Are multiple updates to the same record allowed on REST Composite API?

Question

I don't see anything in the docs for the PATCH /vXX.X/composite/sobjects REST API call prohibiting this, and indeed they imply that each object in the records array is processed independently, so it seems like it should work.

But a vendor who's using that endpoint to update Cases is getting 400 Bad Request for request bodies that look like this, where there are several instances of the same record IDs:

{
    "allOrNone": false,
    "records": [
                {
                    "attributes": {"type": "Case"},
                    "id": "50042000006ZDovBAG",
                    "Comments": "Complaint has been accepted for investigation."
                },
                {
                    "attributes": {"type": "Case"},
                    "id": "50042000006ZDovBAG",
                    "Comments": "Additional investigation/inspection required. Property is Imminently Dangerous."
                },
                {
                    "attributes": {"type": "Case"},
                    "id": "50042000006ZDovBAG",
                    "Comments": "Complaint has been assigned to an a investigator."
                },
                {
                    "attributes": {"type": "Case"},
                    "id": "50042000006ZDovBAG",
                    "Comments": "Complaint has been accepted for investigation."
                },
                {
                    "Status": "Closed",
                    "attributes": {"type": "Case"},
                    "id": "50042000006ZDovBAG",
                    "Comments": "Case Concluded."
                }
    ]
}

Does anyone have a reference or definitive information that this is not allowed and would case the 400 Bad Request?

(Yes, they should use POST /composite/sobjects with actual CaseComment records rather than using the Case.Comments shortcut when not also updating Case fields. But still hoping for definitive answer to this question.)

Answer 1

Yes, it's allowed; I just tried this in my org and it worked successfully. Whatever is going on here is not related to providing the same ID multiple times.