# Buggy code
def create(self, request, *args, **kwargs):
    # If the object ID was not specified, it probably doesn't exist in the
    # DB yet. We want to see if we can create it.  The URL may choose to
    # inject it's primary key into the object because we are posting to a
    # subcollection. Use all the normal access control mechanisms.

    # Make a copy of the data provided (since it's readonly) in order to
    # inject additional data.
    if hasattr(request.data, "copy"):
        data = request.data.copy()
    else:
        data = QueryDict("")
        data.update(request.data)

    # add the parent key to the post data using the pk from the URL
    parent_key = getattr(self, "parent_key", None)
    if parent_key:
        data[parent_key] = self.kwargs["pk"]

    # attempt to deserialize the object
    serializer = self.get_serializer(data=data)
    if not serializer.is_valid():
        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

    # Verify we have permission to add the object as given.
    if not request.user.can_access(self.model, "add", serializer.initial_data):
        raise PermissionDenied()

    # save the object through the serializer, reload and returned the saved
    # object deserialized
    obj = serializer.save()
    serializer = self.get_serializer(instance=obj)

    headers = {"Location": obj.get_absolute_url(request)}
    return Response(serializer.data, status=status.HTTP_201_CREATED, headers=headers)


# Traceback (AttributeError)
2019-06-21 20:31:01,747 ERROR    django.request Internal Server Error: /api/v2/job_templates/7/schedules/
Traceback (most recent call last):
File "/venv/awx/lib64/python3.6/site-packages/django/core/handlers/exception.py", line 41, in inner
response = get_response(request)
File "/venv/awx/lib64/python3.6/site-packages/django/core/handlers/base.py", line 187, in _get_response
response = self.process_exception_by_middleware(e, request)
File "/venv/awx/lib64/python3.6/site-packages/django/core/handlers/base.py", line 185, in _get_response
response = wrapped_callback(request, *callback_args, **callback_kwargs)
File "/usr/lib64/python3.6/contextlib.py", line 52, in inner
return func(*args, **kwds)
File "/venv/awx/lib64/python3.6/site-packages/django/views/decorators/csrf.py", line 58, in wrapped_view
return view_func(*args, **kwargs)
File "/venv/awx/lib64/python3.6/site-packages/django/views/generic/base.py", line 68, in view
return self.dispatch(request, *args, **kwargs)
File "./awx/api/generics.py", line 293, in dispatch
return super(APIView, self).dispatch(request, *args, **kwargs)
File "/venv/awx/lib64/python3.6/site-packages/rest_framework/views.py", line 495, in dispatch
response = self.handle_exception(exc)
File "/venv/awx/lib64/python3.6/site-packages/rest_framework/views.py", line 455, in handle_exception
self.raise_uncaught_exception(exc)
File "/venv/awx/lib64/python3.6/site-packages/rest_framework/views.py", line 492, in dispatch
response = handler(request, *args, **kwargs)
File "/venv/awx/lib64/python3.6/site-packages/rest_framework/generics.py", line 244, in post
return self.create(request, *args, **kwargs)
File "./awx/api/generics.py", line 570, in create
if not request.user.can_access(self.model, 'add', serializer.initial_data):
File "./awx/main/access.py", line 122, in check_user_access
result = access_method(*args, **kwargs)
File "./awx/main/access.py", line 162, in wrapper
return func(self, *args, **kwargs)
File "./awx/main/access.py", line 2445, in can_add
if not JobLaunchConfigAccess(self.user).can_add(data):
File "./awx/main/access.py", line 162, in wrapper
return func(self, *args, **kwargs)
File "./awx/main/access.py", line 1787, in can_add
cred_pks = [cred.pk for cred in data['credentials']]
File "./awx/main/access.py", line 1787, in <listcomp>
cred_pks = [cred.pk for cred in data['credentials']]
AttributeError: 'int' object has no attribute 'pk'

# Fixed code
def create(self, request, *args, **kwargs):
    # If the object ID was not specified, it probably doesn't exist in the
    # DB yet. We want to see if we can create it.  The URL may choose to
    # inject it's primary key into the object because we are posting to a
    # subcollection. Use all the normal access control mechanisms.

    # Make a copy of the data provided (since it's readonly) in order to
    # inject additional data.
    if hasattr(request.data, "copy"):
        data = request.data.copy()
    else:
        data = QueryDict("")
        data.update(request.data)

    # add the parent key to the post data using the pk from the URL
    parent_key = getattr(self, "parent_key", None)
    if parent_key:
        data[parent_key] = self.kwargs["pk"]

    # attempt to deserialize the object
    serializer = self.get_serializer(data=data)
    if not serializer.is_valid():
        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

    # Verify we have permission to add the object as given.
    if not request.user.can_access(self.model, "add", serializer.validated_data):
        raise PermissionDenied()

    # save the object through the serializer, reload and returned the saved
    # object deserialized
    obj = serializer.save()
    serializer = self.get_serializer(instance=obj)

    headers = {"Location": obj.get_absolute_url(request)}
    return Response(serializer.data, status=status.HTTP_201_CREATED, headers=headers)