Inbox container

Each agent MUST host an inbox container that is an ldp:Container as defined by the Linked Data Platform. The inbox MUST contain the two log files defined in this specification:

• sharedWithMe.ttl
• sharedWithOthers.ttl

Servers SHOULD include ldp:contains statements in RDF representations of the inbox container.

The inbox location MUST be discoverable from the agent's profile document using the ldp:inbox predicate. If no ldp:inbox link is present, clients MUST assume the inbox is located at {webid-document}/inbox/, where {webid-document} is the agent WebID URI without a fragment identifier.

sharedWithMe.ttl

The sharedWithMe.ttl log records permissions granted to the inbox owner by other agents. The file MUST be an RDF document in Turtle syntax and MUST be served with media type text/turtle.

By default, sharedWithMe.ttl SHOULD allow public acl:Append access so that other agents (or servers acting on their behalf) can submit notifications. This behavior is STRONGLY RECOMMENDED to maximize interoperability. When an implementation allows public append, it MUST accept SPARQL Update PATCH requests with Content-Type: application/sparql-update. If public append is not desired, the inbox initialization process SHOULD explicitly grant acl:Append to the specific agents that are expected to send notifications. Implementations SHOULD reject updates that delete or replace existing notification entries, except for explicit log metadata nodes such as #lastAccess.

Each notification entry in sharedWithMe.ttl:

• MUST be typed as as:Offer.
• MUST include dct:creator identifying the agent who initiated the permission change.
• MUST include dct:created as an xsd:dateTime timestamp for when the change occurred.
• MUST include acl:accessTo identifying the affected resource.
• MUST include one or more acl:mode values describing the resulting access modes.
• SHOULD use an opaque fragment identifier unique within the log (for example, #NStqftOhhw).

The log SHOULD be append-only: if permissions change again, a new entry is appended rather than modifying existing entries. A log metadata node such as #lastAccess MAY be used to record the most recent update time for the file.

sharedWithOthers.ttl

The sharedWithOthers.ttl log records permissions changes that the inbox owner grants to other agents. The file MUST be an RDF document in Turtle syntax, MUST be served with media type text/turtle, and is maintained by the inbox owner or their server.

Each resource for which permissions have been changed SHOULD appear as a subject node typed as ldp:Container (for containers) or ldp:Resource (for non-containers). Each such subject node MUST include one or more as:Offer links to notification entries.

Each notification entry in sharedWithOthers.ttl:

• MUST include as:target identifying the agent whose permissions changed.
• MUST include acl:accessTo identifying the affected resource.
• MUST include one or more acl:mode values describing the resulting access modes.
• MUST include dct:created as an xsd:dateTime timestamp.
• MAY include dct:creator; if omitted, the inbox owner is implied.
• SHOULD use an opaque fragment identifier unique within the log (for example, #MGopUTnDU7).

For entries referenced from a resource subject, the acl:accessTo value SHOULD resolve to the same resource IRI as that subject.

The log SHOULD be append-only to preserve historical context. Implementations SHOULD reject updates that delete or replace existing notification entries.

Notification lifecycle

When permissions are changed for a resource, the system applying the change MUST create notification entries in both logs:

• A notification entry MUST be appended to the affected agent's sharedWithMe.ttl log.
• A corresponding entry MUST be appended to the granting agent's sharedWithOthers.ttl log, unless the granting agent and the affected agent are the same.

If permissions are updated multiple times, each change MUST result in a new entry. This specification defines grant and update notifications using as:Offer.

Revocation notifications

A permission revocation MUST be represented using ActivityStreams as:Undo. The revocation entry MUST be appended to the same log(s) as a grant/update notification and MUST include the following:

• MUST be typed as as:Undo.
• MUST include as:object identifying the prior as:Offer notification being revoked.
• MUST include acl:accessTo identifying the affected resource.
• MUST include one or more acl:mode values describing the access modes being revoked.
• MUST include dct:created as an xsd:dateTime timestamp.
• SHOULD include dct:creator identifying the agent who initiated the revocation.

In sharedWithOthers.ttl, revocation entries MUST also include as:target identifying the affected agent. Implementations SHOULD keep revocations append-only to preserve audit trails.

sharedWithMe.ttl Operations

            PATCH https://a-WebId-url.com/datastore/inbox/sharedWithMe.ttl HTTP/1.1
            Content-Type: application/sparql-update

            INSERT DATA {
              <#Fzxhxu0U9g> a <https://www.w3.org/ns/activitystreams#Offer>;
                  <http://purl.org/dc/terms/creator> <http://localhost:3000/test/profile/card#me>;
                  <http://purl.org/dc/terms/created> "2025-09-08T17:07:25.654Z"^^<http://www.w3.org/2001/XMLSchema#dateTime>;
                  <http://www.w3.org/ns/auth/acl#accessTo> <http://localhost:3000/test/container/>;
                  <http://www.w3.org/ns/auth/acl#mode> 
                    <http://www.w3.org/ns/auth/acl#Read>,
                    <http://www.w3.org/ns/auth/acl#Append>,
                    <http://www.w3.org/ns/auth/acl#Write>;.
            }
          

            PATCH https://a-WebId-url.com/datastore/inbox/sharedWithMe.ttl HTTP/1.1
            Content-Type: application/sparql-update

            INSERT DATA {
              <#UndoFzxhxu0U9g> a <https://www.w3.org/ns/activitystreams#Undo>;
                  <https://www.w3.org/ns/activitystreams#object> <#Fzxhxu0U9g>;
                  <http://purl.org/dc/terms/creator> <http://localhost:3000/test/profile/card#me>;
                  <http://purl.org/dc/terms/created> "2026-02-11T10:15:00Z"^^<http://www.w3.org/2001/XMLSchema#dateTime>;
                  <http://www.w3.org/ns/auth/acl#accessTo> <http://localhost:3000/test/container/>;
                  <http://www.w3.org/ns/auth/acl#mode> 
                    <http://www.w3.org/ns/auth/acl#Write>.
            }
          

sharedWithOthers.ttl Operations

            PATCH http://localhost:3000/test/inbox/sharedWithOthers.ttl HTTP/1.1
            Content-Type: application/sparql-update

            INSERT DATA {
              <#http://localhost:3000/test/container/> a <http://www.w3.org/ns/ldp#Container>;
                  <https://www.w3.org/ns/activitystreams#Offer> <#Fzxhxu0U9g>.
              <#Fzxhxu0U9g>
                  <https://www.w3.org/ns/activitystreams#target> <https://a-WebId-url.com/datastore/profile/card#me>;
                  <http://www.w3.org/ns/auth/acl#accessTo> <http://localhost:3000/test/container/>;
                  <http://www.w3.org/ns/auth/acl#mode>
                      <http://www.w3.org/ns/auth/acl#Read>,
                      <http://www.w3.org/ns/auth/acl#Append>,
                      <http://www.w3.org/ns/auth/acl#Write>;
                  <http://purl.org/dc/terms/created> "2025-09-08T16:18:38.002Z"^^<http://www.w3.org/2001/XMLSchema#dateTime>.
            }
          

            PATCH http://localhost:3000/test/inbox/sharedWithOthers.ttl HTTP/1.1
            Content-Type: application/sparql-update

            INSERT DATA {
              <#UndoFzxhxu0U9g> a <https://www.w3.org/ns/activitystreams#Undo>;
                  <https://www.w3.org/ns/activitystreams#object> <#Fzxhxu0U9g>;
                  <https://www.w3.org/ns/activitystreams#target> <https://a-WebId-url.com/datastore/profile/card#me>;
                  <http://purl.org/dc/terms/created> "2025-09-11T10:15:00Z"^^<http://www.w3.org/2001/XMLSchema#dateTime>;
                  <http://www.w3.org/ns/auth/acl#accessTo> <http://localhost:3000/test/container/>;
                  <http://www.w3.org/ns/auth/acl#mode> <http://www.w3.org/ns/auth/acl#Write>.
            }