diff --git a/froide/foirequest/serializers.py b/froide/foirequest/serializers.py
index 158cc192b..fe0535c9c 100644
--- a/froide/foirequest/serializers.py
+++ b/froide/foirequest/serializers.py
@@ -3,6 +3,7 @@
 from django.utils.translation import gettext as _
 
 from rest_framework import permissions, serializers
+from rest_framework.generics import ValidationError
 from rest_framework.views import PermissionDenied
 
 from froide.document.api_views import DocumentSerializer
@@ -174,6 +175,11 @@ def get_queryset(self):
         else:
             return get_write_foirequest_queryset(request)
 
+    def run_validation(self, data):
+        if self.context["view"].action == "create":
+            return super().run_validation(data)
+        raise ValidationError(_("Can only set request reference when creating."))
+
 
 class FoiMessageSerializer(serializers.HyperlinkedModelSerializer):
     resource_uri = serializers.HyperlinkedIdentityField(view_name="api:message-detail")
@@ -277,7 +283,7 @@ def validate_kind(self, value):
         # forbid users from e.g. creating a fake e-mail message
         if value not in MESSAGE_KIND_USER_ALLOWED:
             raise serializers.ValidationError(
-                "This message kind can not be created via the API."
+                _("This message kind can not be created via the API.")
             )
         return value
 
@@ -356,7 +362,7 @@ def validate(self, data):
             data=data, foimessage=data["message"], user=self.context["request"].user
         )
         if not self.form.is_valid():
-            raise serializers.ValidationError("Invalid upload")
+            raise serializers.ValidationError(_("Invalid upload"))
 
         return data