In general, I design my APIs as follows:
- Document the methods well, and encourage the callers to pass good/valid data.
- Validate the parameters anyway! - throwing exceptions when the preconditions are not met.
I would say that parameter validation is necessary on most public-facing APIs. Parameter validation on non-public methods is not as important - it is often desirable to have validation occur only once, at the public 'entry point' - but if you can get live with the potential performance hit, I like to validate parameters everywhere, as it makes code maintenance and refactoring a bit easier.