diff --git a/src/util.ts b/src/util.ts
index 7976248..243fedf 100644
--- a/src/util.ts
+++ b/src/util.ts
@@ -1,4 +1,10 @@
+const uuidRegex =
+    /^[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}$/;
+
 export function instanceKeepAlive(instanceId: string, token: string) {
+    if (!uuidRegex.test(instanceId)) {
+        throw new Error('instanceId not of valid form');
+    }
     return fetch(`https://api.rerobots.net/instance/${instanceId}/ka`, {
         method: 'POST',
         headers: {
diff --git a/tests/instanceKeepAlive.test.ts b/tests/instanceKeepAlive.test.ts
index d6aea08..bb02a68 100644
--- a/tests/instanceKeepAlive.test.ts
+++ b/tests/instanceKeepAlive.test.ts
@@ -5,3 +5,9 @@ test('unauthenticated calls fail', () => {
         instanceKeepAlive('1926b858-0d00-4b84-b7ca-5c56be880525', ''),
     ).rejects.toThrow();
 });
+
+test('call with broken ID format fails', () => {
+    expect(() =>
+        instanceKeepAlive('926b858-0d00-4b84-b7ca-5c56be880525', ''),
+    ).toThrow(/instanceId/);
+});