Yes the specification allows nested complex types in attributes of an individual resource, BUT the complex type can not be another resource. See for example Clarification on Resources Composed of Other Resources in the json:api forum for details on this topic. If the nested type is another resource, favor a relationship instead. A corollary to this is do not include “foreign keys” in resources, again instead favor relationships between resources that abstract foreign keys away.