diff --git a/app.py b/app.py
index a2d2561..eb74fa2 100644
--- a/app.py
+++ b/app.py
@@ -26,6 +26,11 @@ def create_item():
     if not data or "name" not in data:
         return jsonify(error="name is required"), 400
 
+    allowed = {"name"}
+    unknown = set(data.keys()) - allowed
+    if unknown:
+        return jsonify(error=f"Unknown fields: {', '.join(sorted(unknown))}"), 400
+
     item = {
         "id": len(_get_items()) + 1,
         "name": data["name"],
@@ -43,6 +48,11 @@ def update_item(item_id):
         return jsonify(error="item not found"), 404
 
     data = request.get_json()
+    allowed = {"name", "done"}
+    unknown = set(data.keys()) - allowed
+    if unknown:
+        return jsonify(error=f"Unknown fields: {', '.join(sorted(unknown))}"), 400
+
     if "done" in data:
         item["done"] = data["done"]
     if "name" in data:
diff --git a/test_app.py b/test_app.py
index d5ae8f6..2e88fb4 100644
--- a/test_app.py
+++ b/test_app.py
@@ -63,3 +63,38 @@ def test_delete_item(client):
 def test_delete_item_not_found(client):
     resp = client.delete("/items/999")
     assert resp.status_code == 404
+
+
+def test_patch_unknown_fields_rejected(client):
+    client.post("/items", json={"name": "widget"})
+    resp = client.patch("/items/1", json={"warehouse_bin": "A-12"})
+    assert resp.status_code == 400
+    assert "warehouse_bin" in resp.get_json()["error"]
+
+
+def test_patch_mixed_known_and_unknown_fields_rejected(client):
+    client.post("/items", json={"name": "widget"})
+    resp = client.patch("/items/1", json={"done": True, "warehouse_bin": "A-12"})
+    assert resp.status_code == 400
+    assert "warehouse_bin" in resp.get_json()["error"]
+
+
+def test_patch_valid_fields_accepted(client):
+    client.post("/items", json={"name": "widget"})
+    resp = client.patch("/items/1", json={"name": "gadget", "done": True})
+    assert resp.status_code == 200
+    data = resp.get_json()
+    assert data["name"] == "gadget"
+    assert data["done"] is True
+
+
+def test_create_item_unknown_fields_rejected(client):
+    resp = client.post("/items", json={"name": "widget", "warehouse_bin": "A-12"})
+    assert resp.status_code == 400
+    assert "warehouse_bin" in resp.get_json()["error"]
+
+
+def test_create_item_valid_fields_accepted(client):
+    resp = client.post("/items", json={"name": "widget"})
+    assert resp.status_code == 201
+    assert resp.get_json()["name"] == "widget"