201 is fine. Is it okay to return the serialized object in the body together with a Location header? I wouldn't want any API client to automatically follow the redirect in the Location header since we're including the object already in the body.