diff --git a/endpoints/routes.go b/endpoints/routes.go
index f47f4b3..394ed69 100644
--- a/endpoints/routes.go
+++ b/endpoints/routes.go
@@ -13,6 +13,7 @@ func ProtoRoutes(r *http.Request, ps httprouter.Params) (bird.Parsed, bool) {
 	if err != nil {
 		return bird.Parsed{"error": fmt.Sprintf("%s", err)}, false
 	}
+
 	return bird.RoutesProto(protocol)
 }
 
@@ -21,6 +22,7 @@ func RoutesFiltered(r *http.Request, ps httprouter.Params) (bird.Parsed, bool) {
 	if err != nil {
 		return bird.Parsed{"error": fmt.Sprintf("%s", err)}, false
 	}
+
 	return bird.RoutesFiltered(protocol)
 }
 
@@ -29,6 +31,7 @@ func RoutesNoExport(r *http.Request, ps httprouter.Params) (bird.Parsed, bool) {
 	if err != nil {
 		return bird.Parsed{"error": fmt.Sprintf("%s", err)}, false
 	}
+
 	return bird.RoutesNoExport(protocol)
 }
 
@@ -43,19 +46,40 @@ func RoutesPrefixed(r *http.Request, ps httprouter.Params) (bird.Parsed, bool) {
 	if err != nil {
 		return bird.Parsed{"error": fmt.Sprintf("%s", err)}, false
 	}
+
 	return bird.RoutesPrefixed(prefix)
 }
 
 func TableRoutes(r *http.Request, ps httprouter.Params) (bird.Parsed, bool) {
-	return bird.RoutesTable(ps.ByName("table"))
+	table, err := ValidateProtocolParam(ps.ByName("table"))
+	if err != nil {
+		return bird.Parsed{"error": fmt.Sprintf("%s", err)}, false
+	}
+
+	return bird.RoutesTable(table)
 }
 
 func TableRoutesFiltered(r *http.Request, ps httprouter.Params) (bird.Parsed, bool) {
-	return bird.RoutesTableFiltered(ps.ByName("table"))
+	table, err := ValidateProtocolParam(ps.ByName("table"))
+	if err != nil {
+		return bird.Parsed{"error": fmt.Sprintf("%s", err)}, false
+	}
+
+	return bird.RoutesTableFiltered(table)
 }
 
 func TableAndPeerRoutes(r *http.Request, ps httprouter.Params) (bird.Parsed, bool) {
-	return bird.RoutesTableAndPeer(ps.ByName("table"), ps.ByName("peer"))
+	table, err := ValidateProtocolParam(ps.ByName("table"))
+	if err != nil {
+		return bird.Parsed{"error": fmt.Sprintf("%s", err)}, false
+	}
+
+	peer, err := ValidatePrefixParam(ps.ByName("peer"))
+	if err != nil {
+		return bird.Parsed{"error": fmt.Sprintf("%s", err)}, false
+	}
+
+	return bird.RoutesTableAndPeer(table, peer)
 }
 
 func ProtoCount(r *http.Request, ps httprouter.Params) (bird.Parsed, bool) {
@@ -63,6 +87,7 @@ func ProtoCount(r *http.Request, ps httprouter.Params) (bird.Parsed, bool) {
 	if err != nil {
 		return bird.Parsed{"error": fmt.Sprintf("%s", err)}, false
 	}
+
 	return bird.RoutesProtoCount(protocol)
 }
 
@@ -75,32 +100,94 @@ func ProtoPrimaryCount(r *http.Request, ps httprouter.Params) (bird.Parsed, bool
 }
 
 func TableCount(r *http.Request, ps httprouter.Params) (bird.Parsed, bool) {
-	return bird.RoutesTableCount(ps.ByName("table"))
+	table, err := ValidateProtocolParam(ps.ByName("table"))
+	if err != nil {
+		return bird.Parsed{"error": fmt.Sprintf("%s", err)}, false
+	}
+
+	return bird.RoutesTableCount(table)
 }
 
 func RouteNet(r *http.Request, ps httprouter.Params) (bird.Parsed, bool) {
-	return bird.RoutesLookupTable(ps.ByName("net"), "master")
+	net, err := ValidatePrefixParam(ps.ByName("net"))
+	if err != nil {
+		return bird.Parsed{"error": fmt.Sprintf("%s", err)}, false
+	}
+
+	return bird.RoutesLookupTable(net, "master")
 }
 
 func RouteNetTable(r *http.Request, ps httprouter.Params) (bird.Parsed, bool) {
-	return bird.RoutesLookupTable(ps.ByName("net"), ps.ByName("table"))
+	net, err := ValidatePrefixParam(ps.ByName("net"))
+	if err != nil {
+		return bird.Parsed{"error": fmt.Sprintf("%s", err)}, false
+	}
+
+	table, err := ValidateProtocolParam(ps.ByName("table"))
+	if err != nil {
+		return bird.Parsed{"error": fmt.Sprintf("%s", err)}, false
+	}
+
+	return bird.RoutesLookupTable(net, table)
 }
 
 func PipeRoutesFiltered(r *http.Request, ps httprouter.Params) (bird.Parsed, bool) {
 	qs := r.URL.Query()
-	table := qs["table"][0]
-	pipe := qs["pipe"][0]
+
+	if len(qs["table"]) != 1 {
+		return bird.Parsed{"error": "need a table as single query parameter"}, false
+	}
+	table, err := ValidateProtocolParam(qs["table"][0])
+	if err != nil {
+		return bird.Parsed{"error": fmt.Sprintf("%s", err)}, false
+	}
+
+	if len(qs["pipe"]) != 1 {
+		return bird.Parsed{"error": "need a pipe as single query parameter"}, false
+	}
+	pipe, err := ValidateProtocolParam(qs["pipe"][0])
+	if err != nil {
+		return bird.Parsed{"error": fmt.Sprintf("%s", err)}, false
+	}
+
 	return bird.PipeRoutesFiltered(pipe, table)
 }
 
 func PipeRoutesFilteredCount(r *http.Request, ps httprouter.Params) (bird.Parsed, bool) {
 	qs := r.URL.Query()
-	table := qs["table"][0]
-	pipe := qs["pipe"][0]
-	address := qs["address"][0]
+
+	if len(qs["table"]) != 1 {
+		return bird.Parsed{"error": "need a table as single query parameter"}, false
+	}
+	table, err := ValidateProtocolParam(qs["table"][0])
+	if err != nil {
+		return bird.Parsed{"error": fmt.Sprintf("%s", err)}, false
+	}
+
+	if len(qs["pipe"]) != 1 {
+		return bird.Parsed{"error": "need a pipe as single query parameter"}, false
+	}
+	pipe, err := ValidateProtocolParam(qs["pipe"][0])
+	if err != nil {
+		return bird.Parsed{"error": fmt.Sprintf("%s", err)}, false
+	}
+
+	if len(qs["address"]) != 1 {
+		return bird.Parsed{"error": "need a address as single query parameter"}, false
+	}
+	address, err := ValidatePrefixParam(qs["address"][0])
+	if err != nil {
+		return bird.Parsed{"error": fmt.Sprintf("%s", err)}, false
+	}
+
 	return bird.PipeRoutesFilteredCount(pipe, table, address)
 }
 
 func PeerRoutes(r *http.Request, ps httprouter.Params) (bird.Parsed, bool) {
-	return bird.RoutesPeer(ps.ByName("peer"))
+	peer, err := ValidatePrefixParam(ps.ByName("peer"))
+	if err != nil {
+		return bird.Parsed{"error": fmt.Sprintf("%s", err)}, false
+	}
+
+	return bird.RoutesPeer(peer)
 }