I'm ok with stricter checking (there will need to be quite a few changes in order to allow other content), but my initial knee-jerk reaction was not to like using Forms to validate API calls. They're very heavyweight, and most of their usefulness comes from generating the form widgets and generating errors that can be rendered in-context in the form. But as I think about it, I think it's growing on me, as there's a lot of validation machinery (required fields, etc) that can then be leveraged. Still mulling it over, but ok with it as an experiment for now.