The scenario

An online shop shows a catalog of products that can be added to a basket. It is an ASP.NET MVC application with a page that receives and sends data through Ajax. It is authenticated, as a basket is associated with the username, and referred to as UserId.

Add to Basket is associated with a JavaScript function that composes the request to the API controller:

        function AddToBasket(productId) {
            $.ajax({
                type: "POST",
                url: "/api/commands/addtobasket",
                contentType: "application/json; charset=utf-8",
                dataType: "json",
                data: JSON.stringify({
                    productId: productId,
                    quantity: 1
                })
            }).done(function (msg) {
                ViewItems();
            });
        }