(We do need to validate input in both the client and the server, since our CLI isn't the only possible API user.)