Identify the format and check permission
05The media type identifies merge semantics, while the server separately decides whether the requested changes are appropriate and authorized.
This example server does not permit the role change. A valid merge patch has not granted permission, and the stored role stays user.
Source for this drawing: RFC 7396 · Read RFC section 4 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
- Media type
- A label telling a recipient how to interpret the representation.
- Authorization
- A decision about which changes a requester is permitted to make.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
A well-formed patch is not permission to apply it.
- The registered media type is application/merge-patch+json, with no required or optional media-type parameters. RFC 7396 is primarily intended for use with HTTP PATCH; the method and patch format are distinct.
- The recipient determines the actual changes by comparing the patch with the current target. Receiving a syntactically valid JSON value does not by itself establish that those changes are appropriate.
- The server is responsible for determining the appropriateness of each change and the user agent’s authorization to request it. RFC 7396 leaves how those decisions are made out of scope; HTTP PATCH security considerations also apply.
The drawing shows a fictional request to change role from user to admin that a server policy rejects before application. No particular policy, authentication scheme, error status or successful privilege change is prescribed by the format. HTTP conditional-request and atomic-application requirements belong to the PATCH method’s specification, not to a new guarantee invented here.
Read the RFC section ↗