The change to product_id here actually is a bugfix. Because the api controller expects the parameter product_id