public async Task <IHttpActionResult> Patch(int key, Delta <ElementCell> patch) { var elementCell = await _resourcePoolManager.GetElementCellSet(key, true, item => item.ElementField.Element.ResourcePool).SingleOrDefaultAsync(); // Owner check: Entity must belong to the current user var currentUserId = User.Identity.GetUserId <int>(); if (currentUserId != elementCell.ElementField.Element.ResourcePool.UserId) { return(StatusCode(HttpStatusCode.Forbidden)); } patch.Patch(elementCell); await _resourcePoolManager.SaveChangesAsync(); return(Ok(elementCell)); }