Implementing a Receiver

This guide lists what an inbox does with each request. It adds no rules: each step links to the one it comes from. This order works, but the specification does not require it.

1. Check the headers. Answer a wrong Content-Type with 415 Unsupported Media Type.
2. Verify the signature. Verify it against the raw body, answer a failure with 401 Unauthorized, and answer a repeated signature with a 2xx status code without processing it.
3. Validate the body. Answer a body that is not JSON with 400 Bad Request and an invalid entity with 422 Unprocessable Entity, and handle an unknown type by what kind of type it is.
4. Check the author. An entity’s author must belong to the signing instance.
5. Apply the entity. Processing must be idempotent, a new version replaces the copy you hold, and an entity with nothing to apply to is ignored.
6. Send the response. The inbox should answer with 202 Accepted and no body.

Checks can run after the response has been sent, but they can then no longer report a problem, so the entity is dropped instead.