In the WordPress REST API, args do the checking for you. Mark a param as required and core answers 400 restmissingcallbackparam before your callback runs. Give it a type and an enum, and a wrong value gets 400 restinvalid_param.
There is one trap. Core only applies that type check by default when the arg has no sanitizecallback. Add your own sanitizecallback, and type stops checking: with absint, post_id=abc silently becomes 0 and the request passes.
Sanitized is not validated. To keep both, add validatecallback => restvalidaterequestarg next to sanitize_callback.
Your args also show up in the route index at /wp-json/{namespace}, so they double as documentation.
Go deeper
- Full guide: 4wp.dev/development/rest-api/schema-validation