Guest cart API ignoring cartId in url for some methods

[midlan]

Preconditions

1. Magento 2.2.3

Steps to reproduce

I am following the API documentation to create guest cart and add item to it:

1. POST https://yourdomain/rest/default/V1/guest-carts (with empty body) creates cart for you and return cartId in body
2. GET https://yourdomain/rest/default/V1/guest-carts/:cartId to check you cart is created
3. POST https://yourdomain/rest/default/V1/guest-carts/:cartId/items with body

{
  "cartItem": {
    "sku": "WS12-M-Orange",
    "qty": 3
  }
}

to add item to your cart, but error is returned instead of adding cart to item

Expected result

In step 3, I was expecting the added item to be returned. Instead of that, error is returned.

Actual result

{
    "message": "No such entity with %fieldName = %fieldValue",
    "parameters": {
        "fieldName": "cartId",
        "fieldValue": null
    },
    "trace": "..."
}

Further research

I discovered: If you send the cartId in quote_id field in body at step 3, the method would work. So the body would be:

{
  "cartItem": {
    "sku": "WS12-M-Orange",
    "qty": 3,
    "quote_id": ":cartId"
  }
}

And the results is cart item, no error. The cartId in url is completly ignored. If you use send request with some dummy string instead of cartId in URL (with the body with quote_id field), it actually works.

So request like
POST https://yourdomain/rest/default/V1/guest-carts/some_dummy_string_insetead_of_cartId/items
works. But it should not! And the mandatory quote_id in body is also wrong I think. The only cartId needed to add the item to the cart should be the one from URL (which is not used at all at the moment).

The same problem is present on other methods in guest-cart.

[magento-engcom-team]

@midlan, thank you for your report.
We've acknowledged the issue and added to our backlog.

[elzekool]

I've created a PR for this issue. Investigating this a little further I found a related issue for the normal cart API. In the case /V1/carts/mine/items is used it allows adding/editing items to a quote different then the actual customer quote.