base_params.rb

module BaseParams
  include JsonApiDeserialization

  def allowed_params(raw_params)
    jsonapi_parsed_params(raw_params, self.class.const_get(MODEL_NAME)).
      require(self.class.const_get(MODEL_NAME)).
      permit(self.class.const_get(PERMITTED_PARAMS))
  end
end

foo_params.rb

require 'active_support/concern'

module FooParams
  extend ActiveSupport::Concern

  PERMITTED_PARAMS = [:foobar, :bar, :baz]
  MODEL_NAME = :foo

  include BaseParams
end

foos_controller.rb

class FoosController < AuthenticatedController
  include FooParams

  def create
    foo = Foo.create!(allowed_params(params))
    render json: foo
  end
end

json_api_deserialization.rb

require 'active_support/concern'

module JsonApiDeserialization
  extend ActiveSupport::Concern

  protected

  def jsonapi_parsed_params(raw_params, root_key)
    ActionController::Parameters.new({ "#{root_key}" => ActiveModelSerializers::Deserialization.jsonapi_parse!(raw_params) })
  end
end