diff --git a/plugins/permission-backend/src/service/router.ts b/plugins/permission-backend/src/service/router.ts
index 0fd72297c5..8caba23b50 100644
--- a/plugins/permission-backend/src/service/router.ts
+++ b/plugins/permission-backend/src/service/router.ts
@@ -14,13 +14,14 @@
  * limitations under the License.
  */
 
+import { z } from 'zod';
+import express, { Request, Response } from 'express';
+import Router from 'express-promise-router';
+import { Logger } from 'winston';
 import {
   errorHandler,
   PluginEndpointDiscovery,
 } from '@backstage/backend-common';
-import express, { Request, Response } from 'express';
-import Router from 'express-promise-router';
-import { Logger } from 'winston';
 import {
   BackstageIdentity,
   IdentityClient,
@@ -34,6 +35,27 @@ import {
 import { PermissionPolicy } from '@backstage/plugin-permission-node';
 import { PermissionIntegrationClient } from './PermissionIntegrationClient';
 
+const requestSchema: z.ZodSchema<Identified<AuthorizeRequest>[]> = z.array(
+  z.object({
+    id: z.string(),
+    resourceRef: z.string().optional(),
+    permission: z.object({
+      name: z.string(),
+      resourceType: z.string().optional(),
+      attributes: z.object({
+        action: z
+          .union([
+            z.literal('create'),
+            z.literal('read'),
+            z.literal('update'),
+            z.literal('delete'),
+          ])
+          .optional(),
+      }),
+    }),
+  }),
+);
+
 /**
  * Options required when constructing a new {@link express#Router} using
  * {@link createRouter}.
@@ -121,7 +143,7 @@ export async function createRouter(
       const token = IdentityClient.getBearerToken(req.header('authorization'));
       const user = token ? await identity.authenticate(token) : undefined;
 
-      const body: Identified<AuthorizeRequest>[] = req.body;
+      const body = requestSchema.parse(req.body);
 
       res.json(
         await Promise.all(