POST /api/FinancialScheduledTransactions rejects ScheduledTransactionDetails since the nested related records REST fix #7144

Description

Since the REST hotfix in b4f11e4 ("Updated the REST API to reject related records nested inside a posted record or named in a PATCH so they are not saved without a permission check."), you can no longer create a scheduled transaction and its details in one v1 REST request. POST /api/FinancialScheduledTransactions with a ScheduledTransactionDetails array now returns 400 Bad Request:

{"Message":"Related records in ScheduledTransactionDetails cannot be saved with this record. Save them separately."}

That commit lets a controller accept a nested collection by overriding IsRelatedEntityCollectionAllowed. It adds overrides for FinancialTransactionsController (TransactionDetails, to keep Check Scanner working) and PeopleController (PhoneNumbers), but not for FinancialScheduledTransactionsController. So external giving integrations that create a schedule and its account splits in one request stop working once a church updates to a version that has the hotfix.

The hotfix is in 17.12.1, 18.8.1, 19.8.1 and 20.0.10-alpha, and in the hotfix-17.12 through hotfix-20.1 branches.

Note for a fix: an override like the one for TransactionDetails would not be enough on its own. FinancialTransactionDetail overrides ParentAuthority to use its transaction, so the transaction's permission check covers its details. FinancialScheduledTransactionDetail does not override ParentAuthority, so the schedule's check would not cover its details. Allowing the collection would also need a ParentAuthority on the detail that points to its schedule, or an explicit permission check on each detail in the controller.

Actual Behavior

The POST returns 400 with the message above, and nothing is saved.

Expected Behavior

A scheduled transaction can be created with its ScheduledTransactionDetails in one request, as it could before the hotfix, with the details authorized.

If the two-step approach is intended instead (POST the schedule, then POST each detail to /api/FinancialScheduledTransactionDetails), please document it as a breaking change for integrators. The two-step approach is not atomic, so if a detail POST fails, the schedule is left with no details or only some of them.

Steps to Reproduce

1. On a Rock version that includes b4f11e4, authenticate as a REST user who can edit FinancialScheduledTransactions.
2. POST /api/FinancialScheduledTransactions with a body that includes details, for example:

   {
     "AuthorizedPersonAliasId": 1,
     "TransactionFrequencyValueId": 1,
     "StartDate": "2026-11-01T00:00:00",
     "IsActive": true,
     "ScheduledTransactionDetails": [
       { "AccountId": 1, "Amount": 25.00 }
     ]
   }

3. The response is 400 with Related records in ScheduledTransactionDetails cannot be saved with this record. Save them separately.

The check runs before any other validation in ApiController<T>.Post, so any body that includes ScheduledTransactionDetails returns the 400.

Issue Confirmation

• Perform a search on the Github Issues to see if your bug is already reported.
• Reproduced the problem on a fresh install or on the demo site.

Rock Version

19.8.1

Client Culture Setting

en-US