I think it would be nice to include a small example here. Maybe:

<?php

use Illuminate\Support\Arr;
use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Server\RequestHandlerInterface;

class MyController implements RequestHandlerInterface
{
    protected $validator;
    public function __construct(UserValidator $validator) {
        $this->validator = $validator;
    }

    public function handle(ServerRequestInterface $request): ResponseInterface
    {
        $attributes = Arr::get($request->getParsedBody(), 'data.attributes', []);

        $this->validator->assertValid($attributes);

        // Do something with the attributes
        // Access them with for example Arr::get($attributes, 'email')
    }
}

Also worth noting somehow:

When validating an array, only keys that are present in the validator will be checked. Other will be left as-it. You should only read values from the array that were validated. To get an array of values that ran through the validator, you can use Arr::only($attributes, array_keys($validator->getRules())).

A validator based on Flarum's AbstractValidator will only validate keys which are present in the $data parameter. This means required rules won't be checked if the data is absent. This is designed to handle API requests where each attribute will be handled separately and ignored when absent. To validate all data including missing data, you need to use a Laravel validator.