Request object for validate_callback

A quick search through the WP-API source revealed where validate_callback is being used:

wp-api/lib/infrastructure/class-wp-rest-request.php

$valid_check = call_user_func( $arg['validate_callback'], $param, $this, $key );

In this case, $this is an instance of WP_Rest_Request – so there’s one. Now, for sanitize_callback:

$this->params[ $type ][ $key ] = call_user_func( $attributes['args'][ $key ]['sanitize_callback'], $value, $this, $key );

Same file, there’s the $this you’re looking for. So yes, both should get an instance of WP_Rest_Request as their second argument.