> You could also just validate the JSON payload, but most people don't bother. I don't think I have ever worked somewhere that didn't require people to validat

> You could also just validate the JSON payload, but most people don't bother. I don't think I have ever worked somewhere that didn't require people to validate inputs. The only scenario could be prototypes that made it to production, and even when its thrown over the wall I'll make it clear that it is unsupported until it meets minimum requirements. Who does it is less important than it happening.