<?xml version="1.0" encoding="utf-8"?>
<!-- name="GENERATOR" content="github.com/mmarkdown/mmark Mmark Markdown Processor - mmark.miek.nl" --> encoding="UTF-8"?>

<!DOCTYPE rfc [
 <!ENTITY nbsp    "&#160;">
 <!ENTITY zwsp   "&#8203;">
 <!ENTITY nbhy   "&#8209;">
 <!ENTITY wj     "&#8288;">
]>

<rfc version="3" ipr="trust200902" docName="draft-ietf-jmap-blob-18" number="9404" submissionType="IETF" category="std" consensus="true" xml:lang="en" xmlns:xi="http://www.w3.org/2001/XInclude" updates="8620" indexInclude="true" consensus="true"> obsoletes=""
symRefs="true" sortRefs="true" tocInclude="true">

<front>

  <title abbrev="JMAP Blob">JMAP Blob">JSON Meta Application Protocol (JMAP) Blob management extension</title><seriesInfo value="draft-ietf-jmap-blob-18" stream="IETF" status="standard" name="Internet-Draft"></seriesInfo> Management Extension</title>
  <seriesInfo name="RFC" value="9404"/>
  <author role="editor" initials="B." surname="Gondwana" fullname="Bron Gondwana"><organization>Fastmail</organization><address><postal><street>Level Gondwana">
    <organization>Fastmail</organization>
    <address>
      <postal>
	<street>Level 2, 114 William St</street>
	<city>Melbourne</city>
<code>VIC 3000</code>
	<region>VIC</region>
	<code>3000</code>
	<country>Australia</country>
</postal><email>brong@fastmailteam.com</email>
      </postal>
      <email>brong@fastmailteam.com</email>
      <uri>https://www.fastmail.com</uri>
</address></author><date
  </address></author>

  <date year="2023" month="January" day="4"></date>
<area>Applications</area>
<workgroup>JMAP</workgroup> month="August"></date>
  <area>art</area>
  <workgroup>jmap</workgroup>
  <keyword>jmap</keyword>

  <abstract>
<t>The JMAP JSON Meta Application Protocol (JMAP) base protocol (RFC8620) (RFC 8620) provides
the ability to upload and download arbitrary binary data via HTTP POST and GET
on a defined endpoint.  This binary data is called a &quot;blob&quot;.</t> "blob".</t>
<t>This extension adds additional ways to create and access blobs, blobs by making
inline method calls within a standard JMAP request.</t>
<t>This extension also adds a reverse lookup mechanism to discover where blobs
are referenced within other data types.</t>
</abstract>

</front>

<middle>

<section anchor="introduction"><name>Introduction</name>
<t>Sometimes JMAP (<xref target="RFC8620"></xref>) <xref target="RFC8620"></xref> interactions require creating
a blob and then referencing it.  In the same way that IMAP Literals literals were
extended by <xref target="RFC7888"></xref>, embedding small blobs directly
into the JMAP method calls array can be an option for reducing roundtrips.</t> round trips.</t>
<t>Likewise, when fetching an object, it can be useful to also fetch the raw
content of that object without a separate roundtrip.</t> round trip.</t>
<t>Since raw blobs may contain arbitrary binary data, this document defines
a use of the base64 coding specified in <xref target="RFC4648"></xref> for both creating and
fetching blob data.</t>
<t>Where
<t>When JMAP is being proxied through a system which that applies additional
access restrictions, it can be useful to know which objects reference
any particular blob, and blob; this document defines a way to discover those
references.</t>
</section>

<section anchor="conventions-used-in-this-document"><name>Conventions Used In in This Document</name>
<t>The
        <t>
    The key words &quot;MUST&quot;, &quot;MUST NOT&quot;, &quot;REQUIRED&quot;, &quot;SHALL&quot;, &quot;SHALL
NOT&quot;, &quot;SHOULD&quot;, &quot;SHOULD NOT&quot;, &quot;RECOMMENDED&quot;, &quot;NOT RECOMMENDED&quot;,
&quot;MAY&quot;, "<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>",
    "<bcp14>REQUIRED</bcp14>", "<bcp14>SHALL</bcp14>", "<bcp14>SHALL
    NOT</bcp14>", "<bcp14>SHOULD</bcp14>", "<bcp14>SHOULD NOT</bcp14>",
    "<bcp14>RECOMMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>",
    "<bcp14>MAY</bcp14>", and &quot;OPTIONAL&quot; "<bcp14>OPTIONAL</bcp14>" in this document are
    to be interpreted as described in BCP 14 BCP&nbsp;14 <xref target="RFC2119"></xref> target="RFC2119"/>
    <xref target="RFC8174"></xref> target="RFC8174"/> when, and only when, they appear in all capitals,
    as shown here.</t> here.
        </t>
<t>The definitions of JSON keys and datatypes in the document follow the
conventions described in the core JMAP specification <xref target="RFC8620"></xref>.</t>
</section>

<section anchor="addition-to-the-capabilities-object"><name>Addition to the Capabilities Object</name>
<t>The capabilities object is returned as part of the JMAP Session
object; see <xref target="RFC8620"></xref>, Section 2.</t> target="RFC8620" sectionFormat="comma" section="2"></xref>.</t>
<t>This document defines an additional capability URI.</t>

<section anchor="urn-ietf-params-jmap-blob"><name>urn:ietf:params:jmap:blob</name>
<t>The presence of the capability <tt>urn:ietf:params:jmap:blob</tt> being present in the
&quot;accountCapabilities&quot;
accountCapabilities property of an account represents support for additional
API methods on the Blob datatype.  Servers that include the capability in one
or more &quot;accountCapabilities&quot; accountCapabilities properties MUST <bcp14>MUST</bcp14> also include the
property in the &quot;capabilities&quot; capabilities property.</t>

<t>The value of this property in the JMAP session &quot;capabilities&quot; Session capabilities
property MUST <bcp14>MUST</bcp14> be an empty object.</t>
<t>The value of this property in an account's &quot;accountCapabilities&quot; accountCapabilities
property is an object that MUST <bcp14>MUST</bcp14> contain the following information
on server capabilities and permissions for that account:</t>

<ul>
  <li><t>maxSizeBlobSet: <tt>UnsignedInt|null</tt></t>
<t>This is the "UnsignedInt|null"</t>
  <t>The maximum size of the blob (in octets) that the server will
  allow to be created (including blobs created by concatenating multiple data
  sources together).</t>
  <t>Clients MUST NOT <bcp14>MUST NOT</bcp14> attempt to create blobs larger than this
  size.</t>

  <t>If this value is <tt>null</tt>, then clients are not required to limit
  the size of the blob they try to create, though servers can always reject
  creation of blobs regardless of size; e.g. size, e.g., due to lack of disk space, space or
  per-user rate limits.</t>
</li> limits.</t></li>
  <li><t>maxDataSources: <tt>UnsignedInt</tt></t> "UnsignedInt"</t>
  <t>The maximum number of DataSourceObjects allowed per creation in a
  Blob/upload.</t>
  <t>Servers MUST <bcp14>MUST</bcp14> allow at least 64 DataSourceObjects per creation.</t>
</li>
  creation.</t></li>
  <li><t>supportedTypeNames: <tt>String[]</tt></t> "String[]"</t>
  <t>An array of data type names that are supported for <tt>Blob/lookup</tt>.
  If the server does not support lookups lookups, then this will be the empty list.</t>
<t>NOTE,
  <t>Note that the supportedTypeNames list may include private types which that are not
  in the JMAP Types Registry "JMAP Data Types" registry defined by this document.  Clients MUST
  <bcp14>MUST</bcp14> ignore type names they do not recognise.</t>
</li> recognise.</t></li>
  <li><t>supportedDigestAlgorithms: <tt>String[]</tt></t> "String[]"</t>
  <t>An array of supported digest algorithms that are supported for
  <tt>Blob/get</tt>.  If the server does not support calculating blob digests,
  then this will be the empty list.  Algorithms in this list MUST
  <bcp14>MUST</bcp14> be present in the HTTP "HTTP Digest
Algorithms Algorithm Values"
  registry defined by <xref target="RFC3230"></xref>, and are always lowercased.</t> target="RFC3230"></xref>; however, in JMAP, they
  must be lowercased, e.g., "md5" rather than "MD5".</t>
  <t>Clients SHOULD <bcp14>SHOULD</bcp14> prefer algorithms listed earlier in this list.</t>
</li>
  list.</t></li>
</ul>

<section anchor="capability-example"><name>Capability Example</name>

<artwork>{
  &quot;capabilities&quot;:

<sourcecode type="json"><![CDATA[{
  "capabilities": {
    ...,
    &quot;urn:ietf:params:jmap:blob&quot;:
    "urn:ietf:params:jmap:blob": {}
  },
  &quot;accounts&quot;:
  "accounts": {
    &quot;A13842&quot;:
    "A13842": {
      ...
      &quot;accountCapabilities&quot;:
      "accountCapabilities": {
        &quot;urn:ietf:params:jmap:blob&quot;:
        "urn:ietf:params:jmap:blob": {
          &quot;maxSizeBlobSet&quot;:
          "maxSizeBlobSet": 50000000,
          &quot;maxDataSources&quot;:
          "maxDataSources": 100,
          &quot;supportedTypeNames&quot;
          "supportedTypeNames" : [
            &quot;Mailbox&quot;,
            &quot;Thread&quot;,
            &quot;Email&quot;
            "Mailbox",
            "Thread",
            "Email"
          ],
          &quot;supportedDigestAlgorithms&quot;
          "supportedDigestAlgorithms" : [
            &quot;sha&quot;,
            &quot;sha-256&quot;
            "sha",
            "sha-256"
          ]
        }
      }
    }
  }
}
</artwork>
}]]></sourcecode>

</section>
</section>
</section>

<section anchor="blob-methods"><name>Blob Methods</name>
<t>A blob is a sequence of zero or more octets.</t>
<t>The JMAP base spec
<t>JMAP <xref target="RFC8620"></xref> target="RFC8620" format="default"/> defines the
<tt>Blob/copy</tt> method, which is unchanged by this specification, specification and is
selected by the <tt>urn:ietf:params:jmap:core</tt> capability.</t>
<t>The following JMAP Methods methods are selected by the
<tt>urn:ietf:params:jmap:blob</tt> capability.</t>

<section anchor="blob-upload"><name>Blob/upload</name>
<t>This is similar to a Foo/set from in <xref target="RFC8620"></xref> in some ways, however
ways. However, blobs can not cannot be updated or deleted, so only <tt>create</tt> is
allowed in the method call, and call. Also, blobs do not have state, so there is no
<tt>state</tt> field present in the method response.</t>

<t><strong>Parameters</strong></t>
<ul>
  <li><t>accountId: <tt>Id</tt></t> "Id"</t>
  <t>The id of the account in which the blobs will be created.</t>
</li> created.</t></li>
  <li><t>create: <tt>Id[UploadObject]</tt></t> "Id[UploadObject]"</t>
  <t>A map of creation id to UploadObjects.</t>
</li> UploadObjects.</t></li>
</ul>

<t><strong>Result</strong></t>
<t>The result is the same as for Foo/set in RFC8620, <xref target="RFC8620" format="default"/>, with <tt>created</tt> and <tt>notCreated</tt> objects
mapping from the creationId.</t> creation id.</t>
<t>The <tt>created</tt> objects contain:</t>

<ul>
  <li><t>id: <tt>Id</tt></t>
<t>the "Id"</t>
  <t>The blobId which that was created</t>
</li> created.</t></li>
  <li><t>type: <tt>String|null</tt></t>
<t>the "String|null"</t>
  <t>The media type as given in the creation (if any); or detected from any). If not provided, the
  server <bcp14>MAY</bcp14> perform content by analysis and return one of the
server;
  following: the calculated value, "application/octet-string", or null</t>
</li>
  null.</t></li>
  <li><t>size: <tt>UnsignedInt</tt></t>
<t>as "UnsignedInt"</t>
  <t>As per RFC8620 - <xref target="RFC8620" format="default"/>, the size of the
  created blob in octets</t>
</li> octets.</t></li>
</ul>
<t>It

   <t>The created objects will also contain any other properties identical to
   those that would be returned in the JSON response of the RFC8620 upload endpoint (which
   described in <xref target="RFC8620" format="default"/>.  This may be
   extended in the future - future; in this document anticipates document, it is anticipated that
   implementations will extend both the upload endpoint and the Blob/upload
   responses in the same way)</t>
<t>Or if way.</t>

<t>If there is a problem with a creation, then the server will return a
<tt>notCreated</tt> response with a map from the failed creationId creation id to a
<tt>SetError</tt> object.</t>
<t>For each successful upload, servers MUST <bcp14>MUST</bcp14> add an entry to the <tt>creationIds</tt>
<tt>createdIds</tt> map (<xref target="RFC8620" sectionFormat="comma"
section="3.3"/>) for the request. request; even if the caller did not explicitly pass a
createdIds, the value must be available to later methods defined in the same
Request Object. This allows the blob id blobId to be used via back-reference in
subsequent method calls.</t>
<t>The created blob will have the same lifetime and same expiry semantics as
any other binary object created via the mechanism specified in [!@RFC8620] section 6.</t> <xref
target="RFC8620" sectionFormat="comma" section="6"/>.</t>

<t>Uploads using with this mechanism will be restricted by the maxUploadSize limit
for JMAP requests specified by the server, and clients SHOULD <bcp14>SHOULD</bcp14>
consider using the upload mechanism defined by [!@RFC8620] <xref target="RFC8620"
format="default"/> for blobs larger than a megabyte.</t>

<t><strong>UploadObject</strong></t>

<ul>
  <li><t>data: <tt>DataSourceObject[]</tt></t>
<t>an "DataSourceObject[]"</t>
  <t>An array of zero or more octet sources in order (zero to create an empty
  blob).  The result of each of these sources is concatenated together in
  order to create the blob.</t>
</li> blob.</t></li>
  <li><t>type: <tt>String|null</tt> "String|null" (default: null)</t>
<t>hint
  <t>A hint for media type of the data</t>
</li> data.</t></li>
</ul>

<t><strong>DataSourceObject</strong></t>
<t>Exactly one of:</t>

<ul>

<ul spacing="normal">
  <li><t>data:asText: <tt>String|null</tt> "String|null" (raw octets, must be UTF-8)</t>
</li>
<li><t>data:asBase64: <tt>String|null</tt> "String|null" (base64 representation of octets)</t>
</li>
</ul>

<t>or a blobId source:</t>

<ul>

<ul spacing="normal">
<li><t>blobId: <tt>Id</tt></t> "Id"</t>
</li>
<li><t>offset: <tt>UnsignedInt|null</tt> (MAY "UnsignedInt|null" (<bcp14>MAY</bcp14> be zero)</t>
</li>
<li><t>length: <tt>UnsignedInt|null</tt> (MAY "UnsignedInt|null" (<bcp14>MAY</bcp14> be zero)</t>
</li>
</ul>

<t>If <tt>null</tt> <tt>null</tt>, then offset is assumed to be zero.</t>
<t>If <tt>null</tt> <tt>null</tt>, then length is the remaining octets in the blob.</t>
<t>If the range can not cannot be fully satisfied (i.e. (i.e., it begins or extends past
the end of the data in the blob) blob), then the DataSourceObject is invalid
and results in a notCreated response for this creation id.</t>
<t>If the data properties have any invalid references or invalid data
contained in them, the server MUST NOT <bcp14>MUST NOT</bcp14> guess as to the user's intent, intent
and MUST <bcp14>MUST</bcp14> reject the creation and return a notCreated response for that
creation id.</t>
<t>Likewise, invalid characters in the base64 of data:asBase64, data:asBase64 or invalid
UTF-8 in data:asText MUST <bcp14>MUST</bcp14> result in a nonCreated notCreated response.</t>
<t>It is envisaged that the definition for DataSourceObject might be
extended in the future, for example example, to fetch external content.</t>
<t>A server MUST <bcp14>MUST</bcp14> accept at least 64 DataSourceObjects per create, as
described in Section 3.1 <xref target="urn-ietf-params-jmap-blob" format="default"/> of this document.</t>

<section anchor="blob-upload-simple-example"><name>Blob/upload simple example</name> Simple Example</name>
<t>The data:asBase64 field is set over multiple lines for ease of publication here, however all
here; however, the entire data:asBase64 field would be sent as a continuous
string with no whitespace wrapping on the wire.</t>

<artwork>Method Call:

<t>Method Call:</t>

<sourcecode type="json"><![CDATA[
[
  &quot;Blob/upload&quot;,
 "Blob/upload",
 {
    &quot;accountId&quot;: &quot;account1&quot;,
    &quot;create&quot;:
  "accountId": "account1",
  "create": {
      &quot;1&quot;:
   "1": {
        &quot;data&quot;
    "data" : [
    {
            &quot;data:asBase64&quot;: &quot;iVBORw0KGgoAAAANSUhEUgAAAAEAAAABAQMAAAAl21bKA
     "data:asBase64": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABAQMAAAAl21bKA
                       AAAA1BMVEX/AAAZ4gk3AAAAAXRSTlN/gFy0ywAAAApJRE
                              FUeJxjYgAAAAYAAzY3fKgAAAAASUVORK5CYII=&quot;,
                       FUeJxjYgAAAAYAAzY3fKgAAAAASUVORK5CYII="
    }
   ],
        &quot;type&quot;: &quot;image/png&quot;
      },
    },
   "type": "image/png"
   }
  }
 },
  &quot;R1&quot;
]

Response:

[
  &quot;Blob/upload&quot;,
 "R1"
]]]></sourcecode>

<t>Response:</t>

<sourcecode type="json"><![CDATA[[
  "Blob/upload",
  {
    &quot;accountId&quot;
    "accountId" : &quot;account1&quot;,
    &quot;created&quot; "account1",
    "created" : {
      &quot;1&quot;:
      "1": {
        &quot;id&quot;
        "id" : &quot;G4c6751edf9dd6903ff54b792e432fba781271beb&quot;,
        &quot;type&quot; "G4c6751edf9dd6903ff54b792e432fba781271beb",
        "type" : &quot;image/png&quot;,
        &quot;size&quot; "image/png",
        "size" : 95
      }
    }
  },
    },
  },
  &quot;R1&quot;
]
</artwork>
  "R1"
]]]></sourcecode>

</section>

<section anchor="blob-upload-complex-example"><name>Blob/upload complex example</name>

<artwork>Method Calls: Complex Example</name>

<t>Method Calls:</t>

<sourcecode type="json"><![CDATA[
[
 [
    &quot;Blob/upload&quot;,
  "Blob/upload",
  {
      &quot;create&quot;:
   "create": {
        &quot;b4&quot;:
    "b4": {
          &quot;data&quot;:
     "data": [
      {
              &quot;data:asText&quot;: &quot;The
       "data:asText": "The quick brown fox jumped over the lazy dog.&quot; dog."
      }
    ]
   }
  }
 },
    &quot;S4&quot;
 "S4"
],
[
    &quot;Blob/upload&quot;,
  "Blob/upload",
  {
      &quot;create&quot;:
   "create": {
        &quot;cat&quot;:
     "cat": {
          &quot;data&quot;:
       "data": [
         {
              &quot;data:asText&quot;: &quot;How&quot;
           "data:asText": "How"
         },
         {
              &quot;blobId&quot;: &quot;#b4&quot;,
              &quot;length&quot;:
           "blobId": "#b4",
           "length": 7,
              &quot;offset&quot;:
           "offset": 3
         },
         {
              &quot;data:asText&quot;: &quot;was t&quot;
           "data:asText": "was t"
         },
         {
              &quot;blobId&quot;: &quot;#b4&quot;,
              &quot;length&quot;:
           "blobId": "#b4",
           "length": 1,
              &quot;offset&quot;:
           "offset": 1
         },
         {
              &quot;data:asBase64&quot;: &quot;YXQ/&quot;
           "data:asBase64": "YXQ/"
         }
       ]
     }
   }
  },
    &quot;CAT&quot;
  "CAT"
],
[
    &quot;Blob/get&quot;,
  "Blob/get",
  {
      &quot;properties&quot;:
   "properties": [
        &quot;data:asText&quot;,
        &quot;size&quot;
     "data:asText",
     "size"
   ],
      &quot;ids&quot;:
   "ids": [
        &quot;#cat&quot;
     "#cat"
   ]
  },
    &quot;G4&quot;
  ]
  "G4"
 ]

Responses:

[
]]]></sourcecode>

<t>Responses:</t>

<sourcecode type="json"><![CDATA[[
  [
    &quot;Blob/upload&quot;,
    "Blob/upload",
    {
      &quot;oldState&quot;:
      "oldState": null,
      &quot;created&quot;:
      "created": {
        &quot;b4&quot;:
        "b4": {
          &quot;id&quot;: &quot;Gc0854fb9fb03c41cce3802cb0d220529e6eef94e&quot;,
          &quot;size&quot;:
          "id": "Gc0854fb9fb03c41cce3802cb0d220529e6eef94e",
          "size": 45,
          &quot;type&quot;: &quot;application/octet-stream&quot;
          "type": "application/octet-stream"
        }
      },
      &quot;notCreated&quot;:
      "notCreated": null,
      &quot;accountId&quot;: &quot;account1&quot;
      "accountId": "account1"
    },
    &quot;S4&quot;
    "S4"
  ],
  [
    &quot;Blob/upload&quot;,
    "Blob/upload",
    {
      &quot;oldState&quot;:
      "oldState": null,
      &quot;created&quot;:
      "created": {
        &quot;cat&quot;:
        "cat": {
          &quot;id&quot;: &quot;Gcc60576f036321ae6e8037ffc56bdee589bd3e23&quot;,
          &quot;size&quot;:
          "id": "Gcc60576f036321ae6e8037ffc56bdee589bd3e23",
          "size": 19,
          &quot;type&quot;: &quot;application/octet-stream&quot;
          "type": "application/octet-stream"
        }
      },
      &quot;notCreated&quot;:
      "notCreated": null,
      &quot;accountId&quot;: &quot;account1&quot;
      "accountId": "account1"
    },
    &quot;CAT&quot;
    "CAT"
  ],
  [
    &quot;Blob/get&quot;,
    "Blob/get",
    {
      &quot;list&quot;:
      "list": [
        {
          &quot;id&quot;: &quot;Gcc60576f036321ae6e8037ffc56bdee589bd3e23&quot;,
          &quot;data:asText&quot;: &quot;How
          "id": "Gcc60576f036321ae6e8037ffc56bdee589bd3e23",
          "data:asText": "How quick was that?&quot;,
          &quot;size&quot;: that?",
          "size": 19
        }
      ],
      &quot;notFound&quot;:
      "notFound": [],
      &quot;accountId&quot;: &quot;account1&quot;
      "accountId": "account1"
    },
    &quot;G4&quot;
    "G4"
  ]
]
</artwork>
]]]></sourcecode>

</section>
</section>

<section anchor="blob-get"><name>Blob/get</name>

<t>A standard JMAP get, with two additional optional parameters:</t>

<ul>
  <li><t>offset: <tt>UnsignedInt|null</tt></t>
<t>start "UnsignedInt|null"</t>
  <t>Start this many octets into the blob data.  If null or unspecified, this
  defaults to zero.</t>
</li> zero.</t></li>
  <li><t>length: <tt>UnsignedInt|null</tt></t>
<t>return "UnsignedInt|null"</t>
  <t>Return at most this many octets of the blob data.  If null or
  unspecified, then all remaining octets in the blob are returned.  This can
  be considered equivalent to an infinitely large length value, except that
  the isTruncated warning is not given unless the start offset is past the end
  of the blob.</t>
</li> blob.</t></li>
</ul>

<t><strong>Request Properties:</strong></t>
<t>Any of</t> of:</t>

<ul spacing="compact"> spacing="normal">
<li>data:asText</li>
<li>data:asBase64</li>
<li>data (returns data:asText if the selected octets are valid UTF-8, UTF-8 or data:asBase64)</li>
<li>digest:&lt;algorithm&gt; (where &lt;algorithm&gt; is one of the named algorithms in the <tt>supportedDigestAlgorithms</tt> capability)</li>
<li>size</li>
</ul>
<t>If not given, the properties defaults default to <tt>data</tt> and <tt>size</tt>.</t>

<t><strong>Result Properties:</strong></t>

<ul>
  <li><t>data:asText: <tt>String|null</tt></t>
<t>the "String|null"</t>
  <t>The raw octets of the selected range if they are valid UTF-8, otherwise null</t>
</li> UTF-8; otherwise,
  null.</t></li>
  <li><t>data:asBase64: <tt>String</tt></t>
<t>the "String"</t>
  <t>The base64 encoding of the octets in the selected range</t>
</li>
<li><t>digest:&lt;algorithm&gt; <tt>String</tt></t>
<t>the range.</t></li>
  <li><t>digest:&lt;algorithm&gt;: "String"</t>
  <t>The base64 encoding of the digest of the octets in the selected range,
  calculated using the named algorithm</t>
</li> algorithm.</t></li>
  <li><t>isEncodingProblem: <tt>Boolean</tt> "Boolean" (default: false)</t>
</li> false)</t></li>
  <li><t>isTruncated: <tt>Boolean</tt> "Boolean" (default: false)</t>
</li> false)</t></li>
  <li><t>size: <tt>UnsignedInt</tt></t>
<t>the "UnsignedInt"</t>
  <t>The number of octets in the entire blob</t>
</li> blob.</t></li>
</ul>

<t>The size value MUST <bcp14>MUST</bcp14> always be the number of octets in the underlying blob,
regardless of offset and length.</t>
<t>The data fields contain a representation of the octets within the selected
range that are present in the blob.  If the octets selected are not valid
UTF-8 (including truncating in the middle of a multi-octet sequence)
and <tt>data</tt> or <tt>data:asText</tt> was requested, then the key <tt>isEncodingProblem</tt>
MUST
<bcp14>MUST</bcp14> be set to <tt>true</tt> <tt>true</tt>, and the <tt>data:asText</tt> response value MUST <bcp14>MUST</bcp14> be <tt>null</tt>.
In the case where <tt>data</tt> was requested and the data is not valid UTF-8,
then <tt>data:asBase64</tt> MUST <bcp14>MUST</bcp14> be returned.</t>
<t>If the selected range requests data outside the blob (i.e. (i.e., the
offset+length is larger than the blob) blob), then the result is either just the
octets from the offset to the end of the blob, blob or an empty string if the
offset is past the end of the blob.  Either way, the <tt>isTruncated</tt> isTruncated
property in the result MUST <bcp14>MUST</bcp14> be set to <tt>true</tt> to tell the
client that the requested range could not be fully satisfied.  If digest was
requested, any <tt>digest</tt> is calculated on the octets that would be
returned for a <tt>data</tt> field.</t>
<t>Servers SHOULD <bcp14>SHOULD</bcp14> store the size for blobs in a format which that is
efficient to read, and clients SHOULD <bcp14>SHOULD</bcp14> limit their request to
just the size parameter if that is all they need, as fetching blob content
could be significantly more expensive and slower for the server.</t>

<section anchor="blob-get-simple-example"><name>Blob/get simple example</name>
<t>Where Simple Example</name>
<t>In this example, a blob containing the string &quot;The "The quick brown fox jumped over
the lazy dog.&quot; dog." has blobId <tt>Gc0854fb9fb03c41cce3802cb0d220529e6eef94e</tt>.</t>
<t>The first method call requests just the size for multiple blobs, and
the second requests both the size and a short range of the data for one
of the blobs.</t>

<artwork>Method Calls:

<t>Method Calls:</t>

<sourcecode type="json"><![CDATA[[
  [
  [
    &quot;Blob/get&quot;,
    "Blob/get",
    {
      &quot;accountId&quot;
      "accountId" : &quot;account1&quot;,
      &quot;ids&quot; "account1",
      "ids" : [
        &quot;Gc0854fb9fb03c41cce3802cb0d220529e6eef94e&quot;,
        &quot;not-a-blob&quot;
        "Gc0854fb9fb03c41cce3802cb0d220529e6eef94e",
        "not-a-blob"
      ],
      &quot;properties&quot;
      "properties" : [
        &quot;data:asText&quot;,
        &quot;digest:sha&quot;,
        &quot;size&quot;
        "data:asText",
        "digest:sha",
        "size"
      ]
    },
    &quot;R1&quot;
    "R1"
  ],
  [
    &quot;Blob/get&quot;,
    "Blob/get",
    {
      &quot;accountId&quot;
      "accountId" : &quot;account1&quot;,
      &quot;ids&quot; "account1",
      "ids" : [
        &quot;Gc0854fb9fb03c41cce3802cb0d220529e6eef94e&quot;
        "Gc0854fb9fb03c41cce3802cb0d220529e6eef94e"
      ],
      &quot;properties&quot;
      "properties" : [
        &quot;data:asText&quot;,
        &quot;digest:sha&quot;,
        &quot;digest:sha-256&quot;,
        &quot;size&quot;
        "data:asText",
        "digest:sha",
        "digest:sha-256",
        "size"
      ],
      &quot;offset&quot;
      "offset" : 4,
      &quot;length&quot;
      "length" : 9
    },
    &quot;R2&quot;
  ]
    "R2"
  ]

Responses:
]]]></sourcecode>

<t>Responses:</t>

<sourcecode type="json"><![CDATA[
[
 [
    &quot;Blob/get&quot;,
  "Blob/get",
  {
      &quot;accountId&quot;: &quot;account1&quot;,
      &quot;list&quot;:
   "accountId": "account1",
   "list": [
    {
          &quot;id&quot;: &quot;Gc0854fb9fb03c41cce3802cb0d220529e6eef94e&quot;,
          &quot;data:asText&quot;: &quot;The
     "id": "Gc0854fb9fb03c41cce3802cb0d220529e6eef94e",
     "data:asText": "The quick brown fox jumped over the lazy dog.&quot;,
          &quot;digest:sha&quot;: &quot;wIVPufsDxBzOOALLDSIFKebu+U4=&quot;,
          &quot;size&quot;: dog.",
     "digest:sha": "wIVPufsDxBzOOALLDSIFKebu+U4=",
     "size": 45
    }
  ],
      &quot;notFound&quot;:
  "notFound": [
        &quot;not-a-blob&quot;
   "not-a-blob"
  ]
 },
    &quot;R1&quot;
 "R1"
],
[
    &quot;Blob/get&quot;,
 "Blob/get",
 {
      &quot;accountId&quot;: &quot;account1&quot;,
      &quot;list&quot;: [
        {
          &quot;id&quot;: &quot;Gc0854fb9fb03c41cce3802cb0d220529e6eef94e&quot;,
          &quot;data:asText&quot;: &quot;quick bro&quot;,
          &quot;digest:sha&quot;: &quot;QiRAPtfyX8K6tm1iOAtZ87Xj3Ww=&quot;,
          &quot;digest:sha-256&quot;: &quot;gdg9INW7lwHK6OQ9u0dwDz2ZY/gubi0En0xlFpKt0OA=&quot;,
          &quot;size&quot;:
  "accountId": "account1",
  "list": [
   {
    "id": "Gc0854fb9fb03c41cce3802cb0d220529e6eef94e",
    "data:asText": "quick bro",
    "digest:sha": "QiRAPtfyX8K6tm1iOAtZ87Xj3Ww=",
    "digest:sha-256": "gdg9INW7lwHK6OQ9u0dwDz2ZY/gubi0En0xlFpKt0OA=",
    "size": 45
    }
   ]
  },
    &quot;R2&quot;
  ]
  "R2"
 ]

</artwork>
]]]></sourcecode>

</section>

<section anchor="blob-get-example-with-range-and-encoding-errors"><name>Blob/get example Example with range Range and encoding errors</name> Encoding Errors</name>

<t>The <tt>b1</tt> value is the text: &quot;The text "The quick brown fox jumped over the \x81\x81 fox&quot; dog.", which contains an invalid utf8 UTF-8 sequence.</t>
<t>The results have the following interesting properties:</t>

<ul>
<li><t>G1: defaults Defaults to <tt>data</tt> and <tt>size</tt> - <tt>size</tt>, so b1 returns
<tt>isEncodingProblem</tt> and a base64 value.</t>
</li>
<li><t>G2: since Since <tt>data:asText</tt> was explicitly selected, does not
attempt to return a value for the data, just <tt>isEncodingProblem</tt> for
b1.</t>
</li>
<li><t>G3: since Since only <tt>data:asBase64</tt> was requested, there is no
encoding
problem problem, and both values are returned.</t>
</li>
<li><t>G4: since Since the requested range could be satisfied as text, both blobs
are returned as <tt>data:asText</tt> <tt>data:asText</tt>, and there is no encoding problem.</t>
</li>
<li><t>G5: both Both blobs cannot satisfy the requested range, so isTruncated is
true for both.</t>
</li>
</ul>
<t>Note: some
<aside><t>Note: Some values have been wrapped for line length - there length. There would be
no whitespace wrapping in the <tt>data:asBase64</tt> values on the wire</t>

<artwork>Method calls: wire.</t></aside>

<t>Method Calls:</t>

<sourcecode type="json"><![CDATA[[
  [
  [
    &quot;Blob/upload&quot;,
    "Blob/upload",
    {
      &quot;create&quot;:
      "create": {
        &quot;b1&quot;:
        "b1": {
          &quot;data&quot;:
          "data": [
            {
              &quot;data:asBase64&quot;: &quot;VGhlIHF1aWNrIGJyb3duIGZveCBqdW1wZW
                                Qgb3ZlciB0aGUggYEgZG9nLg==&quot;
              "data:asBase64": "VGhlIHF1aWNrIGJyb3duIGZveCBqdW1wZW
                                Qgb3ZlciB0aGUggYEgZG9nLg=="
            }
          ]
        },
        &quot;b2&quot;:
        "b2": {
          &quot;data&quot;:
          "data": [
            {
              &quot;data:asText&quot;: &quot;hello world&quot;
              "data:asText": "hello world"
            }
          ],
          &quot;type&quot;
          "type" : &quot;text/plain&quot; "text/plain"
        }
      }
    },
    &quot;S1&quot;
    "S1"
  ],
  [
    &quot;Blob/get&quot;,
    "Blob/get",
    {
      &quot;ids&quot;:
      "ids": [
        &quot;#b1&quot;,
        &quot;#b2&quot;
        "#b1",
        "#b2"
      ]
    },
    &quot;G1&quot;
    "G1"
  ],
  [
    &quot;Blob/get&quot;,
    "Blob/get",
    {
      &quot;ids&quot;:
      "ids": [
        &quot;#b1&quot;,
        &quot;#b2&quot;
        "#b1",
        "#b2"
      ],
      &quot;properties&quot;:
      "properties": [
        &quot;data:asText&quot;,
        &quot;size&quot;
        "data:asText",
        "size"
      ]
    },
    &quot;G2&quot;
    "G2"
  ],
  [
    &quot;Blob/get&quot;,
    "Blob/get",
    {
      &quot;ids&quot;:
      "ids": [
        &quot;#b1&quot;,
        &quot;#b2&quot;
        "#b1",
        "#b2"
      ],
      &quot;properties&quot;:
      "properties": [
        &quot;data:asBase64&quot;,
        &quot;size&quot;
        "data:asBase64",
        "size"
      ]
    },
    &quot;G3&quot;
    "G3"
  ],
  [
    &quot;Blob/get&quot;,
    "Blob/get",
    {
      &quot;offset&quot;:
      "offset": 0,
      &quot;length&quot;:
      "length": 5,
      &quot;ids&quot;:
      "ids": [
        &quot;#b1&quot;,
        &quot;#b2&quot;
        "#b1",
        "#b2"
      ]
    },
    &quot;G4&quot;
    "G4"
  ],
  [
    &quot;Blob/get&quot;,
    "Blob/get",
    {
      &quot;offset&quot;:
      "offset": 20,
      &quot;length&quot;:
      "length": 100,
      &quot;ids&quot;:
      "ids": [
        &quot;#b1&quot;,
        &quot;#b2&quot;
        "#b1",
        "#b2"
      ]
    },
    &quot;G5&quot;
  ]
    "G5"
  ]

Responses:
]]]></sourcecode>

<t>Responses:</t>

<sourcecode type="json"><![CDATA[[
  [
  [
    &quot;Blob/upload&quot;,
    "Blob/upload",
    {
      &quot;oldState&quot;:
      "oldState": null,
      &quot;created&quot;:
      "created": {
        &quot;b2&quot;:
        "b2": {
          &quot;id&quot;: &quot;G2aae6c35c94fcfb415dbe95f408b9ce91ee846ed&quot;,
          &quot;size&quot;:
          "id": "G2aae6c35c94fcfb415dbe95f408b9ce91ee846ed",
          "size": 11,
          &quot;type&quot;: &quot;application/octet-stream&quot;
          "type": "application/octet-stream"
        },
        &quot;b1&quot;:
        "b1": {
          &quot;id&quot;: &quot;G72cfa4804194563685d9a4b695f7ba20e7739576&quot;,
          &quot;size&quot;:
          "id": "G72cfa4804194563685d9a4b695f7ba20e7739576",
          "size": 43,
          &quot;type&quot;: &quot;text/plain&quot;
          "type": "text/plain"
        }
      },
      &quot;updated&quot;:
      "updated": null,
      &quot;destroyed&quot;:
      "destroyed": null,
      &quot;notCreated&quot;:
      "notCreated": null,
      &quot;notUpdated&quot;:
      "notUpdated": null,
      &quot;notDestroyed&quot;:
      "notDestroyed": null,
      &quot;accountId&quot;: &quot;account1&quot;
      "accountId": "account1"
    },
    &quot;S1&quot;
    "S1"
  ],
  [
    &quot;Blob/get&quot;,
    "Blob/get",
    {
      &quot;list&quot;:
      "list": [
        {
          &quot;id&quot;: &quot;G72cfa4804194563685d9a4b695f7ba20e7739576&quot;,
          &quot;isEncodingProblem&quot;:
          "id": "G72cfa4804194563685d9a4b695f7ba20e7739576",
          "isEncodingProblem": true,
          &quot;data:asBase64&quot;: &quot;VGhlIHF1aWNrIGJyb3duIGZveCBqdW1wZW
                            Qgb3ZlciB0aGUggYEgZG9nLg==&quot;,
          &quot;size&quot;:
          "data:asBase64": "VGhlIHF1aWNrIGJyb3duIGZveCBqdW1wZW
                            Qgb3ZlciB0aGUggYEgZG9nLg==",
          "size": 43
        },
        {
          &quot;id&quot;: &quot;G2aae6c35c94fcfb415dbe95f408b9ce91ee846ed&quot;,
          &quot;data:asText&quot;: &quot;hello world&quot;,
          &quot;size&quot;:
          "id": "G2aae6c35c94fcfb415dbe95f408b9ce91ee846ed",
          "data:asText": "hello world",
          "size": 11
        }
      ],
      &quot;notFound&quot;:
      "notFound": [],
      &quot;accountId&quot;: &quot;account1&quot;
      "accountId": "account1"
    },
    &quot;G1&quot;
    "G1"
  ],
  [
    &quot;Blob/get&quot;,
    "Blob/get",
    {
      &quot;list&quot;:
      "list": [
        {
          &quot;id&quot;: &quot;G72cfa4804194563685d9a4b695f7ba20e7739576&quot;,
          &quot;isEncodingProblem&quot;:
          "id": "G72cfa4804194563685d9a4b695f7ba20e7739576",
          "isEncodingProblem": true,
          &quot;size&quot;:
          "size": 43
        },
        {
          &quot;id&quot;: &quot;G2aae6c35c94fcfb415dbe95f408b9ce91ee846ed&quot;,
          &quot;data:asText&quot;: &quot;hello world&quot;,
          &quot;size&quot;:
          "id": "G2aae6c35c94fcfb415dbe95f408b9ce91ee846ed",
          "data:asText": "hello world",
          "size": 11
        }
      ],
      &quot;notFound&quot;:
      "notFound": [],
      &quot;accountId&quot;: &quot;account1&quot;
      "accountId": "account1"
    },
    &quot;G2&quot;
    "G2"
  ],
  [
    &quot;Blob/get&quot;,
    "Blob/get",
    {
      &quot;list&quot;:
      "list": [
        {
          &quot;id&quot;: &quot;G72cfa4804194563685d9a4b695f7ba20e7739576&quot;,
          &quot;data:asBase64&quot;: &quot;VGhlIHF1aWNrIGJyb3duIGZveCBqdW1wZW
                            Qgb3ZlciB0aGUggYEgZG9nLg==&quot;,
          &quot;size&quot;:
          "id": "G72cfa4804194563685d9a4b695f7ba20e7739576",
          "data:asBase64": "VGhlIHF1aWNrIGJyb3duIGZveCBqdW1wZW
                            Qgb3ZlciB0aGUggYEgZG9nLg==",
          "size": 43
        },
        {
          &quot;id&quot;: &quot;G2aae6c35c94fcfb415dbe95f408b9ce91ee846ed&quot;,
          &quot;data:asBase64&quot;: &quot;aGVsbG8gd29ybGQ=&quot;,
          &quot;size&quot;:
          "id": "G2aae6c35c94fcfb415dbe95f408b9ce91ee846ed",
          "data:asBase64": "aGVsbG8gd29ybGQ=",
          "size": 11
        }
      ],
      &quot;notFound&quot;:
      "notFound": [],
      &quot;accountId&quot;: &quot;account1&quot;
      "accountId": "account1"
    },
    &quot;G3&quot;
    "G3"
  ],
  [
    &quot;Blob/get&quot;,
    "Blob/get",
    {
      &quot;list&quot;:
      "list": [
        {
          &quot;id&quot;: &quot;G72cfa4804194563685d9a4b695f7ba20e7739576&quot;,
          &quot;data:asText&quot;: &quot;The q&quot;,
          &quot;size&quot;:
          "id": "G72cfa4804194563685d9a4b695f7ba20e7739576",
          "data:asText": "The q",
          "size": 43
        },
        {
          &quot;id&quot;: &quot;G2aae6c35c94fcfb415dbe95f408b9ce91ee846ed&quot;,
          &quot;data:asText&quot;: &quot;hello&quot;,
          &quot;size&quot;:
          "id": "G2aae6c35c94fcfb415dbe95f408b9ce91ee846ed",
          "data:asText": "hello",
          "size": 11
        }
      ],
      &quot;notFound&quot;:
      "notFound": [],
      &quot;accountId&quot;: &quot;account1&quot;
      "accountId": "account1"
    },
    &quot;G4&quot;
    "G4"
  ],
  [
    &quot;Blob/get&quot;,
    "Blob/get",
    {
      &quot;list&quot;:
      "list": [
        {
          &quot;id&quot;: &quot;G72cfa4804194563685d9a4b695f7ba20e7739576&quot;,
          &quot;isTruncated&quot;:
          "id": "G72cfa4804194563685d9a4b695f7ba20e7739576",
          "isTruncated": true,
          &quot;isEncodingProblem&quot;:
          "isEncodingProblem": true,
          &quot;data:asBase64&quot;: &quot;anVtcGVkIG92ZXIgdGhlIIGBIGRvZy4=&quot;,
          &quot;size&quot;:
          "data:asBase64": "anVtcGVkIG92ZXIgdGhlIIGBIGRvZy4=",
          "size": 43
        },
        {
          &quot;id&quot;: &quot;G2aae6c35c94fcfb415dbe95f408b9ce91ee846ed&quot;,
          &quot;isTruncated&quot;:
          "id": "G2aae6c35c94fcfb415dbe95f408b9ce91ee846ed",
          "isTruncated": true,
          &quot;data:asText&quot;: &quot;&quot;,
          &quot;size&quot;:
          "data:asText": "",
          "size": 11
        }
      ],
      &quot;notFound&quot;:
      "notFound": [],
      &quot;accountId&quot;: &quot;account1&quot;
      "accountId": "account1"
    },
    &quot;G5&quot;
  ]
    "G5"
  ]
</artwork>
]]]></sourcecode>

</section>
</section>

<section anchor="blob-lookup"><name>Blob/lookup</name>

<t>Given a list of blobIds, this method does a reverse lookup in each of
the provided type names to find the list of Ids within that data type
which
that reference the provided blob.</t>
<t>Since different datatypes will have different semantics of &quot;contains&quot;, "contains",
the definition of reference "reference" is somewhat loosely defined, loose but roughly
means &quot;you "you could discover this blobId by looking at this object or
at other objects recursively contained within this object&quot;.</t> object".</t>
<t>For example example, with an [RFC8621] server, a server that supports <xref target="RFC8621"
format="default"/>, if checking whether a Mailbox references a blob, then blob and if any Emails
within that Mailbox reference the blobId, then the Mailbox references that
blobId.  For any Thread
which that references an Email that references a blobId, it
can be said that the Thread references the blobId.</t>
<t>But
<t>However, this does not mean that if an Email references a Mailbox in its
mailboxIds property, then any blobId referenced by other Emails in
that Mailbox are also referenced by the initial Email.</t>
<t><strong>Parameters</strong></t>

<ul>
<li><t>accountId: <tt>Id</tt></t> "Id"</t>
<t>The id of the account used for the call.</t>
</li>
<li><t>typeNames: <tt>String[]</tt></t> "String[]"</t>
<t>A list of names from the &quot;JMAP "JMAP Data Types&quot; registry, Types" registry or defined by
private extensions which that the client has requested.  Only names
for which &quot;Can "Can reference blobs&quot; blobs" is true may be specified, and the
capability which that defines each type must also be used by the overall
JMAP request in which this method is called.</t>
<t>If a type name is not known by the server, or the associated capability
has not been requested, then the server returns an &quot;unknownDataType&quot; "unknownDataType"
error.</t>
</li>
<li><t>ids: <tt>Id[]</tt></t> "Id[]"</t>
<t>A list of blobId values to be looked for.</t>
</li>
</ul>
<t><strong>Response</strong></t>

<ul>
<li><t>list: <tt>BlobInfo[]</tt></t> "BlobInfo[]"</t>
<t>A list of BlobInfo objects.</t>
</li>
</ul>
<t><strong>BlobInfo Object</strong></t>

<ul>
<li><t>id: <tt>Id</tt></t> "Id"</t>
<t>The Blob Identifier.</t> blobId.</t>
</li>
<li><t>matchedIds: <tt>String[Id[]]</tt></t> "String[Id[]]"</t>
<t>A map from type name to a list of Ids of that data type (e.g. (e.g., the name
&quot;Email&quot;
"Email" maps to a list of emailIds)</t> emailIds).</t>
</li>
</ul>
<t>If a blob is not visible to a user, user or does not exist on the server at all,
then the server MUST <bcp14>MUST</bcp14> still return an empty array for each type
as this doesn't leak any information about whether the blob is on the server
but not visible to the requesting user.</t>

<section anchor="blob-lookup-example"><name>Blob/lookup example</name>

<artwork>Method call:

[
  &quot;Blob/lookup&quot;, Example</name>

<t>Method Call:</t>

<sourcecode type="json"><![CDATA[[
  "Blob/lookup",
  {
    &quot;typeNames&quot;:
    "typeNames": [
      &quot;Mailbox&quot;,
      &quot;Thread&quot;,
      &quot;Email&quot;
      "Mailbox",
      "Thread",
      "Email"
    ],
    &quot;ids&quot;:
    "ids": [
      &quot;Gd2f81008cf07d2425418f7f02a3ca63a8bc82003&quot;,
      &quot;not-a-blob&quot;
      "Gd2f81008cf07d2425418f7f02a3ca63a8bc82003",
      "not-a-blob"
    ]
  },
  &quot;R1&quot;
]

Response:

[
  &quot;Blob/lookup&quot;,
  "R1"
]]]></sourcecode>

<t>Response:</t>

<sourcecode type="json"><![CDATA[[
  "Blob/lookup",
  {
    &quot;list&quot;:
    "list": [
      {
        &quot;id&quot;: &quot;Gd2f81008cf07d2425418f7f02a3ca63a8bc82003&quot;,
        &quot;matchedIds&quot;:
        "id": "Gd2f81008cf07d2425418f7f02a3ca63a8bc82003",
        "matchedIds": {
          &quot;Mailbox&quot;:
          "Mailbox": [
            &quot;M54e97373&quot;,
            &quot;Mcbe6b662&quot;
            "M54e97373",
            "Mcbe6b662"
          ],
          &quot;Thread&quot;:
          "Thread": [
            &quot;T1530616e&quot;
            "T1530616e"
          ],
          &quot;Email&quot;:
          "Email": [
            &quot;E16e70a73eb4&quot;,
            &quot;E84b0930cf16&quot;
            "E16e70a73eb4",
            "E84b0930cf16"
          ]
        }
      }
    ],
    &quot;notFound&quot;:
    "notFound": [
      &quot;not-a-blob&quot;
      "not-a-blob"
    ]
  },
  &quot;R1&quot;
]
</artwork>
  "R1"
]]]></sourcecode>

</section>
</section>
</section>

<section anchor="security-considerations"><name>Security considerations</name> Considerations</name>
<t>All security considerations of for JMAP <xref target="RFC8620"></xref> apply to this specification.
Additional considerations specific to the data types and functionality
introduced by this document are described here.</t>
<t>JSON parsers are not all consistent in handling non-UTF-8 data.
JMAP requires that all JSON data be UTF-8 encoded, so servers MUST
<bcp14>MUST</bcp14> only return a null value if <tt>data:asText</tt> is
requested for a range of octets which that is not valid UTF-8, UTF-8 and set
<tt>isEncodingProblem: true</tt>.</t>
<t>Servers MUST <bcp14>MUST</bcp14> apply any access controls, such that if the authenticated user would
be unable to discover the blobId by making queries, then this fact can not cannot be
discovered via a Blob/lookup.  For example, if an Email exists in a Mailbox which that
the authenticated user does not have access to see, then that emailId MUST NOT <bcp14>MUST NOT</bcp14> be
returned in a lookup for a blob which that is referenced by that email.</t>
<t>The server MUST NOT <bcp14>MUST NOT</bcp14> trust that the data given to a
Blob/upload is a well formed well-formed instance of the specified media type, and type. Also, if
the server attempts to parse the given blob, only hardened parsers designed to
deal with arbitrary untrusted data should be used.  The server SHOULD NOT <bcp14>SHOULD
NOT</bcp14> reject data on the grounds that it is not a valid specimen of the
stated type.</t>
<t>Blob/upload with
<t>With carefully chosen data sources sources, Blob/upload can be used to recreate
dangerous content on the far side of security scanners (anti-virus or
exfiltration scanners scanners, for example) which that may be watching the upload endpoint.
Server implementations
SHOULD <bcp14>SHOULD</bcp14> provide a hook to allow security
scanners to check the resulting blob after concatenating the data sources in
the same way that they do for the upload endpoint.</t>
<t>Digest algorithms can be expensive for servers to calculate.  Servers which that
share resources between multiple users should track resource usage by clients, clients
and rate-limit expensive operations to avoid resource starvation.</t>
</section>

<section anchor="iana-considerations"><name>IANA considerations</name> Considerations</name>

<section anchor="jmap-capability-registration-for-blob"><name>JMAP Capability registration Registration for &quot;blob&quot;</name> "blob"</name>
<t>IANA is requested to register has registered the &quot;blob&quot; "blob" JMAP Capability capability as follows:</t>
<t>Capability Name: urn:ietf:params:jmap:blob</t>
<t>Specification document: this document</t>
<t>Intended use: common</t>
<t>Change Controller: IETF</t>
<t>Security

<dl newline="false" spacing="compact">
  <dt>Capability Name:</dt> <dd>urn:ietf:params:jmap:blob</dd>
  <dt>Specification document:</dt> <dd>RFC 9404</dd>
  <dt>Intended use:</dt> <dd>common</dd>
  <dt>Change Controller:</dt> <dd>IETF</dd>
  <dt>Security and privacy considerations: this document, Section XXX</t> considerations:</dt> <dd>RFC 9404, <xref
  target="security-considerations" format="default"/></dd>
</dl>

</section>

<section anchor="jmap-error-codes-registration-for-unknowndatatype"><name>JMAP Error Codes Registration for &quot;unknownDataType&quot;</name> "unknownDataType"</name>
<t>IANA is requested to register has registered the &quot;unknownDataType&quot; "unknownDataType" JMAP Error Code error code as follows:</t>
<t>JMAP

<dl newline="false" spacing="compact">
  <dt>JMAP Error Code: unknownDataType</t>
<t>Intended use: common</t>
<t>Change Controller: IETF</t>
<t>Reference: this document</t>
<t>Description: The Code:</dt> <dd>unknownDataType</dd>
  <dt>Intended use:</dt> <dd>common</dd>
  <dt>Change Controller:</dt> <dd>IETF</dd>
  <dt>Reference:</dt> <dd>RFC 9404</dd>
  <dt>Description:</dt> <dd>The server does not recognise this data type, or
  the capability to enable it was is not present.</t> present in the current Request
  Object.</dd>
</dl>
</section>

<section anchor="creation-of-jmap-data-types-registry"><name>Creation of &quot;JMAP "JMAP Data Types&quot; Types" Registry</name>
<t>IANA is requested to create has created a new registry &quot;JMAP called "JMAP Data Types&quot; with Types".  <xref
target="ianatable" format="default"/> shows the initial content:</t>
<table> contents of this
new registry.</t>
<table anchor="ianatable">
<thead>
<tr>
<th>Type Name</th>
<th>Can reference blobs</th> Ref Blobs</th>
<th>Can use Use for state change</th> State Change</th>
<th>Capability</th>
<th>Reference</th>
</tr>
</thead>

<tbody>
<tr>
<td>Core</td>
<td>No</td>
<td>No</td>
<td>urn:ietf:params:jmap:core</td>
<td><xref target="RFC8620"></xref></td>
</tr>

<tr>
<td>PushSubscription</td>
<td>No</td>
<td>No</td>
<td>urn:ietf:params:jmap:core</td>
<td><xref target="RFC8620"></xref></td>
</tr>

<tr>
<td>Mailbox</td>
<td>Yes</td>
<td>Yes</td>
<td>urn:ietf:params:jmap:mail</td>
<td><xref target="RFC8621"></xref></td>
</tr>

<tr>
<td>Thread</td>
<td>Yes</td>
<td>Yes</td>
<td>urn:ietf:params:jmap:mail</td>
<td><xref target="RFC8621"></xref></td>
</tr>

<tr>
<td>Email</td>
<td>Yes</td>
<td>Yes</td>
<td>urn:ietf:params:jmap:mail</td>
<td><xref target="RFC8621"></xref></td>
</tr>

<tr>
<td>EmailDelivery</td>
<td>No</td>
<td>Yes</td>
<td>urn:ietf:params:jmap:mail</td>
<td><xref target="RFC8621"></xref></td>
</tr>

<tr>
<td>SearchSnippet</td>
<td>No</td>
<td>No</td>
<td>urn:ietf:params:jmap:mail</td>
<td><xref target="RFC8621"></xref></td>
</tr>

<tr>
<td>Identity</td>
<td>No</td>
<td>Yes</td>
<td>urn:ietf:params:jmap:submission</td>
<td>urn:ietf:params:jmap:&zwsp;submission</td>
<td><xref target="RFC8621"></xref></td>
</tr>

<tr>
<td>EmailSubmission</td>
<td>No</td>
<td>Yes</td>
<td>urn:ietf:params:jmap:submission</td>
<td>urn:ietf:params:jmap:&zwsp;submission</td>
<td><xref target="RFC8621"></xref></td>
</tr>

<tr>
<td>VacationResponse</td>
<td>No</td>
<td>Yes</td>
<td>urn:ietf:params:jmap:vacationresponse</td>
<td>urn:ietf:params:jmap:&zwsp;vacationresponse</td>
<td><xref target="RFC8621"></xref></td>
</tr>

<tr>
<td>MDN</td>
<td>No</td>
<td>No</td>
<td>urn:ietf:params:jmap:mdn</td>
<td>[RFC9007]</td>
<td><xref target="RFC9007"></xref></td>
</tr>
</tbody>
</table><t>This
</table>

<t>The registration policy for this registry is &quot;Specification required&quot;, either "Specification Required" <xref target="RFC8126"></xref>. Either an RFC or a similarly stable reference document which defines a JMAP Data Type
and associated capability.</t>
<t>IANA is asked to will appoint designated experts to review requests for additions to this
registry, with guidance to allow any registration which that provides a stable document describing
the capability, capability and control over the URI namespace where to which the capability URI points.</t>
</section>
</section>

<section anchor="changes"><name>Changes</name>
<t>EDITOR: please remove this section before publication.</t>
<t>The source of this document exists on github at: <eref target="https://github.com/brong/draft-gondwana-jmap-blob/">https://github.com/brong/draft-gondwana-jmap-blob/</eref></t>
<t><strong>draft-ietf-jmap-blob-18</strong></t>

<ul spacing="compact">
<li>add security considerations for Digest algorithm performance (was supposed
to be in -13 but I had a commit that never got pushed)</li>
<li><t>artart review:</t>

<ul spacing="compact">
<li>clarify that created blobs behave identically to RFC8620 section 6 binary
objects.</li>
<li>clearer text about &quot;references a blob&quot;</li>
<li>remove contractions</li>
</ul></li>
<li><t>Roman Danyliw DISCUSS</t>

<ul spacing="compact">
<li>corrected example text - missing comma and extra data:asBase64.</li>
<li>simplify Blob/lookup to not have multiple ways of saying &quot;not found&quot;
for a blob and then need a security considerations around it.</li>
<li>said that clients SHOULD prefer algorithms earlier in the list.</li>
<li>clarified that supportedTypeNames could include private extensions.</li>
<li>editorial/spelling fixes</li>
</ul></li>
<li><t>genart review</t>

<ul spacing="compact">
<li>editorial/spelling fixes</li>
</ul></li>
<li><t>Robert Winton review</t>

<ul spacing="compact">
<li>added a suggestion to use the regular upload mechanism for blobs over a
megabyte in size.</li>
</ul></li>
</ul>
<t><strong>draft-ietf-jmap-blob-17</strong></t>

<ul spacing="compact">
<li>AD review, one more wording nit</li>
</ul>
<t><strong>draft-ietf-jmap-blob-16</strong></t>

<ul spacing="compact">
<li>secdir last-call review changes - nit fixes and security considerations</li>
</ul>
<t><strong>draft-ietf-jmap-blob-15</strong></t>

<ul spacing="compact">
<li>changed capabilities object to MUST contain all specified keys, to align
with all other published JMAP extensions.</li>
</ul>
<t><strong>draft-ietf-jmap-blob-14</strong></t>

<ul spacing="compact">
<li>AD review - fixed MUST usage</li>
<li>AD review - added instructions regarding expert review for IANA</li>
</ul>
<t><strong>draft-ietf-jmap-blob-13</strong></t>

<ul spacing="compact">
<li>added examples of digest responses</li>
</ul>
<t><strong>draft-ietf-jmap-blob-12</strong></t>

<ul spacing="compact">
<li><t>updates based on Neil Jenkins' feedback:</t>

<ul spacing="compact">
<li>fixed [] positions for type specs</li>
<li>documented delta between /upload and /set better</li>
<li>allowed zero-length blobId sources</li>
<li>fixed examples with /set leftovers</li>
<li>documented datatypes registry policy</li>
</ul></li>
<li>added optional &quot;digest&quot; support</li>
</ul>
<t><strong>draft-ietf-jmap-blob-11</strong>:</t>

<ul spacing="compact">
<li><t>updates based on IETF113 feedback:</t>

<ul spacing="compact">
<li>added wording to suggest the a Blob/get of just size might be faster</li>
<li>added an example with just the size field being selected</li>
</ul></li>
</ul>
<t><strong>draft-ietf-jmap-blob-10</strong>:</t>

<ul spacing="compact">
<li>removed remaining references to <tt>catenate</tt>.</li>
</ul>
<t><strong>draft-ietf-jmap-blob-09</strong>:</t>

<ul spacing="compact">
<li>tidied up introduction text</li>
<li>replaced Blob/set with Blob/upload</li>
<li>made all upload creates take an array of sources to normalise behaviour at the cost of a slightly more
complex default case.</li>
</ul>
<t><strong>draft-ietf-jmap-blob-08</strong>:</t>

<ul spacing="compact">
<li>Fixed spelling of Neil's name in acknowledgements</li>
<li><t>Last call review (thanks Jim Fenton)</t>

<ul spacing="compact">
<li>fixed mmark sillyness causing RFC8620 to be non-normative in the references</li>
<li>clarified the capability object and accountCapability object requirements</li>
<li>made capability keys much more tightly defined, with mandatory minimum
catenate limit and default values.</li>
<li>increased use of normative language generally</li>
<li>lowercased 'blob' anywhere it wasn't explicitly the object</li>
<li>lowercased titles of the columns in the registry</li>
</ul></li>
</ul>
<t><strong>draft-ietf-jmap-blob-07</strong>:</t>

<ul spacing="compact">
<li>more examples to cover the interactions of offset, length and encoding checks.</li>
</ul>
<t><strong>draft-ietf-jmap-blob-06</strong>:</t>

<ul spacing="compact">
<li>removed asHex - we only need base64 and text</li>
<li>added reference to where base64 is defined</li>
<li>made 'destroy' not be allowed</li>
<li>expanded JSON examples for readability</li>
<li>removed 'expires' from examples</li>
</ul>
<t><strong>draft-ietf-jmap-blob-05</strong>:</t>

<ul spacing="compact">
<li>discovered I hadn't actually included <tt>typeNames</tt> and <tt>matchedIds</tt> anywhere except the
updates section, oops!</li>
<li>added a catenate example</li>
<li>tightened up some text</li>
</ul>
<t><strong>draft-ieft-jmap-blob-04</strong>:</t>

<ul spacing="compact">
<li>added security considerations for scanning <tt>catenate</tt> results</li>
</ul>
<t><strong>draft-ieft-jmap-blob-03</strong>:</t>

<ul spacing="compact">
<li>added capabilities object</li>
<li>renamed types to typeNames and matchedIds</li>
<li>added details of how to handle non-UTF8 data and truncation in Blob/get</li>
<li>added isTruncated and isEncodingProblem to Blob/get to tell the client
if the request wasn't entirely satisfied.</li>
</ul>
<t><strong>draft-ieft-jmap-blob-02</strong>:</t>

<ul spacing="compact">
<li>fixed incorrect RFC number in reference and HTTP PUT -&gt; POST, thanks Ken.</li>
<li>added acknowledgements section</li>
<li>removed all 'datatype' text and changed to 'data type' or 'type name' as
appropriate (issue #1 proposal)</li>
<li>expanded security considerations section and moved optional Blob/lookup
empty case into Blob/lookup section</li>
</ul>
<t><strong>draft-ieft-jmap-blob-01</strong>:</t>

<ul spacing="compact">
<li>renamed 'datatypes' to 'types' to align with PushSubscription from RFC8620.</li>
<li>added example for Blob/get</li>
<li>specified offset and length precisely</li>
</ul>
<t><strong>draft-ieft-jmap-blob-00</strong>:</t>

<ul spacing="compact">
<li>initial adoption as an IETF document, otherwise identical to draft-gondwana-jmap-blob-02</li>
</ul>
<t><strong>draft-gondwana-jmap-blob-02</strong></t>

<ul spacing="compact">
<li>renamed 'objects' to 'datatypes'</li>
<li>specified Blob/lookup</li>
<li>added IANA registry for datatypes</li>
</ul>
<t><strong>draft-gondwana-jmap-blob-01</strong></t>

<ul spacing="compact">
<li>added an example</li>
</ul>
<t><strong>draft-gondwana-jmap-blob-00</strong></t>

<ul spacing="compact">
<li>initial proposal</li>
</ul>
</section>

<section anchor="acknowledgements"><name>Acknowledgements</name>
<t>Joris Baum, Jim Fenton, Neil Jenkins, Alexey Melnikov, Ken Murchison, Robert Stepanek and
the JMAP working group at the IETF.</t>
</section>

</middle>

<back>
<references><name>References</name>
<references><name>Normative References</name>
<xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.2119.xml"/>
<xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.3230.xml"/>
<xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.4648.xml"/>
<xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.8174.xml"/>
<xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.8620.xml"/>
</references>
<references><name>Informative References</name>
<xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.7888.xml"/>
<xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.8621.xml"/>
<xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.9007.xml"/>
<xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.8126.xml"/>
</references>
</references>

<section anchor="acknowledgements" numbered="false" toc="default">
<name>Acknowledgements</name>
<t><contact fullname="Joris Baum"/>, <contact fullname="Jim Fenton"/>, <contact fullname="Neil Jenkins"/>, <contact fullname="Alexey Melnikov"/>, <contact fullname="Ken Murchison"/>, <contact fullname="Robert Stepanek"/>, and
the JMAP Working Group in the IETF.</t>
</section>

</back>

</rfc>