No, this is just because by default, you don't need to restrict what you are sending in the json dictionary, and even if you do, usually update and create conforms to same criteria ... so the logic goes thusly (allow anything -> filter is same as in create -> filter is specific for update)