Cool, thanks for the input. This is indeed a public API with many users. Seems to me that you can account for backwards compatibility while still restricting qu

Cool, thanks for the input. This is indeed a public API with many users. Seems to me that you can account for backwards compatibility while still restricting query string parameters, by just keeping old parameters in the whitelist, or by using API versioning. But I suppose I can see this being a factor that leads teams toward unrestricted parameters.