Wait who is making the request? In your original post, you were talking about the “currently logged in user”. If the request is made with proper credentials (a cookie, for example), it will contain the acted-Flag, just as in the JSON you quoted in the original post.