For each relationship in the request body:

1. If an id or data.id is provided and matches an existing
   relationship, that relationship is updated in place. On update there
   are some restrictions:

   a. Only data.key and data.description, and meta can be
   changed else a 400 is raised
   b. Other existing properties in data can be provided but only with
   the same value
   c. Any other root properties than data and meta are ignored

2. If no id is provided but a relationship with the same source entity,
   target entity and relationship type (data.key) already exists, the
   incoming relationship is de-duplicated: it is merged into the existing
   one following the relationship de-duplication rules (highest TLP wins,
   earliest estimated_threat_start_time and latest
   estimated_threat_end_time are kept, and descriptions are
   concatenated). The provided source is added to the existing sources.

3. Otherwise, a new relationship is created.

Duplicates within the same request body (matching on source, target and
type) are merged together following the same de-duplication rules before
being persisted.

Returns 201 if at least one relationship was created, otherwise
200.

Required permissions

• modify entities