How updates work in ActivityPub / Mastodon

I didn't realise this, so I'm documenting it to stop other people making the same silly mistake that I did.

Messages in ActivityPub have two distinct ID strings. Here's a (truncated) view of what happens when I send a new message on Mastodon:

 JSON  "id": "https://mastodon.social/users/Edent/statuses/1234567890/activity",

  "type": "Create",

  "actor": "https://mastodon.social/users/Edent",

  "published": "2024-03-10T16:13:49Z",

  "object": {

    "id": "https://mastodon.social/users/Edent/statuses/1234567890",

    "type": "Note",

    "content": "Hello"

...

The "Note" has some human-readable content, some metadata, and an ID - in this case a URl ending with 1234567890

But that Note is wrapped in an Activity. In this case, it is a "Create" message, with some metadata, and it's own ID - in this case ending 1234567890/activity

What happens if I edit the post? Here's a truncated view of what the server sends:

 JSON  "id": "https://mastodon.social/users/Edent/statuses/1234567890#updates/1710087334",

  "type": "Update",

  "actor": "https://mastodon.social/users/Edent",

  "published": "2024-03-10T16:15:34Z",

  "object": {

    "id": "https://mastodon.social/users/Edent/statuses/1234567890",

    "type": "Note",

    "content": "I meant Goodbye!"

...

The "Note" has the same ID as before - but the activity has a different ID.

Further updates follow the same pattern:

 JSON  "id": "https://mastodon.social/users/Edent/statuses/1234567890#updates/1984651324",

  "type": "Update",

  "object": {

    "id": "https://mastodon.social/users/Edent/statuses/1234567890",

...

So what happens when I Delete a previously updated post?

Here's what's sent:

 JSON  "id": "https://mastodon.social/users/Edent/statuses/1234567890#delete",

  "type": "Delete",

  "actor": "https://mastodon.social/users/Edent",

  "object": {

    "id": "https://mastodon.social/users/Edent/statuses/1234567890",

    "type": "Tombstone",

...

Again, the Activity has its own, unique, ID. But it is the original ID of the Note which is to be deleted!

The spec says that all IDs must be URls - but it doesn't say what format they should be in. Mastodon helpfully makes the Activity's ID somewhat related to the object's ID - but not all software will do that.

So, if you're doing something like saving messages to disk or a database, use the object ID as the canonical reference. The ID of the Activity isn't particularly important when it comes to receiving updates, deletes, replies, or anything else.