So most of the time, if ur doing an operation on behalf of the currently logged in user, u should never give the userId in the request. Cause that’s what a session is for.