asp.net mvc 4 web api - data integrity/validation responsibility -

i'm new asp.net mvc , web apis, learning it.

lets have

models:

public class student {     public int studentid { get; set; }     public string studentname { get; set; } }  public class course {     public int courseid { get; set; }     public string coursename { get; set; }      public ienumerable<int> studentids { get; set; } } 

controllers:

1. user controller - implements post, put, get, delete
2. course controller - implements post, put, get, delete

each controller uses kind of repository get/add/remove/update data
lets say:
courses repository static dictionary<'int, course> courses
students repository *static dictionary<'int, student> students *

we not use entity framework!

custom routing

post /api/courses/{courseid}/users/{userid}
should go course controller , add user id list

[route("api/courses/{courseid}/students/{studentid}")] [httppost] public httpresponsemessage addstudenttocourse(int courseid, int studentid)  {      // adding student id course     ...  } 

questions:

1. should use custom route add mapping between courses , users
2. should check if student exists ? or kind of agreement client input valid
3. if check - should ? controller ? model ? kind of data access layer?
4. if coursecontroller / coursemodel means should "know" 2 repositories (the courses repository , students repository) right ?

i'll try answer questions in order, remember kind of questions can answered on opinions, personal preference, , personal experience, you'll different answers:

1. in general should avoid attribute routing, if exception , fits in routing pattern: go it.
2. you should ensure integrity of data , implement data access in way. if client misuses service can damage data integrity. if student exists give him http 200 or 201 , if student not exist give him 1 of http 400 errors (f.e. 404). rule of thumb: mistrust client , check , validate data sending api.
3. i in data access layer. should go idea of thing controller, meaning should avoid lot of operations in controller. model representation of data. should not contain logic find out if specific entity exists or not.
4. i don't know if question right, should answer point 3.

hope answer of questions.