Yes, from the link you posted there are examples for both sanitising and validating the parameters. Validating does a check which can fail and block the API call from running; sanitising just does some operations to clean or interpret the parameter and does not stop the API call from running.
An example of validation, taken from the page:
<?php
add_action( 'rest_api_init', function () {
register_rest_route( 'myplugin/v1', '/author/(?P<id>\d+)', array(
'methods' => 'GET',
'callback' => 'my_awesome_func',
'args' => array(
'id' => array(
'validate_callback' => function($param, $request, $key) {
return is_numeric( $param );
}
),
),
) );
} );
You can see in the second parameter of register_rest_route that this defines an endpoints like /author/1234
The format of the second parameter of register_rest_route breaks down as:
/author/ initial part of the URL to match
?P a code specific to this function that means 'parameter'. Note this is not included in the URL when called
<id> optional name for the parameter, used belows in args, not included as part of URL.
\d+ the regex for this parameter
validate_callbackis for.argsargument. By using regex in the endpoint you can accept them as part of the URL, but by default they're passed as query parameters.