The when/1 function is a part of the language rather than part of the controller as far as I’m aware (it is in erlang). I’m not sure your usage is valid anyway (since plug ApiWeb.Plug.EnsureAuthenticated is not a function header) but I do know that when only has an arity of 1 (only takes 1 param) and the above is trying to take two params, you might try adding some parens around action in [:create] and see if that works.
However standard when clauses are used as part of a function header like :
def function() when some_expression do
which could be looked as
def function() when (some_expressions) do
Where some_expression or the result of (some_expressions) evaluates to a boolean value.