1. You can override `.save` method of a model and detect that it is an update operation like this
```
def save(self, *args, **kwargs):
if not self._state.adding:
…
```
exception when that parameter is not to your liking during the update.
2. If you rely on DRF serializer, you can create a different serializer for updating
3. Since this is a forum on DRF, to prevent update via http, you write different views for PUT vs POST ie you allow insert into all fields in your POST view but updates on your whitelisted fields in PUT view.