public async Task <IHttpActionResult> Patch(int userId, int elementCellId, Delta <UserElementCell> patch) { // Owner check: Entity must belong to the current user var currentUserId = User.Identity.GetUserId <int>(); if (currentUserId != userId) { return(StatusCode(HttpStatusCode.Forbidden)); } // REMARK UserCommandTreeInterceptor already filters "userId" on EntityFramework level, but that might be removed later on / coni2k - 31 Jul. '17 var userElementCell = await _resourcePoolManager.GetUserElementCellSet(userId, elementCellId).SingleOrDefaultAsync(); patch.Patch(userElementCell); await _resourcePoolManager.SaveChangesAsync(); return(Ok(userElementCell)); }