Function enforce_object_id_policy 

pub fn enforce_object_id_policy(
    body: &WriteBody,
    allow_custom_object_id: bool,
) -> Result<(), ParseError>

allowCustomObjectId, on the create path only (RestWrite.js:50-65).

This runs on the client’s body, before any server-generated identity is folded in. Signup pre-generates an objectId so it can build the user’s private ACL, so checking after that point would refuse every signup. That is why this is a separate function called by each create route rather than a guard inside the write pipeline.

At the default of false, objectId and id are both refused with INVALID_KEY_NAME. id is there because the JavaScript SDK uses it internally and a body carrying one is a sign the caller serialized a Parse.Object rather than its attributes.

At true, the only check is that a present objectId is not falsy, which upstream reports as MISSING_OBJECT_ID. Note the asymmetry: hasOwnProperty decides whether to check and JS truthiness decides the outcome, so {"objectId": ""} is an error while an absent key is fine.