rfc-7396

JSON Merge Patch

P. Hoffman, J. Snell
date2014-10 streamIETF areaart wgappsawg statusPROPOSED STANDARD pages9 canonicalhttps://www.rfc-editor.org/rfc/rfc7396 doi10.17487/RFC7396
This specification defines the JSON merge patch format and processing rules. The merge patch format is primarily intended for use with the HTTP PATCH method as a means of describing a set of modifications to a target resource's content.

obsoletes

Extracted elements (15)

design-rationale §2

It is not possible to patch part of a target that is not an object, such as replacing just some values in an array. Arrays are replaced wholesale rather than merged element-by-element, which is an intentional scope limitation.

json, http

design-rationale §1

Merge patch documents are suitable only for JSON documents that primarily use objects for their structure and do not make use of explicit null values, because null is overloaded to mean 'delete this key' rather than the JSON null literal.

json, http

interoperability-note §2

If the target implementation allows multiple name/value pairs with the same key name, the result of the MergePatch operation on such objects is not defined by this specification.

json

interoperability-note §1

The merge patch format is not appropriate for all JSON syntaxes. It cannot express setting a member to the JSON null value, nor can it patch arrays partially; alternative patch formats (such as JSON Patch, RFC 6902) should be used in those cases.

json, http

normative-requirement §2 MUST

If the patch is an object but the target is not an object, the target is set to an empty object before applying the patch's name/value pairs.

json, http

normative-requirement §2 MUST

If the patch is anything other than a JSON object, the result is to replace the entire target with the entire patch value, regardless of the target's current content.

json, http

normative-requirement §1 MUST

If the provided merge patch contains members that do not appear within the target, those members are added to the target document.

json, http

normative-requirement §1 MUST

If the target contains a member that also appears in the merge patch, the target member's value is replaced with the value from the patch.

json, http

normative-requirement §2 MUST

Null values in the merge patch indicate the removal of existing values in the target. If the patch member's value is null and the name exists in the target, that name/value pair is removed from the target.

json, http

normative-requirement §2 MUST

The MergePatch operation is defined to operate at the level of data items, not textual representation. It does not preserve whitespace, member ordering, number precision beyond implementation limits, or other textual features.

json

protocol-element §1

A JSON merge patch document describes changes to a target JSON document using syntax that mimics the document being modified. Members not in the target are added; existing members have their values replaced; null values signal removal of existing values.

json, http

protocol-element §2

The MergePatch algorithm is a recursive function taking a Target (any JSON value or undefined) and a Patch (any JSON value). If Patch is an Object, it iterates name/value pairs: null values remove target members, non-null values recursively merge. If Patch is not an Object, it returns Patch directly.

json, http

registry §4

IANA registers the MIME media type 'application/merge-patch+json' (type: application, subtype: merge-patch+json) with no required or optional parameters, encoding per RFC 7159, and intended usage COMMON.

registry, json, http

security-consideration §5

All security considerations discussed in Section 5 of RFC 5789 (PATCH Method for HTTP) apply to all uses of the HTTP PATCH method with the application/merge-patch+json media type.

security, http, json

security-consideration §5

The application/merge-patch+json media type allows user agents to indicate their intention for the server to determine the specific set of change operations to apply to a target resource. It is the server's responsibility to determine the appropriateness of any given change and the user agent's authorization to request such changes.

security, http, json