properly validate incoming callback data