Similar to my previous post, this endpoint is also needlessly strict. The API Explorer is also broken on this as a result. These endpoints need, at the very least, documentation explaining the inconsistent strictness, and the __proto__ URL parameter needs to be removed from the API Explorer. Moreover, this requirement to not include any unexpected URL parameters should be removed from the endpoints.
SubmittedOfficial response from Alex Simoes-McArtor
At the moment, we haven't prioritized work to display errors if a user submits unexpected URL parameters. The current implementation shows an error, but it is a generic 400 error. If we prioritize work to change this behavior, we will update this post here.