title: Rails 5 API Strong Parameters behavior
body: <p>I generated a new rails 5 --api --database=postgresql app the other day and only created one scaffold (Hero).  I'm wondering how the strong parameters work in rails as I am seeing some odd behavior:</p>
  
  <p>Controller looks like:</p>
  
  <pre><code>def create
    hero = Hero.new(hero_params)
  
    if hero.save
     render json: hero, status: :created, location: hero
    else
     render json: hero.errors, status: :unprocessable_entity
    end
  end
  </code></pre>
  
  <p>My hero_params look like this:</p>
  
  <pre><code>def hero_params
    params.require(:hero).permit(:name)
  end
  </code></pre>
  
  <p>So I would assume that the client is required to submit a hash containing a <code>"hero"</code> key and it's allowed to have a <code>"name</code>" subkey that is allowed to be mass assigned when this controller action is called.</p>
  
  <p>Meaning, the JSON should look like this:</p>
  
  <pre><code>{
    "hero": {
      "name": "test"
    }
  }
  </code></pre>
  
  <p>All is well but here is where I am seeing strange behavior.  When the user submits the exact JSON as above, the parameters come in as:</p>
  
  <pre><code>Parameters: {"hero"=&gt;{"name"=&gt;"test"}}
  </code></pre>
  
  <p>Now if the user submits just:</p>
  
  <pre><code>{ "name": "test" }
  </code></pre>
  
  <p>It still creates a new resource and the parameters come in as:</p>
  
  <pre><code>Parameters: {"name"=&gt;"test", "hero"=&gt;{"name"=&gt;"test"}}
  </code></pre>
  
  <ol>
  <li><p>Why are there two sets of parameters, one with the actual submitted data and one in the format of a hero object as if it was anticipating the mass assignment?</p></li>
  <li><p>How come the <code>require(:hero)</code> doesn't raise an error when that key is not submitted?  I assume the answer to this is because of what is automatically creating that second hash (<code>"hero"=&gt;{"name"=&gt;"test"}}</code> from question 1.</p></li>
  </ol>
  
  <p>Any information on what I am missing here would be greatly appreciated, as this is barebones rails behavior out-of-the-box.</p>