diff --git a/src/backend/core/api/serializers.py b/src/backend/core/api/serializers.py
index aaedd743..2eb25e32 100644
--- a/src/backend/core/api/serializers.py
+++ b/src/backend/core/api/serializers.py
@@ -13,7 +13,7 @@ from django.core.exceptions import SuspiciousOperation
 from django.utils.translation import gettext_lazy as _
 
 from django_pydantic_field.rest_framework import SchemaField
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, ValidationError
 from rest_framework import serializers
 from rest_framework.exceptions import PermissionDenied
 from timezone_field.rest_framework import TimeZoneSerializerField
@@ -123,6 +123,16 @@ class ListRoomSerializer(serializers.ModelSerializer):
         read_only_fields = ["id", "slug"]
 
 
+class RoomConfiguration(BaseModel):
+    """Wip"""
+
+    can_publish_sources: list[Literal[
+        "microphone", "screen_share", "screen_share_audio", "camera"
+    ]] | None = None
+
+    model_config = {"extra": "forbid"}
+
+
 class RoomSerializer(serializers.ModelSerializer):
     """Serialize Room model for the API."""
 
@@ -131,6 +141,20 @@ class RoomSerializer(serializers.ModelSerializer):
         fields = ["id", "name", "slug", "configuration", "access_level", "pin_code"]
         read_only_fields = ["id", "slug", "pin_code"]
 
+    def validate_configuration(self, configuration):
+        """Wip."""
+
+        if configuration is None:
+            return configuration
+
+        try:
+            RoomConfiguration.model_validate(configuration)
+        except ValidationError as e:
+            raise SuspiciousOperation("Wip, invalid room configuration")
+
+        return configuration
+
+
     def to_representation(self, instance):
         """
         Add users only for administrator users.
diff --git a/src/backend/core/tests/rooms/test_api_rooms_retrieve.py b/src/backend/core/tests/rooms/test_api_rooms_retrieve.py
index f317ddd8..ebc9e7d5 100644
--- a/src/backend/core/tests/rooms/test_api_rooms_retrieve.py
+++ b/src/backend/core/tests/rooms/test_api_rooms_retrieve.py
@@ -232,7 +232,7 @@ def test_api_rooms_retrieve_authenticated_public(mock_token):
     """
     room = RoomFactory(
         access_level=RoomAccessLevel.PUBLIC,
-        configuration={"can_publish_sources": ["mock-source"]},
+        configuration={"can_publish_sources": ["camera"]},
     )
 
     user = UserFactory()
@@ -264,7 +264,7 @@ def test_api_rooms_retrieve_authenticated_public(mock_token):
         user=user,
         username=None,
         color=None,
-        sources=["mock-source"],
+        sources=["camera"],
         is_admin_or_owner=False,
         participant_id=None,
     )
@@ -363,7 +363,7 @@ def test_api_rooms_retrieve_members(mock_token, django_assert_num_queries, setti
     other_user = UserFactory()
 
     room = RoomFactory(
-        configuration={"can_publish_sources": ["mock-source"]},
+        configuration={"can_publish_sources": ["camera"]},
     )
     UserResourceAccessFactory(resource=room, user=user, role="member")
     UserResourceAccessFactory(resource=room, user=other_user, role="member")
@@ -401,7 +401,7 @@ def test_api_rooms_retrieve_members(mock_token, django_assert_num_queries, setti
         user=user,
         username=None,
         color=None,
-        sources=["mock-source"],
+        sources=["camera"],
         is_admin_or_owner=False,
         participant_id=None,
     )
diff --git a/src/backend/core/tests/rooms/test_api_rooms_update.py b/src/backend/core/tests/rooms/test_api_rooms_update.py
index da3020a1..88877812 100644
--- a/src/backend/core/tests/rooms/test_api_rooms_update.py
+++ b/src/backend/core/tests/rooms/test_api_rooms_update.py
@@ -95,7 +95,7 @@ def test_api_rooms_update_administrators():
             "name": "New name",
             "slug": "should-be-ignored",
             "access_level": RoomAccessLevel.PUBLIC,
-            "configuration": {"the_key": "the_value"},
+            "configuration": {"can_publish_sources": ["camera"]},
         },
         format="json",
     )
@@ -104,7 +104,7 @@ def test_api_rooms_update_administrators():
     assert room.name == "New name"
     assert room.slug == "new-name"
     assert room.access_level == RoomAccessLevel.PUBLIC
-    assert room.configuration == {"the_key": "the_value"}
+    assert room.configuration == {"can_publish_sources": ["camera"]}
 
 
 def test_api_rooms_update_administrators_of_another():