I think it makes sense to add validation here as well as it will provide clearer error messages when developing and when something wasn't caught in the higher level APIs. We do validation in the authz apis as well.