---
title: "Api Watchlist Post"
method: POST
path: "/api/watchlist"
tags: ["Portfolio"]
---

# Api Watchlist Post

`POST /api/watchlist`

## Request

- Base URL: `https://www.oxfordledge.com` (the document declares no server; this is the origin it was published from)
- URL: `https://www.oxfordledge.com/api/watchlist`
- Auth: none declared

Add/remove/update watchlist items.

Auth: requires a logged-in session (2026-06-12 audit 6.3). The prior
`Optional[get_current_user]` let ANONYMOUS posts through (legacy
double-submit CSRF passes for anon browsers) — and the anon branch
wrote `save_watchlist()`, the process-wide SQLite cache shared across
ALL users: the same privacy/last-write-wins defect the GET above was
already fixed for. Anonymous watchlists are device-local now
(static/js/watchlist.ts `ol_anon_watchlist`), migrated on signup.

## Response `200`

Successful Response

- WatchlistMutateResponse: `POST /api/watchlist` — add/remove/update watchlist entries. Run 19 F4 backfill 2026-05-12. Returns `{status: 'ok', items}` on success — `items` is the full watchlist after the mutation so the FE can re-render without a follow-up GET. Error envelope on validation failures.
  - `status` string, required: 'ok' on success.
  - `items` unknown[], nullable: Updated watchlist after the mutation. List of {ticker, addedAt, conviction, stage, thesis, ...} entries.
    - unknown
  - `error` string, nullable: Validation error (missing ticker, duplicate add, invalid field, etc.).

---

[API](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api.md) · [All operations](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/llms.txt) · [OpenAPI document](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/revisions/e832a1260f0b?raw)