The GET/PUT/POST routes all receive a node id (usually a corpus) and a list id. The list id should be checked to be a valid list of the node id.