server/AyaNova/Controllers/WorkOrderController.cs

@@ -67,6 +67,9 @@ namespace AyaNova.Api.Controllers
             WorkOrderBiz biz = WorkOrderBiz.GetBiz(ct, HttpContext);
             if (!Authorized.HasCreateRole(HttpContext.Items, biz.BizType))
                 return StatusCode(403, new ApiNotAuthorizedResponse());
+            if (newObject.Items.Count > 0)
+                return BadRequest(new ApiErrorResponse(ApiErrorCode.INVALID_OPERATION, "generalerror", "Work order POST route accepts header only; POST Work order descendants separately"));
+
             if (!ModelState.IsValid)
                 return BadRequest(new ApiErrorResponse(ModelState));
             WorkOrder o = await biz.WorkOrderCreateAsync(newObject);
@@ -127,7 +130,7 @@ namespace AyaNova.Api.Controllers
         /// Update WorkOrder        
         ///
         /// </summary>       
-        /// <param name="updatedObject">WorkOrder - top level only, no descendants</param>
+        /// <param name="updatedObject">WorkOrder - top level only, no Items or other descendants</param>
         /// <returns>Updated work order header</returns>
         [HttpPut]
         public async Task<IActionResult> PutWorkOrder([FromBody] WorkOrder updatedObject)