api: validate user_id as number