diff --git a/appinfo/routes.php b/appinfo/routes.php
index 37445b45c..f532f9d8d 100644
--- a/appinfo/routes.php
+++ b/appinfo/routes.php
@@ -27,7 +27,12 @@
 
 $apiBase = '/api/{apiVersion}/';
 $requirements_v3 = [
-	'apiVersion' => 'v3'
+	'apiVersion' => 'v3',
+	'formId' => '\d+',
+	'questionId' => '\d+',
+	'optionId' => '\d+',
+	'shareId' => '\d+',
+	'submissionId' => '\d+'
 ];
 
 return [
@@ -108,10 +113,12 @@
 			'apiVersion_path' => 'v2(\.[1-4])?'
 		]],
 		['name' => 'api#getFormLegacy', 'url' => $apiBase . 'form/{id}', 'verb' => 'GET', 'requirements' => [
-			'apiVersion_path' => 'v2(\.[1-4])?'
+			'apiVersion_path' => 'v2(\.[1-4])?',
+			'id' => '\d+'
 		]],
 		['name' => 'api#cloneFormLegacy', 'url' => $apiBase . 'form/clone/{id}', 'verb' => 'POST', 'requirements' => [
-			'apiVersion' => 'v2(\.[1-4])?'
+			'apiVersion' => 'v2(\.[1-4])?',
+			'id' => '\d+'		
 		]],
 		['name' => 'api#updateFormLegacy', 'url' => $apiBase . 'form/update', 'verb' => 'POST', 'requirements' => [
 			'apiVersion' => 'v2(\.[1-4])?'
@@ -123,10 +130,12 @@
 			'apiVersion' => 'v2\.[2-4]'
 		]],
 		['name' => 'api#deleteFormLegacy', 'url' => $apiBase . 'form/{id}', 'verb' => 'DELETE', 'requirements' => [
-			'apiVersion' => 'v2(\.[1-4])?'
+			'apiVersion' => 'v2(\.[1-4])?',
+			'id' => '\d+'
 		]],
 		['name' => 'api#getPartialFormLegacy', 'url' => $apiBase . 'partial_form/{hash}', 'verb' => 'GET', 'requirements' => [
-			'apiVersion' => 'v2(\.[1-4])?'
+			'apiVersion' => 'v2(\.[1-4])?',
+			'hash' => '[a-zA-Z0-9]{16}'
 		]],
 		['name' => 'api#getSharedFormsLegacy', 'url' => $apiBase . 'shared_forms', 'verb' => 'GET', 'requirements' => [
 			'apiVersion' => 'v2(\.[1-4])?'
@@ -151,10 +160,12 @@
 			'apiVersion' => 'v2\.[2-4]'
 		]],
 		['name' => 'api#deleteQuestionLegacy', 'url' => $apiBase . 'question/{id}', 'verb' => 'DELETE', 'requirements' => [
-			'apiVersion' => 'v2(\.[1-4])?'
+			'apiVersion' => 'v2(\.[1-4])?',
+			'id' => '\d+'
 		]],
 		['name' => 'api#cloneQuestionLegacy', 'url' => $apiBase . 'question/clone/{id}', 'verb' => 'POST', 'requirements' => [
-			'apiVersion' => 'v2\.[3-4]'
+			'apiVersion' => 'v2\.[3-4]',
+			'id' => '\d+'
 		]],
 
 		// Options
@@ -169,7 +180,8 @@
 			'apiVersion' => 'v2\.[2-4]'
 		]],
 		['name' => 'api#deleteOptionLegacy', 'url' => $apiBase . 'option/{id}', 'verb' => 'DELETE', 'requirements' => [
-			'apiVersion' => 'v2(\.[1-4])?'
+			'apiVersion' => 'v2(\.[1-4])?',
+			'id' => '\d+'
 		]],
 
 		// Shares
@@ -177,7 +189,8 @@
 			'apiVersion' => 'v2(\.[1-4])?'
 		]],
 		['name' => 'shareApi#deleteShareLegacy', 'url' => $apiBase . 'share/{id}', 'verb' => 'DELETE', 'requirements' => [
-			'apiVersion' => 'v2(\.[1-4])?'
+			'apiVersion' => 'v2(\.[1-4])?',
+			'id' => '\d+'
 		]],
 		// TODO: Remove POST in next API release
 		['name' => 'shareApi#updateShareLegacy', 'url' => $apiBase . 'share/update', 'verb' => 'POST', 'requirements' => [
@@ -189,25 +202,31 @@
 
 		// Submissions
 		['name' => 'api#getSubmissionsLegacy', 'url' => $apiBase . 'submissions/{hash}', 'verb' => 'GET', 'requirements' => [
-			'apiVersion' => 'v2(\.[1-4])?'
+			'apiVersion' => 'v2(\.[1-4])?',
+			'hash' => '[a-zA-Z0-9]{16}'
 		]],
 		['name' => 'api#exportSubmissionsLegacy', 'url' => $apiBase . 'submissions/export/{hash}', 'verb' => 'GET', 'requirements' => [
-			'apiVersion' => 'v2(\.[1-4])?'
+			'apiVersion' => 'v2(\.[1-4])?',
+			'hash' => '[a-zA-Z0-9]{16}'
 		]],
 		['name' => 'api#exportSubmissionsToCloudLegacy', 'url' => $apiBase . 'submissions/export', 'verb' => 'POST', 'requirements' => [
 			'apiVersion' => 'v2(\.[1-4])?'
 		]],
 		['name' => 'api#deleteAllSubmissionsLegacy', 'url' => $apiBase . 'submissions/{formId}', 'verb' => 'DELETE', 'requirements' => [
-			'apiVersion' => 'v2(\.[1-4])?'
+			'apiVersion' => 'v2(\.[1-4])?',
+			'formId' => '\d+'
 		]],
 		['name' => 'api#uploadFilesLegacy', 'url' => $apiBase . 'uploadFiles/{formId}/{questionId}', 'verb' => 'POST', 'requirements' => [
-			'apiVersion' => 'v2.5'
+			'apiVersion' => 'v2.5',
+			'formId' => '\d+',
+			'questionId' => '\d+'
 		]],
 		['name' => 'api#insertSubmissionLegacy', 'url' => $apiBase . 'submission/insert', 'verb' => 'POST', 'requirements' => [
 			'apiVersion' => 'v2(\.[1-4])?'
 		]],
 		['name' => 'api#deleteSubmissionLegacy', 'url' => $apiBase . 'submission/{id}', 'verb' => 'DELETE', 'requirements' => [
-			'apiVersion' => 'v2(\.[1-4])?'
+			'apiVersion' => 'v2(\.[1-4])?',
+			'id' => '\d+'
 		]],
 		// Submissions linking with file in cloud
 		['name' => 'api#linkFileLegacy', 'url' => $apiBase . 'form/link/{fileFormat}', 'verb' => 'POST', 'requirements' => [