What is your goal?
- Validating input.
- Writing a quirky programming language to validate input.
If your goal is to just validate the input, I would hard-code it. It is unlikely that your service running in production will suddenly gain an appreciation for a different request format. That would indeed be quite startling.
If your goal is to permit custom validation, such as validating a web-survey. Then yes you'll need that quirky programming language. Just be aware that it is a programming language, that it is scripting your application, because it is changing your application's behaviour.
- So how complex are these rules going to be?
- Will you support arithmetic, branching, looping? Ouch a Turing complete language.
- How will you debug those rules?
- Error handling?
The rabbit hole goes on and on. If you do need this configurability split the validation into two tiers.
- Format validation - Hard code this as the format should not change.
- Content Validation - Hard Code the known and immutable parts, invoke a custom script to validate the rest.
If at all possible locate a scripting language that fits well into your code base, has a nice sandbox, a good syntax editor, and debugging tools. The custom validation script is passed a copy of the request object, and returns a true|false. You can store that script in a database row.