REST API schema is not documentation, it is validation

The schema attached to a route looks like a description for humans. Core uses it to validate and sanitise the request before the callback runs, which means an accurate schema removes a block of defensive code from every endpoint.

'args' => array(
    'per_page' => array(
        'type'    => 'integer',
        'default' => 20,
        'minimum' => 1,
        'maximum' => 100,
    ),
    'status' => array(
        'type' => 'string',
        'enum' => array( 'pending', 'paid', 'shipped' ),
    ),
),

A request outside those bounds gets a 400 with a message naming the parameter, generated by core, before your callback is entered. The failure mode to know about: type alone does not sanitise, so a string parameter still arrives as whatever was sent — sanitize_callback is separate and still needed for anything going near a query.