title: How to validate together-uniqueness of two (foreign key) related fields of a model?
body: <p>Let's say I have three models in my app that lets user write a review for a book. The requirement is that every user can only do one review for each book.</p>
  <p><code>Review</code> model has two foreign keys to <code>User</code> and <code>Book</code> models. I want to be able to validate user input before creating an instance of <code>Review</code> model to ensure a user can not create more than one review per book.</p>
  <p>I know how to do it if I ask the user to provide the <code>User</code> and <code>Book</code> information in the data that's sent to DRF version 3.+.</p>
  <p>But the url to post a new <code>Review</code> has the <code>Book</code> id in it, and the user is authenticated:</p>
  <p>url used to <code>list</code> and <code>create</code> reviews: <code>/book/{book_id}/reviews/</code></p>
  <p>Right now when I do a <code>POST</code> operation on the url, DRF complains that the <code>book</code> field is required, even though I tried to send keyword arguments to the overloaded <code>perform_create</code> function (see snippets below)</p>
  <p>My guess is I should send the information about book and review that's embedded in the url and <code>request</code> to the default <code>UniqueTogetherValidator</code> but I don't know how to do it!</p>
  <p>I have seen a <a href="https://stackoverflow.com/questions/27239382/drf-3-0-uniquetogethervalidator-with-a-read-only-field">partial solution in this question</a>, but my problem is that I not only have to provide the current authenticated user to the validator but also the <code>book</code> information, since I am requiring a <code>unique_together</code> constraint.</p>
  <ul>
  <li>I have unsuccessfully tried providing <code>default</code> kwarg to the fields.</li>
  <li>Also tried providing a custom validator in the serializer, which didn't succeed.</li>
  </ul>
  <p>So my question is how to validate <code>unique_together</code> of input data from user's request when the <code>book</code> information is embedded in the <code>url</code> and the <code>user</code> information is part of the incoming <code>request</code> (while both of those are related foreign keys and not local attributes of <code>Review</code> model)?</p>
  <p>Here are my models and serializers:</p>
  <h3>models.py</h3>
  <pre class="lang-py prettyprint-override"><code>class Review(models.Model):
  
      # Relationships
      book = models.ForeignKey(Book)
      user = models.ForeignKey(User)
      comment = models.TextField(null=True, blank=True)
  
      class Meta:
          unique_together = ((&quot;user&quot;, &quot;book&quot;),)
  </code></pre>
  <h3>serializers.py</h3>
  <pre class="lang-py prettyprint-override"><code>class ReviewSerializer(serializers.ModelSerializer):
  
      book = serializers.PrimaryKeyRelatedField(read_only=True)
      user = serializers.PrimaryKeyRelatedField(read_only=True)
  
      class Meta:
          model = Review
  </code></pre>
  <h3>Part of views.py</h3>
  <pre class="lang-py prettyprint-override"><code>class ReviewList(generics.ListCreateAPIView):
      serializer_class = ReviewSerializer
      def perform_create(self, serializer):
          serializer.save(user=self.request.user, book=self.kwargs['book_id'])
  </code></pre>
  <h3>urls.py</h3>
  <pre class="lang-py prettyprint-override"><code>url(r'^book/(?P&lt;book_id&gt;\d+)/reviews/$', view=ReviewList.as_view(), name='review-list')
  </code></pre>