---
title: "Api Credit Watchlist Post"
method: POST
path: "/api/credit/watchlist"
---

# Api Credit Watchlist Post

`POST /api/credit/watchlist`

## Request

- Base URL: `https://www.oxfordledge.com` (the document declares no server; this is the origin it was published from)
- URL: `https://www.oxfordledge.com/api/credit/watchlist`
- Auth: none declared

Add/remove/update bond watchlist (CSRF protected).

Per-user scoped — passes `user["id"]` to the service so writes
touch ONLY this user's rows. C-3 IDOR fix 2026-05-27
(docs/audits/2026-05-27_SECURITY_AUDIT.md). Pre-fix the POST
handler would DELETE every user's research on every save.

## Response `200`

Successful Response

- CreditWatchlistMutateResponse: `POST /api/credit/watchlist` — add/remove/update bond watchlist. Run 19 F4 backfill 2026-05-12. Delegates to `services.credit_data._handle_credit_watchlist_post_sync` whose return shape is `{watchlist: [...], status?}`.
  - `status` string, required: 'ok' on success.
  - `watchlist` unknown[], nullable: Updated bond watchlist after mutation.
    - unknown
  - `error` string, nullable: Persist or validation error.

---

[API](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api.md) · [All operations](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/llms.txt) · [OpenAPI document](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/revisions/e832a1260f0b?raw)