The CSRF 403 error was expected Django behavior (no CSRF cookie in curl). FormatCodeAPI should follow SubmissionAPI's pattern (APIView, not CSRF-exempt). Verified with GET request: /api/format_code returns 405 (correct route resolution). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>