Portfolio

Api Watchlist Post

Add/remove/update watchlist items.

Auth: requires a logged-in session (2026-06-12 audit 6.3). The prior Optional[get_current_user] let ANONYMOUS posts through (legacy double-submit CSRF passes for anon browsers) — and the anon branch wrote save_watchlist(), the process-wide SQLite cache shared across ALL users: the same privacy/last-write-wins defect the GET above was already fixed for. Anonymous watchlists are device-local now (static/js/watchlist.ts ol_anon_watchlist), migrated on signup.

post/api/watchlist

Request

  • Base URL: https://www.oxfordledge.com (the document declares no server; this is the origin it was published from)
  • URL: https://www.oxfordledge.com/api/watchlist
  • Auth: none declared

Response

Successful Response

statusstring required

'ok' on success.

errorstring nullable

Validation error (missing ticker, duplicate add, invalid field, etc.).

Changes

No recorded changes to this operation across all 1 revision of this API.