Should we allow PUT sequence collection capability?

[nsheff]

Should the /collection endpoint allow a PUT operation, as a way to add new collections to the database? I'm likely to implement this for my server, but is this outside the scope of the spec? This could be restricted to authorized users or something (require a bearer token).

The way I envision it, you would use http PUT , and the request body would be a 'level 2 representation':

{
  "lengths": [
    "1216",
    "970",
    "1788"
  ],
  "names": [
    "A",
    "B",
    "C"
  ],
  "sequences": [
    "76f9f3315fa4b831e93c36cd88196480",
    "d5171e863a3d8f832f0559235987b1e5",
    "b9b1baaa7abf206f6b70cf31654172db"
  ]
}

It would add this collection to the database and return the resulting primary digest.

[nsheff]

I think this is clearly not a REQUIRED part of the spec. Still, we could perhaps add this in as an OPTIONAL thing, to standardize a endpoint for adding new collections. Thoughts anyone?

[sveinugu]

@nsheff Makes sense to me. However, we should make sure that we do not restrict the standard to only work with a certain kind of authorization scheme (or if we do, some thought should at least go into such a choice).

[tcezard]

For me that seems completely outside of the scope of the specs. Even as an optional or suggested method.

• The specs is about retrievals of information not about provision.
• There are many models that people could use for their backend and it would be difficult for us to ensure that this method would provide enough information for all data models.
• It's time consuming to specify this type of endpoint and I think we should focus on the ones we are planning already.

[daviesrob]

Including PUT would introduce all sorts of security risks, e.g. someone abusing the service to store unrelated data. It would be better to gloss over the part about getting data in for now, and concentrate on getting it out.

[nsheff]

Including PUT would introduce all sorts of security risks, e.g. someone abusing the service to store unrelated data. It would be better to gloss over the part about getting data in for now, and concentrate on getting it out.

of course; I was imagining this endpoint would require authorization.

[nsheff]

Ok I think it's pretty clear that we should shelve this for now. I agree that it's not the focus.

I still think the way I described it above is logical, and the clear way to specify this, for servers that want to specify a data creation endpoint.