Django REST Framework: creating hierarchical objects using URL arguments

Here's what I've done to solve it, although it would be nice if there was a more general way to do it, since it's such a common URL pattern. First I created a mixin for my ViewSets that redefined the create method:

class CreatePartialModelMixin(object):
    def initial_instance(self, request):
        return None

    def create(self, request, *args, **kwargs):
        instance = self.initial_instance(request)
        serializer = self.get_serializer(
            instance=instance, data=request.DATA, files=request.FILES,
            partial=True)

        if serializer.is_valid():
            self.pre_save(serializer.object)
            self.object = serializer.save(force_insert=True)
            self.post_save(self.object, created=True)
            headers = self.get_success_headers(serializer.data)
            return Response(
                serializer.data, status=status.HTTP_201_CREATED,
                headers=headers)

        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

Mostly it is copied and pasted from CreateModelMixin, but it defines an initial_instance method that we can override in subclasses to provide a starting point for the serializer, which is set up to do a partial deserialization. Then I can do, for example,

class SubObjectViewSet(CreatePartialModelMixin, viewsets.ModelViewSet):
    # ....

    def initial_instance(self, request):
        instance = models.SubObject(owner=request.user)
        if 'pk' in self.kwargs:
            parent = models.MainObject.objects.get(pk=self.kwargs['pk'])
            instance.parent = parent
        return instance

(I realize I don't actually need to do a .get on the pk to associate it on the model, but in my case I'm exposing the slug rather than the primary key in the public API)

If you're using ModelSerializer (which is implemented by HyperlinkedModelSerializer) it's as easy as implementing the restore_object() method:

class MySerializer(serializers.ModelSerializer):

    def restore_object(self, attrs, instance=None):

        if instance is None:
            # If `instance` is `None`, it means we're creating
            # a new object, so we set the `parent_id` field.
            attrs['parent_id'] = self.context['view'].kwargs['parent_pk']

        return super(MySerializer, self).restore_object(attrs, instance)

    # ...

restore_object() is used to deserialize a dictionary of attributes into an object instance. ModelSerializer implements this method and creates/updates the instance for the model you specified in the Meta class. If the given instance is None it means the object still has to be created, so you just add the parent_id attribute on the attrs argument and call super().

So this way you don't have to specify a read-only field, or have a custom view/serializer.

More information: http://www.django-rest-framework.org/api-guide/serializers#declaring-serializers