Grape permitted_params helper. It works the same as Rails strong params. Only params defined in params block will remain.

general_helper.rb

module GeneralHelper
  def permitted_params
    @permitted_params ||= declared(params, include_missing: false)
  end
end

messages.rb

class Messages < Grape::API
  helpers GeneralHelper

  resources :messages do

    desc 'Create message'
    params do
      requires :message, type: Hash do
        requires :recipient_id, type: Integer, desc: 'Recipient ID'
        requires :content, type: String, desc: 'Content'
      end
    end
    post '/', rabl: 'messages/show' do
      @message = current_user.messages_sent.create!(permitted_params[:message])
    end

  end

end

you will still need to add
gem 'hashie-forbidden_attributes'

👍