diff --git a/migrations.go b/migrations.go
index a0ed1d0..36c2fbc 100644
--- a/migrations.go
+++ b/migrations.go
@@ -14,9 +14,9 @@ func setupCollections(app core.App) error {
 	// Create events collection if it doesn't exist
 	if _, err := app.FindCollectionByNameOrId("events"); err != nil {
 		fmt.Println("Creating events collection...")
-		
+
 		eventsCollection := core.NewBaseCollection("events")
-		
+
 		// Admin only access for events
 		eventsCollection.ListRule = nil
 		eventsCollection.ViewRule = nil
@@ -80,9 +80,9 @@ func setupCollections(app core.App) error {
 	// Create shopping_items collection if it doesn't exist
 	if _, err := app.FindCollectionByNameOrId("shopping_items"); err != nil {
 		fmt.Println("Creating shopping_items collection...")
-		
+
 		itemsCollection := core.NewBaseCollection("shopping_items")
-		
+
 		// Public access rules
 		itemsCollection.ListRule = types.Pointer("")
 		itemsCollection.ViewRule = types.Pointer("")
@@ -90,17 +90,21 @@ func setupCollections(app core.App) error {
 		itemsCollection.UpdateRule = types.Pointer("")
 		itemsCollection.DeleteRule = types.Pointer("")
 
-		// Add fields
+		// Add static fields only - no arbitrary fields allowed
 		itemsCollection.Fields.Add(&core.TextField{
 			Name:     "content",
 			Required: false,
 		})
+		itemsCollection.Fields.Add(&core.TextField{
+			Name:     "priority",
+			Required: false,
+		})
 		itemsCollection.Fields.Add(&core.DateField{
 			Name:     "created_at",
 			Required: false,
 		})
 		itemsCollection.Fields.Add(&core.DateField{
-			Name:     "updated_at", 
+			Name:     "updated_at",
 			Required: false,
 		})
 		itemsCollection.Fields.Add(&core.DateField{
diff --git a/test_api.sh b/test_api.sh
index c2f8ed4..921064e 100644
--- a/test_api.sh
+++ b/test_api.sh
@@ -16,13 +16,13 @@ echo
 echo "3. Create an item - single operation"
 curl -X PATCH "$BASE_URL/api/collections/shopping_items/items/test12345678901" \
   -H "Content-Type: application/json" \
-  -d '{"op": "add", "path": "/content", "value": "My test item"}'
+  -d "{\"op\": \"add\", \"path\": \"/content\", \"value\": \"My test item\"}"
 echo
 
 echo "4. Update the item - single operation"
 curl -X PATCH "$BASE_URL/api/collections/shopping_items/items/test12345678901" \
   -H "Content-Type: application/json" \
-  -d '{"op": "replace", "path": "/content", "value": "Updated test item"}'
+  -d "{\"op\": \"replace\", \"path\": \"/content\", \"value\": \"Updated test item\"}"
 echo
 
 echo "5. Get all items"
@@ -32,19 +32,19 @@ echo
 echo "6. Add another field - single operation"
 curl -X PATCH "$BASE_URL/api/collections/shopping_items/items/test12345678901" \
   -H "Content-Type: application/json" \
-  -d '{"op": "add", "path": "/priority", "value": "high"}'
+  -d "{\"op\": \"add\", \"path\": \"/priority\", \"value\": \"high\"}"
 echo
 
 echo "7. Remove a field - single operation"  
 curl -X PATCH "$BASE_URL/api/collections/shopping_items/items/test12345678901" \
   -H "Content-Type: application/json" \
-  -d '{"op": "remove", "path": "/priority"}'
+  -d "{\"op\": \"remove\", \"path\": \"/priority\"}"
 echo
 
 echo "8. Soft delete - single operation"
 curl -X PATCH "$BASE_URL/api/collections/shopping_items/items/test12345678901" \
   -H "Content-Type: application/json" \
-  -d '{"op": "add", "path": "/deleted_at", "value": "2025-09-29T10:00:00Z"}'
+  -d "{\"op\": \"add\", \"path\": \"/deleted_at\", \"value\": \"2025-09-29T10:00:00Z\"}"
 echo
 
 echo "9. Final state"