You are using “filters”, but filters only can be used in find, not in findOne for example. I need to put something like a middleware. Example: GavinXue only can modify products created by him, so in the request, I need verify if the user_id is the same of created_by_id.