patron = $c->stash('koha.user');
 
         my $can_manage_background_jobs =
diff --git a/Koha/REST/V1/Biblios.pm b/Koha/REST/V1/Biblios.pm
index ca58870e3d..eef084bc2c 100644
--- a/Koha/REST/V1/Biblios.pm
+++ b/Koha/REST/V1/Biblios.pm
@@ -53,7 +53,7 @@ sub get {
     $attributes = { prefetch => [ 'metadata' ] } # don't prefetch metadata if not needed
         unless $c->req->headers->accept =~ m/application\/json/;
 
-    my $biblio = Koha::Biblios->find( { biblionumber => $c->validation->param('biblio_id') }, $attributes );
+    my $biblio = Koha::Biblios->find( { biblionumber => $c->param('biblio_id') }, $attributes );
 
     unless ( $biblio ) {
         return $c->render(
@@ -125,7 +125,7 @@ Controller function that handles deleting a biblio object
 sub delete {
     my $c = shift->openapi->valid_input or return;
 
-    my $biblio = Koha::Biblios->find( $c->validation->param('biblio_id') );
+    my $biblio = Koha::Biblios->find( $c->param('biblio_id') );
 
     if ( not defined $biblio ) {
         return $c->render(
@@ -162,7 +162,7 @@ sub get_public {
     my $c = shift->openapi->valid_input or return;
 
     my $biblio = Koha::Biblios->find(
-        { biblionumber => $c->validation->param('biblio_id') },
+        { biblionumber => $c->param('biblio_id') },
         { prefetch     => ['metadata'] } );
 
     unless ($biblio) {
@@ -255,7 +255,7 @@ Controller function that handles retrieving biblio's items
 sub get_items {
     my $c = shift->openapi->valid_input or return;
 
-    my $biblio = Koha::Biblios->find( { biblionumber => $c->validation->param('biblio_id') }, { prefetch => ['items'] } );
+    my $biblio = Koha::Biblios->find( { biblionumber => $c->param('biblio_id') }, { prefetch => ['items'] } );
 
     unless ( $biblio ) {
         return $c->render(
@@ -268,8 +268,7 @@ sub get_items {
 
     return try {
 
-        my $items_rs = $biblio->items;
-        my $items    = $c->objects->search( $items_rs );
+        my $items = $c->objects->search( $biblio->items );
         return $c->render(
             status  => 200,
             openapi => $items
@@ -290,7 +289,7 @@ sub add_item {
     my $c = shift->openapi->valid_input or return;
 
     try {
-        my $biblio_id = $c->validation->param('biblio_id');
+        my $biblio_id = $c->param('biblio_id');
         my $biblio    = Koha::Biblios->find( $biblio_id );
 
         unless ($biblio) {
@@ -300,7 +299,7 @@ sub add_item {
             );
         }
 
-        my $body = $c->validation->param('body');
+        my $body = $c->req->json;
 
         $body->{biblio_id} = $biblio_id;
 
@@ -403,9 +402,9 @@ sub update_item {
     my $c = shift->openapi->valid_input or return;
 
     try {
-        my $biblio_id = $c->validation->param('biblio_id');
-        my $item_id = $c->validation->param('item_id');
-        my $biblio = Koha::Biblios->find({ biblionumber => $biblio_id });
+        my $biblio_id = $c->param('biblio_id');
+        my $item_id   = $c->param('item_id');
+        my $biblio    = Koha::Biblios->find( { biblionumber => $biblio_id } );
         unless ($biblio) {
             return $c->render(
                 status  => 404,
@@ -422,7 +421,7 @@ sub update_item {
             );
         }
 
-        my $body = $c->validation->param('body');
+        my $body = $c->req->json;
 
         $body->{biblio_id} = $biblio_id;
 
@@ -458,10 +457,11 @@ List Koha::Checkout objects
 sub get_checkouts {
     my $c = shift->openapi->valid_input or return;
 
-    my $checked_in = delete $c->validation->output->{checked_in};
+    my $checked_in = $c->param('checked_in');
+    $c->req->params->remove('checked_in');
 
     try {
-        my $biblio = Koha::Biblios->find( $c->validation->param('biblio_id') );
+        my $biblio = Koha::Biblios->find( $c->param('biblio_id') );
 
         unless ($biblio) {
             return $c->render(
@@ -495,8 +495,7 @@ used for building the dropdown selector
 sub pickup_locations {
     my $c = shift->openapi->valid_input or return;
 
-    my $biblio_id = $c->validation->param('biblio_id');
-    my $biblio = Koha::Biblios->find( $biblio_id );
+    my $biblio = Koha::Biblios->find( $c->param('biblio_id') );
 
     unless ($biblio) {
         return $c->render(
@@ -505,8 +504,8 @@ sub pickup_locations {
         );
     }
 
-    my $patron_id = delete $c->validation->output->{patron_id};
-    my $patron    = Koha::Patrons->find( $patron_id );
+    my $patron = Koha::Patrons->find( $c->param('patron_id') );
+    $c->req->params->remove('patron_id');
 
     unless ($patron) {
         return $c->render(
@@ -562,7 +561,10 @@ access.
 sub get_items_public {
     my $c = shift->openapi->valid_input or return;
 
-    my $biblio = Koha::Biblios->find( { biblionumber => $c->validation->param('biblio_id') }, { prefetch => ['items'] } );
+    my $biblio = Koha::Biblios->find(
+        $c->param('biblio_id'),
+        { prefetch => ['items'] }
+    );
 
     unless ( $biblio ) {
         return $c->render(
@@ -599,7 +601,7 @@ Set rating for the logged in user
 sub set_rating {
     my $c = shift->openapi->valid_input or return;
 
-    my $biblio = Koha::Biblios->find( $c->validation->param('biblio_id') );
+    my $biblio = Koha::Biblios->find( $c->param('biblio_id') );
 
     unless ($biblio) {
         return $c->render(
@@ -619,7 +621,7 @@ sub set_rating {
         );
     }
 
-    my $body   = $c->validation->param('body');
+    my $body         = $c->req->json;
     my $rating_value = $body->{rating};
 
     return try {
@@ -733,8 +735,7 @@ Controller function that handles modifying an biblio object
 sub update {
     my $c = shift->openapi->valid_input or return;
 
-    my $biblio_id = $c->param('biblio_id');
-    my $biblio    = Koha::Biblios->find($biblio_id);
+    my $biblio = Koha::Biblios->find( $c->param('biblio_id') );
 
     if ( ! defined $biblio ) {
         return $c->render(
@@ -776,11 +777,11 @@ sub update {
             );
         }
 
-        ModBiblio( $record, $biblio_id, $frameworkcode );
+        ModBiblio( $record, $biblio->id, $frameworkcode );
 
         $c->render(
             status  => 200,
-            openapi => { id => $biblio_id }
+            openapi => { id => $biblio->id }
         );
     }
     catch {
diff --git a/Koha/REST/V1/Biblios/ItemGroups.pm b/Koha/REST/V1/Biblios/ItemGroups.pm
index b81eee7620..c38de5251e 100644
--- a/Koha/REST/V1/Biblios/ItemGroups.pm
+++ b/Koha/REST/V1/Biblios/ItemGroups.pm
@@ -42,9 +42,8 @@ Controller function that handles listing Koha::Biblio::ItemGroup objects
 
 sub list {
     my $c = shift->openapi->valid_input or return;
-    my $biblio_id = $c->validation->param('biblio_id');
 
-    my $biblio=Koha::Biblios->find( $biblio_id);
+    my $biblio = Koha::Biblios->find( $c->param('biblio_id') );
 
     return try {
 #my $item_groups_set = Koha::Biblio::ItemGroups->new;
@@ -70,8 +69,8 @@ sub get {
     my $c = shift->openapi->valid_input or return;
 
     try {
-        my $item_group_id = $c->validation->param('item_group_id');
-        my $biblio_id = $c->validation->param('biblio_id');
+        my $item_group_id = $c->param('item_group_id');
+        my $biblio_id     = $c->param('biblio_id');
 
         my $item_group = $c->objects->find( Koha::Biblio::ItemGroups->new, $item_group_id );
 
@@ -154,8 +153,8 @@ sub update {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $item_group_id = $c->validation->param('item_group_id');
-        my $biblio_id     = $c->validation->param('biblio_id');
+        my $item_group_id = $c->param('item_group_id');
+        my $biblio_id     = $c->param('biblio_id');
 
         my $item_group = Koha::Biblio::ItemGroups->find( $item_group_id );
 
@@ -168,7 +167,7 @@ sub update {
             );
         }
 
-        my $item_group_data = $c->validation->param('body');
+        my $item_group_data = $c->req->json;
         $item_group->set_from_api( $item_group_data )->store->discard_changes();
 
         return $c->render(
@@ -204,11 +203,12 @@ sub delete {
 
     my $c = shift->openapi->valid_input or return;
 
-    my $item_group_id = $c->validation->param('item_group_id');
-    my $biblio_id     = $c->validation->param('biblio_id');
-
     my $item_group = Koha::Biblio::ItemGroups->find(
-        { item_group_id => $item_group_id, biblio_id => $biblio_id } );
+        {
+            item_group_id => $c->param('item_group_id'),
+            biblio_id     => $c->param('biblio_id')
+        }
+    );
 
     if ( not defined $item_group ) {
         return $c->render(
diff --git a/Koha/REST/V1/Biblios/ItemGroups/Items.pm b/Koha/REST/V1/Biblios/ItemGroups/Items.pm
index a946e5fefc..c241962207 100644
--- a/Koha/REST/V1/Biblios/ItemGroups/Items.pm
+++ b/Koha/REST/V1/Biblios/ItemGroups/Items.pm
@@ -43,9 +43,7 @@ sub add {
 
     return try {
 
-        my $item_group = Koha::Biblio::ItemGroups->find(
-            $c->validation->param('item_group_id')
-        );
+        my $item_group = Koha::Biblio::ItemGroups->find( $c->param('item_group_id') );
 
         unless ( $item_group ) {
             return $c->render(
@@ -56,7 +54,7 @@ sub add {
             );
         }
 
-        unless ( $item_group->biblio_id eq $c->validation->param('biblio_id') ) {
+        unless ( $item_group->biblio_id eq $c->param('biblio_id') ) {
             return $c->render(
                 status  => 409,
                 openapi => {
@@ -66,7 +64,7 @@ sub add {
         }
 
         # All good, add the item
-        my $body    = $c->validation->param('body');
+        my $body    = $c->req->json;
         my $item_id = $body->{item_id};
 
         $item_group->add_item({ item_id => $item_id });
@@ -125,8 +123,8 @@ Controller function that handles unlinking an item from a Koha::Biblio::ItemGrou
 sub delete {
     my $c = shift->openapi->valid_input or return;
 
-    my $item_group_id = $c->validation->param('item_group_id');
-    my $item_id       = $c->validation->param('item_id');
+    my $item_group_id = $c->param('item_group_id');
+    my $item_id       = $c->param('item_id');
 
     my $item_link = Koha::Biblio::ItemGroup::Items->find(
         {
diff --git a/Koha/REST/V1/CashRegisters/Cashups.pm b/Koha/REST/V1/CashRegisters/Cashups.pm
index 12b6f30214..f3cf06dae7 100644
--- a/Koha/REST/V1/CashRegisters/Cashups.pm
+++ b/Koha/REST/V1/CashRegisters/Cashups.pm
@@ -40,11 +40,7 @@ Controller function that handles retrieving a cash registers cashup actions
 sub list {
     my $c = shift->openapi->valid_input or return;
 
-    my $register = Koha::Cash::Registers->find(
-        {
-            id => $c->validation->param('cash_register_id')
-        }
-    );
+    my $register = Koha::Cash::Registers->find( $c->param('cash_register_id') );
 
     unless ($register) {
         return $c->render(
@@ -56,8 +52,7 @@ sub list {
     }
 
     return try {
-        my $cashups_rs = $register->cashups;
-        my $cashups    = $c->objects->search($cashups_rs);
+        my $cashups = $c->objects->search( $register->cashups );
         return $c->render( status => 200, openapi => $cashups );
     }
     catch {
@@ -75,8 +70,7 @@ sub get {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $cashup = Koha::Cash::Register::Cashups->find(
-            $c->validation->param('cashup_id') );
+        my $cashup = Koha::Cash::Register::Cashups->find( $c->param('cashup_id') );
         unless ($cashup) {
             return $c->render(
                 status  => 404,
diff --git a/Koha/REST/V1/Checkouts.pm b/Koha/REST/V1/Checkouts.pm
index bf5b2d5153..e94d027e49 100644
--- a/Koha/REST/V1/Checkouts.pm
+++ b/Koha/REST/V1/Checkouts.pm
@@ -46,7 +46,8 @@ List Koha::Checkout objects
 sub list {
     my $c = shift->openapi->valid_input or return;
 
-    my $checked_in = delete $c->validation->output->{checked_in};
+    my $checked_in = $c->param('checked_in');
+    $c->req->params->remove('checked_in');
 
     try {
         my $checkouts_set;
@@ -77,7 +78,7 @@ get one checkout
 sub get {
     my $c = shift->openapi->valid_input or return;
 
-    my $checkout_id = $c->validation->param('checkout_id');
+    my $checkout_id = $c->param('checkout_id');
     my $checkout = Koha::Checkouts->find( $checkout_id );
     $checkout = Koha::Old::Checkouts->find( $checkout_id )
         unless ($checkout);
@@ -293,7 +294,7 @@ sub get_renewals {
     my $c = shift->openapi->valid_input or return;
 
     try {
-        my $checkout_id = $c->validation->param('checkout_id');
+        my $checkout_id = $c->param('checkout_id');
         my $checkout    = Koha::Checkouts->find($checkout_id);
         $checkout = Koha::Old::Checkouts->find($checkout_id)
           unless ($checkout);
@@ -328,8 +329,8 @@ Renew a checkout
 sub renew {
     my $c = shift->openapi->valid_input or return;
 
-    my $checkout_id = $c->validation->param('checkout_id');
-    my $seen = $c->validation->param('seen') || 1;
+    my $checkout_id = $c->param('checkout_id');
+    my $seen = $c->param('seen') || 1;
     my $checkout = Koha::Checkouts->find( $checkout_id );
 
     unless ($checkout) {
@@ -379,7 +380,7 @@ Checks if the checkout could be renewed and return the related information.
 sub allows_renewal {
     my $c = shift->openapi->valid_input or return;
 
-    my $checkout_id = $c->validation->param('checkout_id');
+    my $checkout_id = $c->param('checkout_id');
     my $checkout = Koha::Checkouts->find( $checkout_id );
 
     unless ($checkout) {
diff --git a/Koha/REST/V1/Cities.pm b/Koha/REST/V1/Cities.pm
index 3dfc91d56f..fccb013b24 100644
--- a/Koha/REST/V1/Cities.pm
+++ b/Koha/REST/V1/Cities.pm
@@ -35,8 +35,7 @@ sub list {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $cities_set = Koha::Cities->new;
-        my $cities = $c->objects->search( $cities_set );
+        my $cities = $c->objects->search( Koha::Cities->new );
         return $c->render( status => 200, openapi => $cities );
     }
     catch {
@@ -53,7 +52,7 @@ sub get {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $city = Koha::Cities->find( $c->validation->param('city_id') );
+        my $city = Koha::Cities->find( $c->param('city_id') );
         unless ($city) {
             return $c->render( status  => 404,
                             openapi => { error => "City not found" } );
@@ -74,7 +73,7 @@ sub add {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $city = Koha::City->new_from_api( $c->validation->param('body') );
+        my $city = Koha::City->new_from_api( $c->req->json );
         $city->store;
         $c->res->headers->location( $c->req->url->to_string . '/' . $city->cityid );
         return $c->render(
@@ -94,7 +93,7 @@ sub add {
 sub update {
     my $c = shift->openapi->valid_input or return;
 
-    my $city = Koha::Cities->find( $c->validation->param('city_id') );
+    my $city = Koha::Cities->find( $c->param('city_id') );
 
     if ( not defined $city ) {
         return $c->render( status  => 404,
@@ -102,7 +101,7 @@ sub update {
     }
 
     return try {
-        $city->set_from_api( $c->validation->param('body') );
+        $city->set_from_api( $c->req->json );
         $city->store();
         return $c->render( status => 200, openapi => $city->to_api );
     }
@@ -118,7 +117,7 @@ sub update {
 sub delete {
     my $c = shift->openapi->valid_input or return;
 
-    my $city = Koha::Cities->find( $c->validation->param('city_id') );
+    my $city = Koha::Cities->find( $c->param('city_id') );
     if ( not defined $city ) {
         return $c->render( status  => 404,
                            openapi => { error => "Object not found" } );
diff --git a/Koha/REST/V1/Clubs/Holds.pm b/Koha/REST/V1/Clubs/Holds.pm
index 7af5602a81..d2111f9cee 100644
--- a/Koha/REST/V1/Clubs/Holds.pm
+++ b/Koha/REST/V1/Clubs/Holds.pm
@@ -44,8 +44,8 @@ sub add {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $body    = $c->validation->param('body');
-        my $club_id = $c->validation->param('club_id');
+        my $body    = $c->req->json;
+        my $club_id = $c->param('club_id');
 
         my $biblio;
 
diff --git a/Koha/REST/V1/Config/SMTP/Servers.pm b/Koha/REST/V1/Config/SMTP/Servers.pm
index 5949c535f4..c5974e929a 100644
--- a/Koha/REST/V1/Config/SMTP/Servers.pm
+++ b/Koha/REST/V1/Config/SMTP/Servers.pm
@@ -59,7 +59,7 @@ sub get {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $smtp_server = Koha::SMTP::Servers->find( $c->validation->param('smtp_server_id') );
+        my $smtp_server = Koha::SMTP::Servers->find( $c->param('smtp_server_id') );
 
         unless ($smtp_server) {
             return $c->render(
@@ -93,7 +93,7 @@ sub add {
 
     return try {
 
-        my $smtp_server = Koha::SMTP::Server->new_from_api( $c->validation->param('body') );
+        my $smtp_server = Koha::SMTP::Server->new_from_api( $c->req->json );
         $smtp_server->store->discard_changes;
 
         $c->res->headers->location( $c->req->url->to_string . '/' . $smtp_server->id );
@@ -127,7 +127,7 @@ Controller method that handles updating a Koha::SMTP::Server object
 sub update {
     my $c = shift->openapi->valid_input or return;
 
-    my $smtp_server = Koha::SMTP::Servers->find( $c->validation->param('smtp_server_id') );
+    my $smtp_server = Koha::SMTP::Servers->find( $c->param('smtp_server_id') );
 
     if ( not defined $smtp_server ) {
         return $c->render(
@@ -139,7 +139,7 @@ sub update {
     }
 
     return try {
-        $smtp_server->set_from_api( $c->validation->param('body') );
+        $smtp_server->set_from_api( $c->req->json );
         $smtp_server->store->discard_changes;
 
         return $c->render(
@@ -171,7 +171,7 @@ Controller method that handles deleting a Koha::SMTP::Server object
 sub delete {
     my $c = shift->openapi->valid_input or return;
 
-    my $smtp_server = Koha::SMTP::Servers->find( $c->validation->param('smtp_server_id') );
+    my $smtp_server = Koha::SMTP::Servers->find( $c->param('smtp_server_id') );
 
     if ( not defined $smtp_server ) {
         return $c->render( status  => 404,
diff --git a/Koha/REST/V1/Holds.pm b/Koha/REST/V1/Holds.pm
index a8a998ef12..00f761511d 100644
--- a/Koha/REST/V1/Holds.pm
+++ b/Koha/REST/V1/Holds.pm
@@ -45,8 +45,7 @@ sub list {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $holds_set = Koha::Holds->new;
-        my $holds     = $c->objects->search( $holds_set );
+        my $holds = $c->objects->search( Koha::Holds->new );
         return $c->render( status => 200, openapi => $holds );
     }
     catch {
@@ -64,7 +63,7 @@ sub add {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $body = $c->validation->param('body');
+        my $body = $c->req->json;
 
         my $biblio;
         my $item;
@@ -247,8 +246,7 @@ sub edit {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $hold_id = $c->validation->param('hold_id');
-        my $hold = Koha::Holds->find( $hold_id );
+        my $hold = Koha::Holds->find( $c->param('hold_id') );
 
         unless ($hold) {
             return $c->render(
@@ -260,7 +258,7 @@ sub edit {
         my $overrides = $c->stash('koha.overrides');
         my $can_override = $overrides->{any} && C4::Context->preference('AllowHoldPolicyOverride');
 
-        my $body = $c->validation->output->{body};
+        my $body = $c->req->json;
 
         my $pickup_library_id = $body->{pickup_library_id};
 
@@ -283,7 +281,7 @@ sub edit {
         my $suspended_until = $body->{suspended_until} || $hold->suspend_until;
 
         my $params = {
-            reserve_id    => $hold_id,
+            reserve_id    => $hold->id,
             branchcode    => $pickup_library_id,
             rank          => $priority,
             suspend_until => $suspended_until,
@@ -312,8 +310,7 @@ Method that handles deleting a Koha::Hold object
 sub delete {
     my $c = shift->openapi->valid_input or return;
 
-    my $hold_id = $c->validation->param('hold_id');
-    my $hold    = Koha::Holds->find($hold_id);
+    my $hold = Koha::Holds->find($c->param('hold_id'));
 
     unless ($hold) {
         return $c->render( status => 404, openapi => { error => "Hold not found." } );
@@ -341,9 +338,9 @@ Method that handles suspending a hold
 sub suspend {
     my $c = shift->openapi->valid_input or return;
 
-    my $hold_id  = $c->validation->param('hold_id');
-    my $hold     = Koha::Holds->find($hold_id);
-    my $body     = $c->req->json;
+    my $hold = Koha::Holds->find( $c->param('hold_id') );
+    my $body = $c->req->json;
+
     my $end_date = ($body) ? $body->{end_date} : undef;
 
     unless ($hold) {
@@ -381,9 +378,8 @@ Method that handles resuming a hold
 sub resume {
     my $c = shift->openapi->valid_input or return;
 
-    my $hold_id = $c->validation->param('hold_id');
-    my $hold    = Koha::Holds->find($hold_id);
-    my $body    = $c->req->json;
+    my $hold = Koha::Holds->find($c->param('hold_id'));
+    my $body = $c->req->json;
 
     unless ($hold) {
         return $c->render( status => 404, openapi => { error => 'Hold not found.' } );
@@ -407,8 +403,7 @@ Method that handles modifying a Koha::Hold object
 sub update_priority {
     my $c = shift->openapi->valid_input or return;
 
-    my $hold_id = $c->validation->param('hold_id');
-    my $hold = Koha::Holds->find($hold_id);
+    my $hold = Koha::Holds->find($c->param('hold_id'));
 
     unless ($hold) {
         return $c->render(
@@ -421,7 +416,7 @@ sub update_priority {
         my $priority = $c->req->json;
         C4::Reserves::_FixPriority(
             {
-                reserve_id => $hold_id,
+                reserve_id => $hold->id,
                 rank       => $priority
             }
         );
@@ -443,8 +438,7 @@ used for building the dropdown selector
 sub pickup_locations {
     my $c = shift->openapi->valid_input or return;
 
-    my $hold_id = $c->validation->param('hold_id');
-    my $hold = Koha::Holds->find( $hold_id, { prefetch => [ 'patron' ] } );
+    my $hold = Koha::Holds->find( $c->param('hold_id'), { prefetch => [ 'patron' ] } );
 
     unless ($hold) {
         return $c->render(
@@ -509,11 +503,7 @@ Method that handles modifying the pickup location of a Koha::Hold object
 sub update_pickup_location {
     my $c = shift->openapi->valid_input or return;
 
-    my $hold_id = $c->validation->param('hold_id');
-    my $body    = $c->validation->param('body');
-    my $pickup_library_id = $body->{pickup_library_id};
-
-    my $hold = Koha::Holds->find($hold_id);
+    my $hold = Koha::Holds->find($c->param('hold_id'));
 
     unless ($hold) {
         return $c->render(
@@ -522,8 +512,13 @@ sub update_pickup_location {
         );
     }
 
+
     return try {
 
+        my $body = $c->req->json;
+
+        my $pickup_library_id = $body->{pickup_library_id};
+
         my $overrides    = $c->stash('koha.overrides');
         my $can_override = $overrides->{any} && C4::Context->preference('AllowHoldPolicyOverride');
 
@@ -556,5 +551,4 @@ sub update_pickup_location {
     };
 }
 
-
 1;
diff --git a/Koha/REST/V1/Illbackends.pm b/Koha/REST/V1/Illbackends.pm
index 02096db565..8b70d9368e 100644
--- a/Koha/REST/V1/Illbackends.pm
+++ b/Koha/REST/V1/Illbackends.pm
@@ -62,7 +62,7 @@ Get one backend
 sub get {
     my $c = shift->openapi->valid_input;
 
-    my $backend_id = $c->validation->param('ill_backend_id');
+    my $backend_id = $c->param('ill_backend_id');
 
     return try {
 
diff --git a/Koha/REST/V1/ImportBatchProfiles.pm b/Koha/REST/V1/ImportBatchProfiles.pm
index 2da99c6c17..9d951ea399 100644
--- a/Koha/REST/V1/ImportBatchProfiles.pm
+++ b/Koha/REST/V1/ImportBatchProfiles.pm
@@ -44,10 +44,9 @@ sub list {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $profiles_set = Koha::ImportBatchProfiles->new;
-        my $profiles = $c->objects->search( $profiles_set );
+        my $profiles = $c->objects->search( Koha::ImportBatchProfiles->new );
         return $c->render(
-            status => 200,
+            status  => 200,
             openapi => $profiles
         );
     }
@@ -65,7 +64,7 @@ Method that handles adding a new Koha::ImportBatchProfile object
 sub add {
     my $c = shift->openapi->valid_input or return;
 
-    my $body = $c->validation->param('body');
+    my $body = $c->req->json;
 
     return try {
         my $profile = Koha::ImportBatchProfile->new_from_api( $body )->store;
@@ -89,19 +88,18 @@ sub edit {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $profile_id = $c->validation->param('import_batch_profile_id');
-        my $profile = Koha::ImportBatchProfiles->find( $profile_id );
+        my $profile = Koha::ImportBatchProfiles->find( $c->param('import_batch_profile_id') );
         unless ($profile) {
-            return $c->render( status  => 404,
-                            openapi => {error => "Import batch profile not found"} );
+            return $c->render(
+                status  => 404,
+                openapi => {error => "Import batch profile not found"}
+            );
         }
 
-        my $body = $c->req->json;
-
-        $profile->set_from_api($body)->store;
+        $profile->set_from_api($c->req->json)->store;
 
         return $c->render(
-            status => 200,
+            status  => 200,
             openapi => $profile->to_api
         );
     }
@@ -119,8 +117,7 @@ Method that handles deleting a Koha::ImportBatchProfile object
 sub delete {
     my $c = shift->openapi->valid_input or return;
 
-    my $profile_id = $c->validation->param('import_batch_profile_id');
-    my $profile = Koha::ImportBatchProfiles->find( $profile_id );
+    my $profile = Koha::ImportBatchProfiles->find( $c->param('import_batch_profile_id') );
 
     unless ($profile) {
         return $c->render( status  => 404,
diff --git a/Koha/REST/V1/ImportRecordMatches.pm b/Koha/REST/V1/ImportRecordMatches.pm
index b414a091ef..64ffd1f8dd 100644
--- a/Koha/REST/V1/ImportRecordMatches.pm
+++ b/Koha/REST/V1/ImportRecordMatches.pm
@@ -40,9 +40,8 @@ DELETE /api/v1/import_batches/{import_batch_id}/records/{import_record_id}/match
 sub unset_chosen {
     my $c = shift->openapi->valid_input or return;
 
-    my $import_record_id = $c->validation->param('import_record_id');
     my $matches = Koha::Import::Record::Matches->search({
-        import_record_id => $import_record_id,
+        import_record_id => $c->param('import_record_id'),
     });
     unless ($matches) {
         return $c->render(
@@ -72,8 +71,8 @@ Body should contain the condidate_match_id to chose
 sub set_chosen {
     my $c = shift->openapi->valid_input or return;
 
-    my $import_record_id = $c->validation->param('import_record_id');
-    my $body    = $c->validation->param('body');
+    my $import_record_id = $c->param('import_record_id');
+    my $body = $c->req->json;
     my $candidate_match_id = $body->{'candidate_match_id'};
 
     my $match = Koha::Import::Record::Matches->find({
diff --git a/Koha/REST/V1/Items.pm b/Koha/REST/V1/Items.pm
index 52c95f59f5..3079135286 100644
--- a/Koha/REST/V1/Items.pm
+++ b/Koha/REST/V1/Items.pm
@@ -95,7 +95,7 @@ sub get {
 
     try {
         my $items_rs = Koha::Items->new;
-        my $item = $c->objects->find($items_rs, $c->validation->param('item_id'));
+        my $item = $c->objects->find($items_rs, $c->param('item_id'));
         unless ( $item ) {
             return $c->render(
                 status => 404,
@@ -119,7 +119,7 @@ sub delete {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $item = Koha::Items->find($c->validation->param('item_id'));
+        my $item = Koha::Items->find($c->param('item_id'));
         unless ( $item ) {
             return $c->render(
                 status => 404,
@@ -184,7 +184,7 @@ used for building the dropdown selector
 sub pickup_locations {
     my $c = shift->openapi->valid_input or return;
 
-    my $item_id = $c->validation->param('item_id');
+    my $item_id = $c->param('item_id');
     my $item = Koha::Items->find( $item_id );
 
     unless ($item) {
@@ -194,9 +194,11 @@ sub pickup_locations {
         );
     }
 
-    my $patron_id = delete $c->validation->output->{patron_id};
+    my $patron_id = $c->param('patron_id');
     my $patron    = Koha::Patrons->find( $patron_id );
 
+    $c->req->params->remove('patron_id');
+
     unless ($patron) {
         return $c->render(
             status  => 400,
@@ -250,7 +252,7 @@ Controller function that handles bundled_items Koha::Item objects
 sub bundled_items {
     my $c = shift->openapi->valid_input or return;
 
-    my $item_id = $c->validation->param('item_id');
+    my $item_id = $c->param('item_id');
     my $item = Koha::Items->find( $item_id );
 
     unless ($item) {
@@ -282,7 +284,7 @@ Controller function that handles adding items to this bundle
 sub add_to_bundle {
     my $c = shift->openapi->valid_input or return;
 
-    my $item_id = $c->validation->param('item_id');
+    my $item_id = $c->param('item_id');
     my $item = Koha::Items->find( $item_id );
 
     unless ($item) {
@@ -292,7 +294,9 @@ sub add_to_bundle {
         );
     }
 
-    my $bundle_item_id = $c->validation->param('body')->{'external_id'};
+    my $body = $c->req->json;
+
+    my $bundle_item_id = $body->{'external_id'};
     $bundle_item_id = barcodedecode($bundle_item_id);
     my $bundle_item = Koha::Items->find( { barcode => $bundle_item_id } );
 
@@ -304,7 +308,6 @@ sub add_to_bundle {
     }
 
     return try {
-        my $body = $c->validation->param('body');
         my $options = {
             force_checkin => $body->{force_checkin},
             ignore_holds => $body->{ignore_holds},
@@ -386,7 +389,7 @@ Controller function that handles removing items from this bundle
 sub remove_from_bundle {
     my $c = shift->openapi->valid_input or return;
 
-    my $item_id = $c->validation->param('item_id');
+    my $item_id = $c->param('item_id');
     my $item = Koha::Items->find( $item_id );
 
     unless ($item) {
@@ -396,7 +399,7 @@ sub remove_from_bundle {
         );
     }
 
-    my $bundle_item_id = $c->validation->param('bundled_item_id');
+    my $bundle_item_id = $c->param('bundled_item_id');
     $bundle_item_id = barcodedecode($bundle_item_id);
     my $bundle_item = Koha::Items->find( { itemnumber => $bundle_item_id } );
 
diff --git a/Koha/REST/V1/Libraries.pm b/Koha/REST/V1/Libraries.pm
index b6ec20e69d..55aa426974 100644
--- a/Koha/REST/V1/Libraries.pm
+++ b/Koha/REST/V1/Libraries.pm
@@ -44,8 +44,7 @@ sub list {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $libraries_set = Koha::Libraries->new;
-        my $libraries     = $c->objects->search( $libraries_set );
+        my $libraries = $c->objects->search( Koha::Libraries->new );
         return $c->render( status => 200, openapi => $libraries );
     }
     catch {
@@ -63,12 +62,13 @@ sub get {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $library_id = $c->validation->param('library_id');
-        my $library = Koha::Libraries->find( $library_id );
+        my $library = Koha::Libraries->find( $c->param('library_id') );
 
         unless ($library) {
-            return $c->render( status  => 404,
-                            openapi => { error => "Library not found" } );
+            return $c->render(
+                status  => 404,
+                openapi => { error => "Library not found" }
+            );
         }
 
         return $c->render(
@@ -91,7 +91,7 @@ sub add {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $library = Koha::Library->new_from_api( $c->validation->param('body') );
+        my $library = Koha::Library->new_from_api( $c->req->json );
         $library->store;
         $c->res->headers->location( $c->req->url->to_string . '/' . $library->branchcode );
 
@@ -121,7 +121,7 @@ Controller function that handles updating a Koha::Library object
 sub update {
     my $c = shift->openapi->valid_input or return;
 
-    my $library = Koha::Libraries->find( $c->validation->param('library_id') );
+    my $library = Koha::Libraries->find( $c->param('library_id') );
 
     if ( not defined $library ) {
         return $c->render(
@@ -154,7 +154,7 @@ sub delete {
 
     my $c = shift->openapi->valid_input or return;
 
-    my $library = Koha::Libraries->find( $c->validation->param( 'library_id' ) );
+    my $library = Koha::Libraries->find( $c->param( 'library_id' ) );
 
     if ( not defined $library ) {
         return $c->render( status => 404, openapi => { error => "Library not found" } );
diff --git a/Koha/REST/V1/OAuth.pm b/Koha/REST/V1/OAuth.pm
index 922134ddc7..f11e065e60 100644
--- a/Koha/REST/V1/OAuth.pm
+++ b/Koha/REST/V1/OAuth.pm
@@ -49,7 +49,7 @@ sub token {
         return $c->render( status => 400, openapi => { error => 'Unimplemented grant type' } );
     }
 
-    my $grant_type = $c->validation->param('grant_type');
+    my $grant_type = $c->param('grant_type');
     unless ( $grant_type eq 'client_credentials' and C4::Context->preference('RESTOAuth2ClientCredentials') ) {
         return $c->render(status => 400, openapi => {error => 'Unimplemented grant type'});
     }
@@ -70,8 +70,8 @@ sub token {
         ( $client_id, $client_secret ) = split( /:/, $decoded_credentials, 2 );
     }
     else {
-        $client_id = $c->validation->param('client_id');
-        $client_secret = $c->validation->param('client_secret');
+        $client_id = $c->param('client_id');
+        $client_secret = $c->param('client_secret');
     }
 
     my $cb = "${grant_type}_grant";
diff --git a/Koha/REST/V1/Patrons.pm b/Koha/REST/V1/Patrons.pm
index 1852d7ccd2..0e04199b55 100644
--- a/Koha/REST/V1/Patrons.pm
+++ b/Koha/REST/V1/Patrons.pm
@@ -47,7 +47,8 @@ sub list {
     return try {
 
         my $query = {};
-        my $restricted = delete $c->validation->output->{restricted};
+        my $restricted = $c->param('restricted');
+        $c->req->params->remove('restricted');
         $query->{debarred} = { '!=' => undef }
             if $restricted;
 
@@ -74,7 +75,7 @@ sub get {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $patron_id = $c->validation->param('patron_id');
+        my $patron_id = $c->param('patron_id');
         my $patron    = $c->objects->find( Koha::Patrons->search_limited, $patron_id );
 
         unless ($patron) {
@@ -108,7 +109,7 @@ sub add {
         Koha::Database->new->schema->txn_do(
             sub {
 
-                my $body = $c->validation->param('body');
+                my $body = $c->req->json;
 
                 my $extended_attributes = delete $body->{extended_attributes} // [];
 
@@ -225,8 +226,7 @@ Controller function that handles updating a Koha::Patron object
 sub update {
     my $c = shift->openapi->valid_input or return;
 
-    my $patron_id = $c->validation->param('patron_id');
-    my $patron    = Koha::Patrons->find( $patron_id );
+    my $patron = Koha::Patrons->find( $c->param('patron_id') );
 
     unless ($patron) {
          return $c->render(
@@ -236,7 +236,7 @@ sub update {
      }
 
     return try {
-        my $body = $c->validation->param('body');
+        my $body = $c->req->json;
         my $user = $c->stash('koha.user');
 
         if (
@@ -269,7 +269,7 @@ sub update {
             }
         }
 
-        $patron->set_from_api($c->validation->param('body'))->store;
+        $patron->set_from_api($body)->store;
         $patron->discard_changes;
         return $c->render( status => 200, openapi => $patron->to_api );
     }
@@ -341,7 +341,7 @@ Controller function that handles deleting a Koha::Patron object
 sub delete {
     my $c = shift->openapi->valid_input or return;
 
-    my $patron = Koha::Patrons->find( $c->validation->param('patron_id') );
+    my $patron = Koha::Patrons->find( $c->param('patron_id') );
 
     unless ( $patron ) {
         return $c->render(
diff --git a/Koha/REST/V1/Patrons/Account.pm b/Koha/REST/V1/Patrons/Account.pm
index 95c998ad56..2cf643029c 100644
--- a/Koha/REST/V1/Patrons/Account.pm
+++ b/Koha/REST/V1/Patrons/Account.pm
@@ -40,8 +40,7 @@ Controller function that handles retrieving a patron's account balance
 sub get {
     my $c = shift->openapi->valid_input or return;
 
-    my $patron_id = $c->validation->param('patron_id');
-    my $patron    = Koha::Patrons->find($patron_id);
+    my $patron = Koha::Patrons->find( $c->param('patron_id') );
 
     unless ($patron) {
         return $c->render(
@@ -84,8 +83,7 @@ sub get {
 sub list_credits {
     my $c = shift->openapi->valid_input or return;
 
-    my $patron_id = $c->validation->param('patron_id');
-    my $patron    = Koha::Patrons->find($patron_id);
+    my $patron = Koha::Patrons->find( $c->param('patron_id') );
 
     unless ($patron) {
         return $c->render(
@@ -95,10 +93,7 @@ sub list_credits {
     }
 
     return try {
-        my $account = $patron->account;
-
-        my $credits_set = $account->credits;
-        my $credits     = $c->objects->search($credits_set);
+        my $credits = $c->objects->search( $patron->account->credits );
         return $c->render( status => 200, openapi => $credits );
     }
     catch {
@@ -115,9 +110,8 @@ Controller function that handles adding a credit to a patron's account
 sub add_credit {
     my $c = shift->openapi->valid_input or return;
 
-    my $patron_id = $c->validation->param('patron_id');
-    my $patron    = Koha::Patrons->find($patron_id);
-    my $user      = $c->stash('koha.user');
+    my $patron = Koha::Patrons->find( $c->param('patron_id') );
+    my $user   = $c->stash('koha.user');
 
     unless ($patron) {
         return $c->render(
@@ -127,7 +121,7 @@ sub add_credit {
     }
 
     my $account = $patron->account;
-    my $body    = $c->validation->param('body');
+    my $body    = $c->req->json;
 
     return try {
         my $credit_type =
@@ -203,8 +197,7 @@ sub add_credit {
 sub list_debits {
     my $c = shift->openapi->valid_input or return;
 
-    my $patron_id = $c->validation->param('patron_id');
-    my $patron    = Koha::Patrons->find($patron_id);
+    my $patron = Koha::Patrons->find( $c->param('patron_id') );
 
     unless ($patron) {
         return $c->render(
@@ -214,10 +207,7 @@ sub list_debits {
     }
 
     return try {
-        my $account = $patron->account;
-
-        my $debits_set = $account->debits;
-        my $debits     = $c->objects->search($debits_set);
+        my $debits = $c->objects->search( $patron->account->debits );
         return $c->render( status => 200, openapi => $debits );
     }
     catch {
@@ -232,8 +222,7 @@ sub list_debits {
 sub add_debit {
     my $c = shift->openapi->valid_input or return;
 
-    my $patron_id = $c->validation->param('patron_id');
-    my $patron    = Koha::Patrons->find($patron_id);
+    my $patron = Koha::Patrons->find( $c->param('patron_id') );
 
     unless ($patron) {
         return $c->render(
@@ -244,7 +233,7 @@ sub add_debit {
 
     return try {
         my $data =
-          Koha::Account::Debit->new_from_api( $c->validation->param('body') )
+          Koha::Account::Debit->new_from_api( $c->req->json )
           ->unblessed;
 
         $data->{library_id}       = delete $data->{branchcode};
diff --git a/Koha/REST/V1/Patrons/Attributes.pm b/Koha/REST/V1/Patrons/Attributes.pm
index 4095a9220a..3d1e347073 100644
--- a/Koha/REST/V1/Patrons/Attributes.pm
+++ b/Koha/REST/V1/Patrons/Attributes.pm
@@ -43,7 +43,7 @@ to a given patron.
 sub list_patron_attributes {
     my $c = shift->openapi->valid_input or return;
 
-    my $patron = Koha::Patrons->find( $c->validation->param('patron_id') );
+    my $patron = Koha::Patrons->find( $c->param('patron_id') );
 
     unless ($patron) {
         return $c->render(
@@ -56,8 +56,7 @@ sub list_patron_attributes {
 
     return try {
 
-        my $attributes_rs = $patron->extended_attributes;
-        my $attributes    = $c->objects->search($attributes_rs);
+        my $attributes = $c->objects->search( $patron->extended_attributes );
 
         return $c->render(
             status  => 200,
@@ -78,7 +77,7 @@ Controller method that handles adding a Koha::Patron::Attribute to a given patro
 sub add {
     my $c = shift->openapi->valid_input or return;
 
-    my $patron = Koha::Patrons->find( $c->validation->param('patron_id') );
+    my $patron = Koha::Patrons->find( $c->param('patron_id') );
 
     unless ($patron) {
         return $c->render(
@@ -93,7 +92,7 @@ sub add {
 
         my $attribute = $patron->add_extended_attribute(
             Koha::Patron::Attribute->new_from_api( # new_from_api takes care of mapping attributes
-                $c->validation->param('body')
+                $c->req->json
             )->unblessed
         );
 
@@ -150,7 +149,7 @@ Controller method that handles overwriting extended attributes for a given patro
 sub overwrite {
     my $c = shift->openapi->valid_input or return;
 
-    my $patron = Koha::Patrons->find( $c->validation->param('patron_id') );
+    my $patron = Koha::Patrons->find( $c->param('patron_id') );
 
     unless ($patron) {
         return $c->render(
@@ -163,7 +162,7 @@ sub overwrite {
 
     return try {
 
-        my $body = $c->validation->every_param('body');
+        my $body = $c->req->json;
 
         my @attrs;
 
@@ -228,7 +227,7 @@ Controller method that handles updating a single extended patron attribute.
 sub update {
     my $c = shift->openapi->valid_input or return;
 
-    my $patron = Koha::Patrons->find( $c->validation->param('patron_id') );
+    my $patron = Koha::Patrons->find( $c->param('patron_id') );
 
     unless ($patron) {
         return $c->render(
@@ -241,7 +240,7 @@ sub update {
 
     return try {
         my $attribute = $patron->extended_attributes->find(
-            $c->validation->param('extended_attribute_id') );
+            $c->param('extended_attribute_id') );
 
         unless ($attribute) {
             return $c->render(
@@ -252,7 +251,7 @@ sub update {
             );
         }
 
-        $attribute->set_from_api( $c->validation->param('body') )->store;
+        $attribute->set_from_api( $c->req->json )->store;
         $attribute->discard_changes;
 
         return $c->render(
@@ -302,7 +301,7 @@ Controller method that handles removing an extended patron attribute.
 sub delete {
     my $c = shift->openapi->valid_input or return;
 
-    my $patron = Koha::Patrons->find( $c->validation->param('patron_id') );
+    my $patron = Koha::Patrons->find( $c->param('patron_id') );
 
     unless ($patron) {
         return $c->render(
@@ -316,7 +315,7 @@ sub delete {
     return try {
 
         my $attribute = $patron->extended_attributes->find(
-            $c->validation->param('extended_attribute_id') );
+            $c->param('extended_attribute_id') );
 
         unless ($attribute) {
             return $c->render(
diff --git a/Koha/REST/V1/Patrons/Holds.pm b/Koha/REST/V1/Patrons/Holds.pm
index e4c2547ccb..88eea15b53 100644
--- a/Koha/REST/V1/Patrons/Holds.pm
+++ b/Koha/REST/V1/Patrons/Holds.pm
@@ -38,7 +38,7 @@ Controller function that handles listing Koha::Hold objects for the requested pa
 sub list {
     my $c = shift->openapi->valid_input or return;
 
-    my $patron = Koha::Patrons->find( $c->validation->param('patron_id') );
+    my $patron = Koha::Patrons->find( $c->param('patron_id') );
 
     unless ( $patron ) {
         return $c->render(
@@ -51,8 +51,7 @@ sub list {
 
     return try {
 
-        my $holds_rs = $patron->holds;
-        my $holds    = $c->objects->search( $holds_rs );
+        my $holds = $c->objects->search( $patron->holds );
 
         return $c->render(
             status  => 200,
diff --git a/Koha/REST/V1/Patrons/Password.pm b/Koha/REST/V1/Patrons/Password.pm
index 96f259c381..4b4b89dea9 100644
--- a/Koha/REST/V1/Patrons/Password.pm
+++ b/Koha/REST/V1/Patrons/Password.pm
@@ -44,8 +44,8 @@ sub set {
 
     my $c = shift->openapi->valid_input or return;
 
-    my $patron = Koha::Patrons->find( $c->validation->param('patron_id') );
-    my $body   = $c->validation->param('body');
+    my $patron = Koha::Patrons->find( $c->param('patron_id') );
+    my $body   = $c->req->json;
 
     unless ($patron) {
         return $c->render( status => 404, openapi => { error => "Patron not found." } );
@@ -87,8 +87,8 @@ sub set_public {
 
     my $c = shift->openapi->valid_input or return;
 
-    my $body      = $c->validation->param('body');
-    my $patron_id = $c->validation->param('patron_id');
+    my $body      = $c->req->json;
+    my $patron_id = $c->param('patron_id');
 
     my $user = $c->stash('koha.user');
 
diff --git a/Koha/REST/V1/Patrons/Password/Expiration.pm b/Koha/REST/V1/Patrons/Password/Expiration.pm
index de0abb748f..a038071ab0 100644
--- a/Koha/REST/V1/Patrons/Password/Expiration.pm
+++ b/Koha/REST/V1/Patrons/Password/Expiration.pm
@@ -43,13 +43,14 @@ sub set {
 
     my $c = shift->openapi->valid_input or return;
 
-    my $patron = Koha::Patrons->find( $c->validation->param('patron_id') );
-    my $body   = $c->validation->param('body');
+    my $patron = Koha::Patrons->find( $c->param('patron_id') );
 
     unless ($patron) {
         return $c->render( status => 404, openapi => { error => "Patron not found." } );
     }
 
+    my $body = $c->req->json;
+
     my $password_expiration_date   = $body->{expiration_date} // "";
 
     return try {
diff --git a/Koha/REST/V1/Quotes.pm b/Koha/REST/V1/Quotes.pm
index 53475ec9c2..51a35c9602 100644
--- a/Koha/REST/V1/Quotes.pm
+++ b/Koha/REST/V1/Quotes.pm
@@ -35,8 +35,7 @@ sub list {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $quotes_set = Koha::Quotes->new;
-        my $quotes = $c->objects->search( $quotes_set );
+        my $quotes = $c->objects->search( Koha::Quotes->new );
         return $c->render( status => 200, openapi => $quotes );
     }
     catch {
@@ -53,10 +52,12 @@ sub get {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $quote = Koha::Quotes->find( $c->validation->param('quote_id') );
+        my $quote = Koha::Quotes->find( $c->param('quote_id') );
         unless ($quote) {
-            return $c->render( status  => 404,
-                            openapi => { error => "quote not found" } );
+            return $c->render(
+                status  => 404,
+                openapi => { error => "quote not found" }
+            );
         }
 
         return $c->render( status => 200, openapi => $quote->to_api );
@@ -74,7 +75,7 @@ sub add {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $quote = Koha::Quote->new_from_api( $c->validation->param('body') );
+        my $quote = Koha::Quote->new_from_api( $c->req->json );
         $quote->store;
         $c->res->headers->location( $c->req->url->to_string . '/' . $quote->id );
         return $c->render(
@@ -94,7 +95,7 @@ sub add {
 sub update {
     my $c = shift->openapi->valid_input or return;
 
-    my $quote = Koha::Quotes->find( $c->validation->param('quote_id') );
+    my $quote = Koha::Quotes->find( $c->param('quote_id') );
 
     if ( not defined $quote ) {
         return $c->render( status  => 404,
@@ -102,7 +103,7 @@ sub update {
     }
 
     return try {
-        $quote->set_from_api( $c->validation->param('body') );
+        $quote->set_from_api( $c->req->json );
         $quote->store();
         return $c->render( status => 200, openapi => $quote->to_api );
     }
@@ -118,7 +119,7 @@ sub update {
 sub delete {
     my $c = shift->openapi->valid_input or return;
 
-    my $quote = Koha::Quotes->find( $c->validation->param('quote_id') );
+    my $quote = Koha::Quotes->find( $c->param('quote_id') );
     if ( not defined $quote ) {
         return $c->render( status  => 404,
                            openapi => { error => "Object not found" } );
diff --git a/Koha/REST/V1/ReturnClaims.pm b/Koha/REST/V1/ReturnClaims.pm
index 850b0f76c2..ad9a61acf1 100644
--- a/Koha/REST/V1/ReturnClaims.pm
+++ b/Koha/REST/V1/ReturnClaims.pm
@@ -40,7 +40,7 @@ Claim that a checked out item was returned.
 
 sub claim_returned {
     my $c    = shift->openapi->valid_input or return;
-    my $body = $c->validation->param('body');
+    my $body = $c->req->json;
 
     return try {
         my $itemnumber      = $body->{item_id};
@@ -99,8 +99,8 @@ Update the notes of an existing claim
 sub update_notes {
     my $c = shift->openapi->valid_input or return;
 
-    my $claim_id = $c->validation->param('claim_id');
-    my $body     = $c->validation->param('body');
+    my $claim_id = $c->param('claim_id');
+    my $body     = $c->req->json;
 
     my $claim = Koha::Checkouts::ReturnClaims->find( $claim_id );
 
@@ -143,10 +143,10 @@ Marks a claim as resolved
 =cut
 
 sub resolve_claim {
-    my $c     = shift->openapi->valid_input or return;
+    my $c = shift->openapi->valid_input or return;
 
-    my $claim_id = $c->validation->param('claim_id');
-    my $body     = $c->validation->param('body');
+    my $claim_id = $c->param('claim_id');
+    my $body     = $c->req->json;
 
     my $claim = Koha::Checkouts::ReturnClaims->find($claim_id);
 
@@ -193,7 +193,7 @@ sub delete_claim {
 
     return try {
 
-        my $claim = Koha::Checkouts::ReturnClaims->find( $c->validation->param('claim_id') );
+        my $claim = Koha::Checkouts::ReturnClaims->find( $c->param('claim_id') );
 
         return $c->render(
             status  => 404,
diff --git a/Koha/REST/V1/SearchFilter.pm b/Koha/REST/V1/SearchFilter.pm
index cf796a263f..ce912b82a3 100644
--- a/Koha/REST/V1/SearchFilter.pm
+++ b/Koha/REST/V1/SearchFilter.pm
@@ -38,8 +38,7 @@ Controller function that handles listing Koha::SearchFilter objects
 sub list {
     my $c = shift->openapi->valid_input or return;
     return try {
-        my $filters_set = Koha::SearchFilters->search({});
-        my $filters = $c->objects->search( $filters_set );
+        my $filters = $c->objects->search( Koha::SearchFilters->new );
         return $c->render(
             status  => 200,
             openapi => $filters
@@ -59,7 +58,7 @@ Controller function that handles retrieving a single Koha::AdvancedEditorMacro
 
 sub get {
     my $c = shift->openapi->valid_input or return;
-    my $filter = Koha::SearchFilters->find( $c->validation->param('search_filter_id') );
+    my $filter = Koha::SearchFilters->find( $c->param('search_filter_id') );
     unless ($filter) {
         return $c->render( status  => 404,
                            openapi => { error => "Search filter not found" } );
@@ -78,7 +77,7 @@ sub add {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $filter = Koha::SearchFilter->new_from_api( $c->validation->param('body') );
+        my $filter = Koha::SearchFilter->new_from_api( $c->req->json );
         $filter->store->discard_changes;
         $c->res->headers->location( $c->req->url->to_string . '/' . $filter->id );
         return $c->render(
@@ -106,7 +105,7 @@ Controller function that handles updating a Koha::SearchFilter object
 sub update {
     my $c = shift->openapi->valid_input or return;
 
-    my $filter = Koha::SearchFilters->find( $c->validation->param('search_filter_id') );
+    my $filter = Koha::SearchFilters->find( $c->param('search_filter_id') );
 
     if ( not defined $filter ) {
         return $c->render( status  => 404,
@@ -114,8 +113,7 @@ sub update {
     }
 
     return try {
-        my $params = $c->req->json;
-        $filter->set_from_api( $params );
+        $filter->set_from_api( $c->req->json );
         $filter->store->discard_changes;
         return $c->render( status => 200, openapi => $filter->to_api );
     }
@@ -133,7 +131,7 @@ Controller function that handles deleting a Koha::SearchFilter object
 sub delete {
     my $c = shift->openapi->valid_input or return;
 
-    my $filter = Koha::SearchFilters->find( $c->validation->param('search_filter_id') );
+    my $filter = Koha::SearchFilters->find( $c->param('search_filter_id') );
     if ( not defined $filter ) {
         return $c->render( status  => 404,
                            openapi => { error => "Object not found" } );
diff --git a/Koha/REST/V1/Stage.pm b/Koha/REST/V1/Stage.pm
index b72a28e750..8e1c4ce734 100644
--- a/Koha/REST/V1/Stage.pm
+++ b/Koha/REST/V1/Stage.pm
@@ -36,13 +36,12 @@ Move a stage up or down the stockrotation rota.
 
 sub move {
     my $c = shift->openapi->valid_input or return;
-    my $input = $c->validation->output;
 
-    my $rota  = Koha::StockRotationRotas->find( $input->{rota_id} );
-    my $stage = Koha::StockRotationStages->find( $input->{stage_id} );
+    my $rota  = Koha::StockRotationRotas->find( $c->param('rota_id') );
+    my $stage = Koha::StockRotationStages->find( $c->param('stage_id') );
 
     if ( $stage && $rota ) {
-        my $result = $stage->move_to( $input->{position} );
+        my $result = $stage->move_to( $c->req->json );
         return $c->render( openapi => {}, status => 200 ) if $result;
         return $c->render(
             openapi => { error => "Bad request - new position invalid" },
diff --git a/Koha/REST/V1/Suggestions.pm b/Koha/REST/V1/Suggestions.pm
index 4bc27709d1..67bcbe04fd 100644
--- a/Koha/REST/V1/Suggestions.pm
+++ b/Koha/REST/V1/Suggestions.pm
@@ -63,8 +63,7 @@ sub get {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $suggestion_id = $c->validation->param('suggestion_id');
-        my $suggestion = $c->objects->find( Koha::Suggestions->new, $suggestion_id );
+        my $suggestion = $c->objects->find( Koha::Suggestions->new, $c->param('suggestion_id') );
 
         unless ($suggestion) {
             return $c->render(
@@ -92,7 +91,7 @@ Controller method that handles adding a new Koha::Suggestion object
 sub add {
     my $c = shift->openapi->valid_input or return;
 
-    my $body = $c->validation->param('body');
+    my $body = $c->req->json;
 
     # FIXME: This should be handled in Koha::Suggestion->store
     $body->{'status'} = 'ASKED'
@@ -171,8 +170,7 @@ Controller method that handles modifying Koha::Suggestion object
 sub update {
     my $c = shift->openapi->valid_input or return;
 
-    my $suggestion_id = $c->validation->param('suggestion_id');
-    my $suggestion = Koha::Suggestions->find( $suggestion_id );
+    my $suggestion = Koha::Suggestions->find( $c->param('suggestion_id') );
 
     return $c->render(
         status  => 404,
@@ -181,7 +179,7 @@ sub update {
 
     return try {
 
-        my $body = $c->validation->param('body');
+        my $body = $c->req->json;
 
         $suggestion->set_from_api( $body )->store;
         $suggestion->discard_changes;
@@ -206,8 +204,7 @@ Controller method that handles removing a Koha::Suggestion object
 sub delete {
     my $c = shift->openapi->valid_input or return;
 
-    my $suggestion_id = $c->validation->param('suggestion_id');
-    my $suggestion = Koha::Suggestions->find( $suggestion_id );
+    my $suggestion = Koha::Suggestions->find( $c->param('suggestion_id') );
 
     return $c->render(
         status  => 404,
diff --git a/Koha/REST/V1/Tickets.pm b/Koha/REST/V1/Tickets.pm
index b27a56d3da..a63ff3539d 100644
--- a/Koha/REST/V1/Tickets.pm
+++ b/Koha/REST/V1/Tickets.pm
@@ -38,8 +38,7 @@ sub list {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $tickets_set = Koha::Tickets->new;
-        my $tickets     = $c->objects->search($tickets_set);
+        my $tickets = $c->objects->search(Koha::Tickets->new);
         return $c->render( status => 200, openapi => $tickets );
     }
     catch {
@@ -56,7 +55,7 @@ sub get {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $ticket = Koha::Tickets->find( $c->validation->param('ticket_id') );
+        my $ticket = Koha::Tickets->find( $c->param('ticket_id') );
         unless ($ticket) {
             return $c->render(
                 status  => 404,
@@ -80,7 +79,7 @@ sub add {
     my $patron = $c->stash('koha.user');
 
     return try {
-        my $body   = $c->validation->param('body');
+        my $body = $c->req->json;
 
         # Set reporter from session
         $body->{reporter_id} = $patron->id;
@@ -108,7 +107,7 @@ sub add {
 sub update {
     my $c = shift->openapi->valid_input or return;
 
-    my $ticket = Koha::Tickets->find( $c->validation->param('ticket_id') );
+    my $ticket = Koha::Tickets->find( $c->param('ticket_id') );
 
     if ( not defined $ticket ) {
         return $c->render(
@@ -118,7 +117,7 @@ sub update {
     }
 
     return try {
-        $ticket->set_from_api( $c->validation->param('body') );
+        $ticket->set_from_api( $c->req->json );
         $ticket->store();
         return $c->render( status => 200, openapi => $ticket->to_api );
     }
@@ -134,7 +133,7 @@ sub update {
 sub delete {
     my $c = shift->openapi->valid_input or return;
 
-    my $ticket = Koha::Tickets->find( $c->validation->param('ticket_id') );
+    my $ticket = Koha::Tickets->find( $c->param('ticket_id') );
     if ( not defined $ticket ) {
         return $c->render(
             status  => 404,
@@ -162,7 +161,7 @@ sub list_updates {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $ticket = Koha::Tickets->find( $c->validation->param('ticket_id') );
+        my $ticket = Koha::Tickets->find( $c->param('ticket_id') );
         unless ($ticket) {
             return $c->render(
                 status  => 404,
@@ -187,8 +186,8 @@ sub add_update {
     my $c = shift->openapi->valid_input or return;
     my $patron = $c->stash('koha.user');
 
-    my $ticket_id_param = $c->validation->param('ticket_id');
-    my $ticket_update   = $c->validation->param('body');
+    my $ticket_id_param = $c->param('ticket_id');
+    my $ticket_update   = $c->req->json;
     $ticket_update->{ticket_id} //= $ticket_id_param;
 
     if ( $ticket_update->{ticket_id} != $ticket_id_param ) {
diff --git a/Koha/REST/V1/TransferLimits.pm b/Koha/REST/V1/TransferLimits.pm
index c7d056d18d..0d7b0eb472 100644
--- a/Koha/REST/V1/TransferLimits.pm
+++ b/Koha/REST/V1/TransferLimits.pm
@@ -47,8 +47,7 @@ sub list {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $limits_set = Koha::Item::Transfer::Limits->new;
-        my $limits = $c->objects->search( $limits_set );
+        my $limits = $c->objects->search( Koha::Item::Transfer::Limits->new );
         return $c->render( status => 200, openapi => $limits );
     }
     catch {
@@ -66,7 +65,7 @@ sub add {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $params = $c->validation->param( 'body' );
+        my $params = $c->req->json;
         my $transfer_limit = Koha::Item::Transfer::Limit->new_from_api( $params );
 
         if ( Koha::Item::Transfer::Limits->search( $transfer_limit->attributes_from_api($params) )->count == 0 ) {
@@ -102,7 +101,7 @@ sub delete {
 
     my $c = shift->openapi->valid_input or return;
 
-    my $transfer_limit = Koha::Item::Transfer::Limits->find( $c->validation->param( 'limit_id' ) );
+    my $transfer_limit = Koha::Item::Transfer::Limits->find( $c->param( 'limit_id' ) );
 
     if ( not defined $transfer_limit ) {
         return $c->render( status => 404, openapi => { error => "Transfer limit not found" } );
@@ -127,7 +126,7 @@ sub batch_add {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $params = $c->validation->param( 'body' );
+        my $params = $c->req->json;
 
         my @libraries = Koha::Libraries->search->as_list;
 
@@ -175,7 +174,7 @@ sub batch_delete {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $params = $c->validation->param( 'body' );
+        my $params = $c->req->json;
         my $transfer_limit = Koha::Item::Transfer::Limit->new_from_api( $params );
         my $search_params = $transfer_limit->unblessed;
 
diff --git a/Koha/REST/V1/TwoFactorAuth.pm b/Koha/REST/V1/TwoFactorAuth.pm
index 29679a544c..9681fca16d 100644
--- a/Koha/REST/V1/TwoFactorAuth.pm
+++ b/Koha/REST/V1/TwoFactorAuth.pm
@@ -131,8 +131,8 @@ sub verification {
 
     return try {
 
-        my $pin_code = $c->validation->param('pin_code');
-        my $secret32 = $c->validation->param('secret32');
+        my $pin_code = $c->param('pin_code');
+        my $secret32 = $c->param('secret32');
 
         my $auth     = Koha::Auth::TwoFactorAuth->new(
             { patron => $patron, secret32 => $secret32 } );