So we're able to create posts, objects inside of the Admon panel.
But that's not very fun.
The whole thing is that we're making this API so that someone on maybe a mobile application or a separate
Web site, maybe a desktop app could be making these things and, you know, reading and data.
So let's go ahead and make an API call so that we can create posts via the API.
So in order to do this, let's go ahead and move back into our project.
And if we go to our Vieuxtemps Pi, you're saying, OK, there's a list API view.
There's probably a create API view.
And there is.
And we could totally create a separate class and, you know, go ahead and do all of that.
But the general risk framework has these really nice combinations that happen.
For example, when someone comes to the u r l, let's go here slash API slash posts.
Well, if they just want to read what's there, they're going to do a get request to that.
You are well and that should list out all the post objects.
But if someone wants to create a post, they should be able to post to this, you are well and be able
to make one of them.
And so what we can do is come back to our views here and change this from just a list API view to a
list create API view.
And what this does, if we literally just doing this one thing, if we go ahead and hit save here and
come back to our API and reload.
Look at this.
We can now post to this.
You are well.
And if we go ahead and scroll down here, this is so cool to me.
There's a little form that allows us to add things into the database here.
So, for example, I can go in, you know, pick something here.
I'm going to say cool search engine.
All right.
And I can pass in and you are going to do HTP.
Colon slash, slash, duck, duck, go dot com.
And I can post this and look at this.
This is now added into our database.
If I go back to because, you know, once we've posted this, it comes back as a two oh one.
And these are HTP status codes.
Now, if you want to go open a can of worms here, go look up HTP status codes.
And there is so much to dive into with this.
There's a whole list of some if we go ahead and I just.
Let's see.
Yeah.
These are all the different things that come back.
And so something that's kind of cool here, if you've ever seen a four or four page that's a HTP number
saying that, you know, something was not found.
Usually that's when someone's put it in a bad you are LTA website or a Web site, remove something that
used to be something that it'll give you a four or four to say, I don't know what you're looking for.
There's all these different options here.
So, for example, this the standard one is 200.
Anytime you visit a Web site, like when we visited this particular Web site, this reste API tutorial
dot com, it came back to our browser as a 200.
Okay, HTP request now for us.
When we made an object, it came back as a two, a one.
And you can see there's all sorts of different ones here.
And you know, this is another great pro of the Gengel rest API is that it handles all of this for us.
We did not have to write any code here to say, oh, if we successfully create go ahead and, you know,
set it as a two one.
Now, it just does that automatically.
And if we come back to the browser here and we reload this you URL because we're still just at the post,
it's now because we did a get request instead of a post.
It gives us back the two hundred and you can see.
Look at this.
We have all the different posts showing up here.
This is so awesome.
So at first this seems like we've done some really great work that, you know, hey, we were able to,
you know, add things.
This is really good.
And we can do it either through this H.T. email form here or we we can do raw data, which you can see
it gets a start is for us.
This is like if someone was gonna be working with our API, they would be passing Jace on like this.
Right.
So let's go and do another.
I'm going to do the accurate search engine.
I love the duck duck, though.
You know, it has a lot more privacy than Google, but Google is so much better at, you know, returning
back what I'm looking for.
So anyways, so, you know, I can add via the raw data here and, you know, post this.
But notice, I don't have the poster set if I say no here and I go ahead and try and post this.
Well, I get this air back and says this feel may not be no.
I have to provide something there and would really think about it.
When someone submitting a post, they shouldn't be able to pick which user, you know, submitted that
post.
It should be only that user can, you know, should be able to do that.
So how are we going to handle this as sort of, you know, a little bit detailed Dupont situation?
How do we do with this, with the general risk framework?
Well, let's go back to Adam and work on a couple.
Well, things here.
So the first thing that we need to do is we need to move over to our serializer.
And we need to make it so that, you know, the different fields that we have here, that some of them
are going to be a read only field.
So the way to set this is going to come back to the top here.
And I'm going to say poster, which is one of our fields.
Right.
I'm gonna say poster is equal to serializer as Dot and I want read only field.
OK.
Now, inside of here, we have to say where the data for this is going to come from.
So we're going to say source is equal to.
And then we pass on a string.
And I'm going to have this be the poster dot username.
I think that might be a good way to display that information.
If we wanted to include the users idea as well, we could totally do that.
We could, you know, make a new line here.
I'm going to copy what we have and make this poster underscore I.D. and this will, you know, give
back the poster I.D..
That could kind of be a cool thing.
And now we can take this poster I.D. and add this to one of the fields here.
So I'm going to do poster I.D..
Great.
And now that we have this, if we go ahead and save what we've got and come back to our.
You are all here.
Kay, let's reload the page.
If we come down to the form, look at this.
There's no longer an option to set the user.
But this isn't really going to get us somewhere if I try and, you know, submit something here.
Let's just, you know, do another Google dot com or whatever we're gonna get in there.
And it's basically saying, you know, hey, someone has to be the poster for this post.
What you know, what user is that?
Well, let's go back to our code.
Let's now move to our views.
And inside of this class space view, we can override a function where it's about to save whatever it
is that we're put into, into the database.
In this case, it's post objects.
But what we can do is name this deaf space perform.
Create and it's really important that this name is exact, it has to be performed, create, this is
like a special name that is going to be called right before it's trying to save something into the database
and the parameters that we're passing in our self and then also the serializer.
So not sterilizers with an S, but just serializer.
And what we're gonna do here is we're going to the typically what just happens if we didn't provide
this?
What happens by default is it just says serializer dot save.
And remember, the serializer basically is holding a Django model.
It's kind of that transition point for us.
But what we can do here is say, hey, while you're doing this save, I want you to have poster be equal
to whatever user made this request so we can go ahead and say self dot user dot.
I did this wrong self dot request dot user.
OK.
So this says any time I'm going to save a post object right before I do, I'm going to grab whatever
user made this API call and I'm going to set that as the poster.
So with this, now that we have this saved, let's go ahead and go back and reload this page.
And still the same situation here.
So I'm just going to call this one like, hello.
We'll do our classic Google here.
Post this and look at that.
It's posted it and it's posted with the user zappy code.
And look, there's that other additional thing that we added, the poster I.D..
OK.
So isn't this great?
Like, the thing that I love about the Jingle Rest framework is that it's flexible enough that if we
have some sort of special situation like, well, you know, I typically want to use it to be entered
into in most fields.
But for the poster, I want that just to be automatic.
We can do that.
We can make these little changes to have the API be exactly what we want.
Now, there's one more thing that we've got to talk about, and that's that I'm signed in currently
as the users AP code.
For example, if I go ahead and, you know, open up, it's a separate browser here and I grab the same.
You are all here.
So here inside of Chrome, I'm going to, you know, go to the same place if I try and add something
here.
Okay.
To do like let's do zappy code here.
If I try and post, this is going to say, hey, Valide, you are.
That was a valid you oil.
No, it was not.
OK, try again post.
That's gonna say, hey, you know, you're an anonymous user.
This doesn't work.
So how do we prevent the situation?
Well, if we go back to Adam here, we can specify inside one of these Class-Based view who has permission
to be able to call this API.
So if we go ahead and say permission.
Underscore.
Classes.
We can set this equal to an array of different permission items here.
But we're going to say permissions, which we've got to go ahead and import this.
I'm going to come up to the top here.
This comes from the rest framework.
So we're just gonna do comma.
Permissions.
OK.
And we're going to come back down here and say permissions dot capital is capital off then.
Kate, got to make sure we spell this right, Kate.
So I'm gonna go ahead and save this.
So now when I come back on Crome and I visit this, it's going to say, hey, you can't do anything
because you're not assigned and user.
But here in Safari, when I where I am signed in, it says, hey, look, you know, you're able to
do this.
I'd be able to create something.
I can view.
What's going on here in this at first can seem like the right situation.
But the problem is we want anybody, whether they have a user account or not, to be able to see the
top post.
Just like when we went to Reddit dot com, we could see what all the top links were without creating
a Reddit account.
I think this you are ill.
If someone visits it with the API, we should be able to see all the different posts.
So how do we make it so that, OK, if someone doesn't get requests, it's OK.
But if they do a post, it's not.
Well, again, the flexibility with this Gengel rest rest framework, I can say is authenticated or
read only.
So when I do this and hit save, you'll notice now in Chrome when I reload the page.
Oh, I can read the information here, but I can't post anything.
That option is not there.
But where I am signed in as the zappy code user, I can still see the information and post new data.
So I hope you're starting to feel the magic here.
This is really fun building.
Now, this API weren't worried at nice point where we can, you know, post posts, create post objects
and we can list them out.
The next step for us is to say, OK, well, you know, how now do we vote for different things?
So let's talk about that in the next lecture.