Skip to content
Snippets Groups Projects

Add API documentation

Merged Konrad Mohrfeldt requested to merge feature/api-docs into master
Compare changes
  • Side-by-side
  • Inline
Files
1
  • The retrieve and update actions can be removed because the get_queryset
    method already ensures that the user has only access to their own user
    object (or all user objects in case of superusers).
    
    Sending 401 responses for unauthorized requests may also be considered
    leaky, because it exposes that these objects exist instead of returning
    a 404 that simply states that no object with that primary key can be
    found.
Loading