Then you say > But, if this API to add a user can only be called by the current user, then u should not give a userId to the API. The API should get the userId from the session @User What is this situation in comparison?