Thanks for the heads-up. A very good find.

Some clarification. The QueryParameterValidationFilter only validates the query parameters itself. It is allowed to use sparse fields with POST request as perspec. However, theSparseFieldsetsMixin which is in charge of interpreting the fields parameter drops the fields of the serializer when parsing and rendering. It should not do it when parsing which is a bug and leads to your explained behavior. It does not validate exclude fields, but it also drops that field from the input data altogether when saving it.

Looking at the code, the mixin should instead of overwriting__init__ overwrite_readable_fields property. A PR is welcome.