userId is managed by the service and should not be provided by the caller
User identifier. This field is deprecated and will be ignored — the service resolves user identity from the authenticated session.