As noted in T423559#12140694, the worklist PATCH endpoint doesn't currently validate the body. While thorough validation is done by the Worklist content handler itself, some minimal validation of data types needs to be done by the handler to avoid type errors: for example, passing "add":["Main Page"] results in Error: exception of type TypeError: array_merge(): Argument #2 must be of type array, string given in WorklistArticleHelper.php line 130. The handler should make sure that the values passed as "add" and "remove" are objects, and that the values are arrays; no other checks should be needed here.