Whitelisted 'format' param