Designing the API

You have been on the other side of this. The APIs & Datasets course had you consume real APIs and record what was missing: undocumented paging, counts that lied, errors returned as HTML, no way to tell an error from data.

Design the one you wished you had received. Wrap results in an object so there is room for a count. Use status codes properly. Return errors as JSON with the same shape every time. Name the fields you expose rather than serializing whole records.

Authorization belongs in the query, not after it. From the Django course: @login_required alone means any signed-in person can act on anyone's data by changing a number in the URL.

Filter by the owner so the wrong thing cannot be fetched at all. There is then no check to forget, and it fails as a 404 rather than confirming that the record exists but belongs to somebody else.