Moving the normalisation to the backend SDK (in the API implementation), would allow users to bypass this normalising step if needed.
In general, should we not normalise any "pure" user facing input in the core? By pure user facing, we mean that things like email / passwords etc.. that are "Created" by the user - as opposed to things like paginationTokens, access tokens, user IDs.. that are created by the core itself.