You're right.  An exception in the response is much better.  If the API call to
0.0.0.0:3000/api/domains/20/parameters?asdf_id=333
then the response is 
```
{
    "error": {
        "message": "ERROR: asdf_id is not allowed as nested parameter for parameters. Allowed parameters are host_id, hostgroup_id, domain_id, operatingsystem_id"
    }
}
```