I'll be honest — I spent years writing PATCH endpoints that just took the whole object and merged it server-side. You probably have too. It works. Until it doesn't. You get concurrent edits. You get race conditions. You get a client that sends { "role": null } because it forgot to exclude the field. And your "partial update" is silently nuking data. Then I found RFC 6902 — JSON Patch . And it solved exactly this problem in a way I hadn't thought about. What JSON Patch actually is Instead of sending the new version of an object, you send a description of the changes . A list of operations: what to add, remove, replace, move.…