api: validate entity and method