Ok so if i call the api-url in my browser I see that the header-status-code is 400, but the delete_record function is still being called... Where did I go wrong?
There is no parent router() method, the base controller doesn't have one. It would only introduce overhead if it did, since it requires a call_user_func_array() call to continue with an anction.
The REST base controller does, since it does the format and authentication for all methods called in the router.
This doesnt mean you can't add a router method to your controller, if you do the Request will automatically call it instead of the action.