Consider adding an attribute validation step prior to executing the actual match operation. For example, if the client sent an invalid date for date_of_birth or an alphabetical character in a numeric field the request should be immediately rejected without further processing.

Note the API spec might require minor updates to return an appropriate error code, currently the only defined errors for a Standard Request are 403 and 404. Something like 400 would probably be better.