Docs
Create Private View (API key)
POST /views
POST
/viewsRequired Tokens
| Field | Type | Required | Description |
|---|---|---|---|
| Bearer | Authorization: Bearer {{apiKey}} | Optional | An **API key**, not a user token. Set `apiKey` in your environment. Collection OAuth2 is bypassed here (`auth: none`) precisely so the request authenticates as a non-user actor. |
A negative-case request. It exists to prove that a private view cannot be created without an acting user to own it.
These endpoints permit API-key auth, so the actor may not be a user at all. A private view needs an owner, so the service resolves the acting user and rejects the request when there is none:
400 A private view requires a signed-in user
The same caller creating a shared view (isPrivate: false) succeeds normally. The two cases
differ because the check is on the requested scope, not on whether an acting user happens to exist:
a shared view has no owner by design, whereas a private view is missing one.
Expected
| Result | Meaning |
|---|---|
400 with the message above | Correct. |
201 | Bug. A private view was created with no owner and is now unreachable by every user. |
401 | apiKey is unset or invalid — the request never reached the check. Not a pass. |
500 | Bug. Indicates the service used GetPrincipalIdentifier() instead of GetActingUserIdOrNull(); the former throws on the missing claim. |