Just a hint, for validating the format of external APIs we use JSON schema and that works remarkably well, especially for nested data structures.

Any request that goes in first has to pass the schema validator. This can be deactivated via a global flag of course.

We use https://github.com/mafintosh/is-my-json-valid but any JSON schema lib will do the job.