Custom deserializer (with injected repositories!) to support json foreign key ids rather than full-blown objects.