{"action":"opened","issue":{"url":"https://api.github.com/repos/cerebris/jsonapi-resources/issues/334","labels_url":"https://api.github.com/repos/cerebris/jsonapi-resources/issues/334/labels{/name}","comments_url":"https://api.github.com/repos/cerebris/jsonapi-resources/issues/334/comments","events_url":"https://api.github.com/repos/cerebris/jsonapi-resources/issues/334/events","html_url":"https://github.com/cerebris/jsonapi-resources/issues/334","id":96848923,"number":334,"title":"can not delete nested resource","user":{"login":"senid231","id":8393857,"avatar_url":"https://avatars.githubusercontent.com/u/8393857?v=3","gravatar_id":"","url":"https://api.github.com/users/senid231","html_url":"https://github.com/senid231","followers_url":"https://api.github.com/users/senid231/followers","following_url":"https://api.github.com/users/senid231/following{/other_user}","gists_url":"https://api.github.com/users/senid231/gists{/gist_id}","starred_url":"https://api.github.com/users/senid231/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/senid231/subscriptions","organizations_url":"https://api.github.com/users/senid231/orgs","repos_url":"https://api.github.com/users/senid231/repos","events_url":"https://api.github.com/users/senid231/events{/privacy}","received_events_url":"https://api.github.com/users/senid231/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-07-23T16:10:24Z","updated_at":"2015-07-23T16:10:24Z","closed_at":null,"body":"\r\n```ruby\r\nclass Api::AuthorResource < BaseResource\r\nend\r\n\r\nclass Api::PostResource < BaseResource\r\nend\r\n\r\nclass Api::PostsController < JsonApiController\r\n  def context\r\n    super.merge author_id: params[:author_id]\r\n  end\r\nend\r\n\r\nRails.application.routes.draw do\r\n  namespace :api do\r\n    jsonapi_resources :authors, only: [:index, :show, :create, :update, :destroy] do\r\n      jsonapi_resources :posts, only: [:index, :show, :create, :update, :destroy]\r\n    end\r\n  end\r\nend\r\n\r\nJSONAPI.configure do |config|\r\n  config.json_key_format = :underscored_key\r\n  config.route_format = :underscored_route\r\n  config.top_level_meta_include_record_count = true\r\n  config.top_level_links_include_pagination = true\r\n  config.default_paginator = :paged\r\nend\r\n\r\nRails.application.configure do\r\n  ...\r\n  config.action_controller.action_on_unpermitted_parameters = :raise\r\nend\r\n```\r\n\r\ni can not delete nested resource\r\n```\r\nStarted DELETE \"/api/authors/1/posts/7\" for 127.0.0.1 at 2015-07-23 18:50:28 +0300\r\nProcessing by Api::PostsController#destroy as API_JSON\r\n  Parameters: {\"author_id\"=>\"1\", \"id\"=>\"7\"}\r\nCan't verify CSRF token authenticity\r\n\"RESPONSE: bad_request\"\r\n{\r\n    :errors => [\r\n        [0] #<JSONAPI::Error:0x000000059158c0 @title=\"Param not allowed\", @detail=\"author_id is not allowed.\", @id=nil, @href=nil, @code=105, @source=nil, @links=nil, @status=:bad_request>\r\n    ]\r\n}\r\nFilter chain halted as :setup_request rendered or redirected\r\nCompleted 400 Bad Request in 108900ms (Views: 1.7ms | ActiveRecord: 0.0ms)\r\n```\r\nit happens because of \r\n```ruby\r\nmodule JSONAPI\r\n  class Request\r\n    ...\r\n    def parse_remove_operation(params)\r\n      keys = parse_key_array(params.permit(:id)[:id])\r\n\r\n      keys.each do |key|\r\n        @operations.push JSONAPI::RemoveResourceOperation.new(\r\n          @resource_klass,\r\n          context: @context,\r\n          resource_id: key\r\n        )\r\n      end\r\n    rescue ActionController::UnpermittedParameters => e\r\n      @errors.concat(JSONAPI::Exceptions::ParametersNotAllowed.new(e.params).errors)\r\n    rescue JSONAPI::Exceptions::Error => e\r\n      @errors.concat(e.errors)\r\n    end\r\n  end\r\nend\r\n```\r\nin my case `params.permit(:id)` raises error because i set `action_on_unpermitted_parameters = :raise` in config"}}