server/AyaNova/Controllers/DataListSavedFilterController.cs

@@ -159,6 +159,13 @@ namespace AyaNova.Api.Controllers
             if (!ModelState.IsValid)
                 return BadRequest(new ApiErrorResponse(ModelState));
 
+            //Default filters can never be created from outside
+            //they are only ever created from inside so a post with a default=true is always invalid
+            if (inObj.Default == true)
+            {
+                return BadRequest(new ApiErrorResponse(ApiErrorCode.INVALID_OPERATION, "default", "Default filters can only be created internally"));
+            }
+
             //Create and validate
             DataListSavedFilter o = await biz.CreateAsync(inObj);
             if (o == null)