Yep, when I remove the user_id from the request it works and that satisfies our use case. So all good for now. Thanks.