The current endpoint for creating a new list is: http://api.twitter.com/1/user/lists.format
But the "user" part is meant to be the user's screen name. If your application is oAuth, you don't necessarily know or care about the user's screen name. You can easily get it with a verify_credentials call. However, this is the first time that an API endpoint has required two calls to be useful. Why would the user part of the URL be necessary at all if authentication is required?
