Feature/api create and delete relationship

I'd return `400: Bad Request` if these params are missing and if more specific validations fail, then `422`.