# Help interpreting "7.3.1 Updating To-One Relationships"

**URL:** <https://discuss.jsonapi.org/t/help-interpreting-7-3-1-updating-to-one-relationships/2317>\
**Category:** Uncategorized\
**Created:** [October 6, 2021, 1:41pm UTC](https://discuss.jsonapi.org/t/help-interpreting-7-3-1-updating-to-one-relationships/2317 "2021-10-06T13:41:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![BillTracy](https://avatars.discourse-cdn.com/v4/letter/b/a88e4f/32.png) [@BillTracy](https://discuss.jsonapi.org/u/BillTracy)\
**Post date:** [October 6, 2021, 1:41pm UTC](https://discuss.jsonapi.org/t/help-interpreting-7-3-1-updating-to-one-relationships/2317/1 "2021-10-06T13:41:03Z")

</div>

Hello,

I am trying to make my API follow the JSON:API spec very strictly, but I’m a little confused on sections 7.3.1 and 7.3.2.

> A server **MUST** respond to `PATCH` , `POST` , and `DELETE` requests to a URL from a to-many relationship link as described below.

> If a client makes a `PATCH` request to a URL from a to-many relationship link, the server **MUST** either completely replace every member of the relationship, return an appropriate error response if some resources can not be found or accessed, or return a `403 Forbidden` response if complete replacement is not allowed by the server.

Does this mean that I cannot have “read-only” relationship routes?

For example if I only want to have this route for the “comments” relationship:  
**GET** /api/posts/{id}/relationships/comments

My server would fail rule 7.3.2 because it does NOT respond to POST, PATCH, or DELETE requests as the rule describes. It would respond with a 404.  
Do I need to have the routes available, and return `403 Forbidden` instead?

Thanks

---

<div class="post-metadata">

**Author:** ![claudenirmf](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.jsonapi.org/claudenirmf/32/714_2.png) [@claudenirmf](https://discuss.jsonapi.org/u/claudenirmf)\
**Post date:** [October 12, 2021, 12:27pm UTC](https://discuss.jsonapi.org/t/help-interpreting-7-3-1-updating-to-one-relationships/2317/2 "2021-10-12T12:27:21Z")

</div>

You are in the section about “updating relationships”. There is another one about “[fetching relationships](https://jsonapi.org/format/#fetching-relationships)” where you find the info you need. Also, you are reading these **MUST** statements out of context, have a look at the beginning of [section 7](https://jsonapi.org/format/#crud):

> A server **MAY** allow resources of a given type to be created. It **MAY** also allow existing resources to be modified or deleted.

---

<div class="post-metadata">

**Author:** ![timothy.stone](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.jsonapi.org/timothy.stone/32/750_2.png) [@timothy.stone](https://discuss.jsonapi.org/u/timothy.stone)\
**Post date:** [October 13, 2021, 2:02pm UTC](https://discuss.jsonapi.org/t/help-interpreting-7-3-1-updating-to-one-relationships/2317/3 "2021-10-13T14:02:46Z")

</div>

Welcome to the community, @BillTracy!

OT, but I want to say thanks for using the new section citations! Hopefully, the numbering proved useful for you in both the **use** of the specification and **asking** your question!

---

<div class="post-metadata">

**Author:** ![BillTracy](https://avatars.discourse-cdn.com/v4/letter/b/a88e4f/32.png) [@BillTracy](https://discuss.jsonapi.org/u/BillTracy)\
**Post date:** [October 13, 2021, 6:13pm UTC](https://discuss.jsonapi.org/t/help-interpreting-7-3-1-updating-to-one-relationships/2317/4 "2021-10-13T18:13:52Z")

</div>

@claudenirmf Thank you for pointing that out. That totally clears things up. I must’ve missed that section.

@timothy.stone Thanks for the kind words and I agree the section numbering helped greatly as well as putting the “musts & mays” in bold. Describing the spec so concisely is certainly an impressive feat.

Thanks again