Saltar al contenido principal

Create Question

POST 
/v1/questions

Create a saved question.

Two gates, deliberately: require_credits is a BILLING check (does the account have budget) and require_creator_or_admin is an AUTHORIZATION check (may this role spend it). Only the first was here once, and a read-only member created a question through it — spending the account's credits from the least-privileged role. A billing check reads like a gate and is not one; the same conflation reads SessionOnly(), which restricts the auth METHOD, as a privilege boundary.

Shipped CLOSED, which is a decision and not a law: the argument for open is real — questions are a read-adjacent exploration tool and credits are the intended meter.

Reads are narrower than this route rather than wider, and narrower than they look. GET /v1/questions and GET /v1/questions/{question_id} authenticate any member, but the query behind them returns only the questions the CALLER OWNS: a question cannot be shared, so a member who may not create one reads none. Do not read the plain JWTBearer() on those handlers as "any member sees the account's questions" — three readers did, and the ownership filter lives one layer down, in SQLQuestionService.

Request​

Responses​

Successful Response