Create or update the caller's note on a reading-list entry (auth required)
A8 (FAST-TRACK 2026-05-12; spike-ratified Cand. A 2026-05-14): POST a body + is_public flag; idempotent on (user_id, slug).
CSRF: enforced via dependencies=[Depends(validate_csrf)] on the decorator. The prior in-body validate_csrf(request) was a bare call to an async def — it returned a discarded coroutine and NEVER validated (CSRF was fully bypassed). CISO #49 2026-05-15.
post/api/reading-list/{slug}/notes
Request
- Base URL: https://www.oxfordledge.com (the document declares no server; this is the origin it was published from)
- URL: https://www.oxfordledge.com/api/reading-list/{slug}/notes
- Auth: none declared
Path parameters
slugstring required
Reading-list entry slug.
Request body
object required
Response
Successful Response
Changes
No recorded changes to this operation across all 1 revision of this API.