How updates work in ActivityPub / Mastodon

I didn't realise this, so I'm documenting it to stop other people making the same silly mistake that I did.

Messages in ActivityPub have two distinct ID strings. Here's a (truncated) view of what happens when I send a new message on Mastodon:

 JSON  "id": "https://mastodon.social/users/Edent/statuses/1234567890/activity",
  "type": "Create",
  "actor": "https://mastodon.social/users/Edent",
  "published": "2024-03-10T16:13:49Z",
  "object": {
    "id": "https://mastodon.social/users/Edent/statuses/1234567890",
    "type": "Note",
    "content": "Hello"
...

The "Note" has some human-readable content, some metadata, and an ID - in this case a URl ending with 1234567890

But that Note is wrapped in an Activity. In this case, it is a "Create" message, with some metadata, and it's own ID - in this case ending 1234567890/activity

What happens if I edit the post? Here's a truncated view of what the server sends:

 JSON  "id": "https://mastodon.social/users/Edent/statuses/1234567890#updates/1710087334",
  "type": "Update",
  "actor": "https://mastodon.social/users/Edent",
  "published": "2024-03-10T16:15:34Z",
  "object": {
    "id": "https://mastodon.social/users/Edent/statuses/1234567890",
    "type": "Note",
    "content": "I meant Goodbye!"
...

The "Note" has the same ID as before - but the activity has a different ID.

Further updates follow the same pattern:

 JSON  "id": "https://mastodon.social/users/Edent/statuses/1234567890#updates/1984651324",
  "type": "Update",
  "object": {
    "id": "https://mastodon.social/users/Edent/statuses/1234567890",
...

So what happens when I Delete a previously updated post?

Here's what's sent:

 JSON  "id": "https://mastodon.social/users/Edent/statuses/1234567890#delete",
  "type": "Delete",
  "actor": "https://mastodon.social/users/Edent",
  "object": {
    "id": "https://mastodon.social/users/Edent/statuses/1234567890",
    "type": "Tombstone",
...

Again, the Activity has its own, unique, ID. But it is the original ID of the Note which is to be deleted!

The spec says that all IDs must be URls - but it doesn't say what format they should be in. Mastodon helpfully makes the Activity's ID somewhat related to the object's ID - but not all software will do that.

So, if you're doing something like saving messages to disk or a database, use the object ID as the canonical reference. The ID of the Activity isn't particularly important when it comes to receiving updates, deletes, replies, or anything else.