3.1 Object Identifiers

All Objects in [ActivityStreams] should have unique global identifiers. ActivityPub extends this requirement; all objects distributed by the ActivityPub protocol MUST have unique global identifiers; these identifiers must fall into one of the following groups:

1. Publicly dereferencable URIs, such as HTTPS URIs, with their authority belonging to that of their originating server. (Publicly facing content SHOULD use HTTPS URIs.)
2. An ID explicitly specified as the JSON null object, which implies an anonymous object (a part of its parent context)

Identifiers MUST be provided for activities posted in server to server communication. However, for client to server communication, a server receiving an object with no specified id should allocate an object ID in the user's namespace and attach it to the posted object.

All objects must have the following properties:

id

The object's unique global identifier

type

The type of the object

3.2 Methods on objects

The HTTP GET method may be dereferenced against an object's id property to retrieve the activity. Servers MAY use HTTP content negotiation as defined in [RFC7231] to select the type of data to return in response to a request. The client MUST specify an Accept header, this specification only applies in the selection of the application/activity+json media type.

Servers MAY implement other behavior for requests which do not comply with the above requirement. (For example, servers may implement additional legacy protocols, or may use the same URI for both HTML and ActivityStreams representations of a resource)

Servers MAY require authorization as specified in 9. Authorization, and may additionally implement their own authentication rules. Servers SHOULD fail requests which do not pass their authorization or authentication checks with the appropriate HTTP error code, or the 404 Not Found error code where the existence of the object is considered private.

4.1 Actor objects

Actor objects are ActivityStreams objects which are subclasses of the Actor type. Actor objects MUST have, in addition to the properties mandated by 3.1 Object Identifiers, the following properties:

inbox

A reference to an [ActivityStreams] collection comprising of all the messages received by the actor; see 5.4.2 Inbox.

outbox

An [ActivityStreams] collection comprising of all the messages produced by the actor; see 5.4.1 Outbox.

Implementations SHOULD, in addition, provide the following properties:

url

A link to the actor's "profile web page", if it is not equal to the value of id.

following

An [ActivityStreams] collection of the actors that this actor is following.

followers

An [ActivityStreams] collection of the actors that follow this actor.

name

The preferred "nickname" or "display name" of the actor.

mediaEndpoint

Upload endpoint URI for this user for binary data.

{
  "@context": [
    "https://www.w3.org/ns/activitystreams",
    "https://www.w3.org/ns/activitypub"
  ],
  "type": "Person",
  "id": "https://johnsmith.example.com/",
  "following": "https://johnsmith.example.com/following.json",
  "followers": "https://johnsmith.example.com/followers.json",
  "inbox": "https://johnsmith.example.com/inbox.json",
  "outbox": "https://johnsmith.example.com/feed.json",
  "preferredUsername": "johnsmith",
  "name": "John Smith",
  "summary": "Just an example guy",
  "icon": [
    "https://johnsmith.example.com/image/165987aklre4"
  ]
}

Implementations MAY, in addition, provide the following properties:

streams

A list of supplementary Collections which may be of interest.

preferredUsername

A short username which may be used to refer to the actor, with no uniqueness guarantees.

summary

A quick summary or bio by the user about themself.

icon

A media link to the user's profile picture (this may be a thumbnail).

5.1 Followers Collection

Every actor SHOULD have a followers collection. This is a list of everyone who has sent a Follow activity for the user, added as a side effect. This is where one would find a list of all the users that are following the actor.

5.2 Following Collection

Every actor MAY have a Following collection. This is a list of everybody that the actor has followed, added as a side effect.

5.3 Likes Collection

Every actor MAY have a Likes collection. This is a list of every object from all of the actor's Like activities, added as a side effect.

5.4 Streams

Streams are collections of ActivityStreams objects, generally Activities, which are always presented in reverse chronological order.

5.5 Public Addressing

In addition to [ActivityStreams] collections and objects, Activities may additionally be addressed to the special "public" collection denoted by:

{
  "@context": "https://www.w3.org/ns/activitystreams",
  "id": "https://www.w3.org/ns/activitypub/Public",
  "type": "Collection"
}

Activities addressed to this special URI shall be accessible to all users, without authentication.

7.1 Create Activity

The Create activity is used to when posting a new object. This has the side effect that the object embedded within the Activity (in the object property) is created.

When a Create activity is posted, the actor of the activity SHOULD be copied onto the object's attributedTo field.

{
  "@context": "https://www.w3.org/ns/activitystreams",
  "type": "Note",
  "content": "This is a note",
  "published": "2015-02-10T15:04:55Z",
  "to": ["https://example.org/~john/"],
  "cc": ["https://example.com/~erik/followers"]
}

{
  "@context": "https://www.w3.org/ns/activitystreams",
  "type": "Create"
  "id": "https://example.net/~mallory/87374"
  "actor": "https://example.net/~mallory",
  "object": {
    "id": "https://example.com/~mallory/note/72",
    "type": "Note",
    "attributedTo": "https://example.net/~mallory",
    "content": "This is a note",
    "published": "2015-02-10T15:04:55Z",
    "to": ["https://example.org/~john/"],
    "cc": ["https://example.com/~erik/followers"]
  },
  "published": "2015-02-10T15:04:55Z",
  "to": ["https://example.org/~john/"],
  "cc": ["https://example.com/~erik/followers"]
}

7.2 Update Activity

The Update activity is used when updating an already existing object. The side effect of this is that the object MUST be modified to reflect the new structure in defined in the update activity.

7.3 Delete Activity

The Delete activity is used to delete an already existing object. The side effect of this is that the server MAY replace the object with a Tombstone of the object that will be displayed in activities which reference the deleted object. If the deleted object is requested the server SHOULD respond with either the HTTP 410 Gone status code if a Tombstone is used, otherwise respond with a HTTP 404 Not Found.

A deleted object:

{
  "@context": "https://www.w3.org/ns/activitystreams",
  "id": "https://example.com/~alice/note/72",
  "type": "Tombstone",
  "published": "2015-02-10T15:04:55Z",
  "updated": "2015-02-10T15:04:55Z",
  "deleted": "2015-02-10T15:04:55Z",
}

7.4 Follow Activity

The Follow activity is used to subscribe to the activities of another user.

The side effect of receiving this in an outbox is that the server SHOULD add the object to the actor's Following Collection.

7.5 Add Activity

Upon receipt of an Add activity into the outbox, the server SHOULD add the object to the collection specified in the target property, unless:

• the target is not owned by the receiving user, and thus they can't update it.
• the object is not allowed to be added to the target collection for some other reason, at the receiver's discretion.

7.6 Remove Activity

Upon receipt of a Remove activity into the outbox, the server SHOULD remove the object from the collection specified in the target property, unless:

• the target is not owned by the receiving server, and thus they can't update it.
• the object is not allowed to be added to the target collection for some other reason, at the receiver's discretion.

7.7 Like Activity

The Like activity indicates the actor likes the object.

The side effect of receiving this in an outbox is that the server MAY add the object to the actor's Likes Collection.

7.8 Block Activity

The Block activity is used to indicate that the actor does not want a user (defined in the object property) to be able to interact with objects posted by the user. The server SHOULD prevent the user from interacting with any object posted by the actor.

Servers SHOULD NOT deliver Block Activities to their object.

7.9 Undo Activity

The Undo activity is used to undo a previous activity. For example, Undo may be used to undo a previous Like or Follow. The undo activity and the activity being undone MUST both have the same author. Side effects (such as adding activities to a user's inbox after a Follow) should be undone, to the extent possible.

There are some exceptions where there is an existing and explicit "inverse activity" which should be used instead. Create based activities should instead use Delete, and Add activities should use Remove.

7.10 Delivery

Federated servers MUST perform delivery on all Activities posted to the outbox according to outbox delivery.

8.1 Targeting

Primary targeting is per the audience targetting properties from the [ ActivityStreams] specification. Notification targeting ensures the owners of all linked objects are notified of a new Activity that relates to them. Thus, the target(s) for delivery of an Activity may be:

• Primary targeting: the values of the to, cc or bcc fields (likely to include the followers collection)
• Notification targeting: the actors for all objects in the object, target, inReplyTo or tag fields

If the entry is a collection, then the server MUST dereference the collection (with the user's credentials) and discover inboxes for each item in the collection. Servers MUST limit the number of layers of indirections through collections which will be performed, which MAY be one.

Servers MUST de-duplicate the final recipient list. Servers MUST also exclude actors from the list which are the same as the actor of the Activity being notified about.

8.2 Delivery

Once the target(s) for delivery have been determined, discovery of the recipient inbox(es), and delivery, are performed according to [LDN].

In summary, the inbox is determined through the inbox property in the actor's profile, and an HTTP POST request (with authorization of the submitting user) is made to to the inbox, with the Activity as the body of the request. This Activity is added by the receiver as an item in the inbox Collection.

For federated servers performing delivery to a 3rd party server, delivery SHOULD be performed asynchronously to completion of the original activity submission request, and SHOULD additionally retry delivery to recipients if it fails due to network error.

8.3 Follow Activity

The side effect of receving this in an inbox is that the server SHOULD add the actor to the object user's Followers Collection.

8.4 Like Activity

The side effect of receving this in an inbox is that the server MAY increment the object's count of likes.

8.5 Add Activity

Upon receipt of an Add activity into the inbox, the server SHOULD add the object to the collection specified in the target property, unless:

• the target is not owned by the receiving server, and thus they can't update it.
• the object is not allowed to be added to the target collection for some other reason, at the receiver's discretion.

8.6 Remove Activity

Upon receipt of a Remove activity into the inbox, the server SHOULD remove the object from the collection specified in the target property, unless:

• the target is not owned by the receiving server, and thus they can't update it.
• the object is not allowed to be added to the target collection for some other reason, at the receiver's discretion.

9.1 User Authentication

User authentication is used in order to identify clients acting on behalf of an actor their origin server, and for federated implementations to other servers. There are two types of authentication permitted for this:

9.2 Origin Authorization

This method is only applicable to federated implementations

A server performing an operation on behalf of an actor (e.g. delivery to a recipient) must authenticate itself with the 3rd party server as such. One method for doing so is defined in this specification.