by Maciej Lisiewski.
I've ended up POSTing the data as json, "validating" it as PARAM_RAW and then doing real validation in the function that actually processes the request.