update user api request should return 400 if registration data present

[bhalsey]

update user api request should return 400 if registration data present

Description

If an update request is made to the user api containing registration information, it is just ignored. Instead, a 400 response code should be returned.

Affects versions

All versions

Steps to reproduce

Steps to reproduce the behavior:

1. Make PUT request to /api/user/{userId} with payload like

{
	"user": {
		"email": "user@example.com",
		"registrations":  [{"applicationId": "48f6f797-5606-436e-be70-ba6c185d92e2", "verified": true}]
	}
}

2. Get 200 response.

Expected behavior

A400 response with code invalidJSON

[robotdan]

This is working as designed. All of our APIs ignore unknown fields. The correct API is the User Registration API.

The reason we ignore unknown fields on the API is for backwards and forwards compatibility. We could fail with a 400 but it would make our APIs more brittle for developers.

In theory we could make an exception for this one API, but it would make this API behave differently than all other APIs.