Oh dear, this may be a new record for answering my own question.
return CreatedAtRoute("DefaultApi", new { controller = "messages", id = message.Id }, message);
does the trick. i.e. explicitly specifying the controller. I worked this our by seeing that the exception was related to the UrlHelper and reading its docs…