code: public static Response getUpdateResponse(App app, ParaObject object, InputStream is) {
  		try (final Metrics.Context context = Metrics.time(app == null ? null : app.getAppid(),
  				RestUtils.class, "crud", "update")) {
  			if (app != null && object != null) {
  				Map<String, Object> newContent;
  				Response entityRes = getEntity(is, Map.class);
  				String[] errors = {};
  				if (entityRes.getStatusInfo() == Response.Status.OK) {
  					newContent = (Map<String, Object>) entityRes.getEntity();
  				} else {
  					return entityRes;
  				}
  				object.setAppid(isNotAnApp(object.getType()) ? app.getAppIdentifier() : app.getAppid());
  				if (newContent.containsKey("_voteup") || newContent.containsKey("_votedown")) {
  					return getVotingResponse(object, newContent);
  				} else {
  					ParaObjectUtils.setAnnotatedFields(object, newContent, Locked.class);
  					// app can't modify other apps except itself
  					if (checkImplicitAppPermissions(app, object)) {
  						// This is the primary validation pass (validates not only core POJOS but also user defined objects).
  						errors = validateObject(app, object);
  						if (errors.length == 0 && checkIfUserCanModifyObject(app, object)) {
  							// Secondary validation pass: object is validated again before being updated
  							object.update();
  							// check if update failed due to optimistic locking
  							if (object.getVersion() == -1) {
  								return getStatusResponse(Response.Status.PRECONDITION_FAILED,
  										"Update failed due to 'version' mismatch.");
  							}
  							return Response.ok(object).build();
  						}
  					}
  				}
  				return getStatusResponse(Response.Status.BAD_REQUEST, errors);
  			}
  			return getStatusResponse(Response.Status.NOT_FOUND);
  		}
  	}
docs: Update response as JSON.
  @param object object to validate and update
  @param is entity input stream
  @param app the app object
  @return a status code 200 or 400 or 404