@smallcircles GoActivityPub servers support following things for Client to Server:
* Accessing objects and collections
* Filtering the collections through query parameters (eg. ?type=Create)
* Support for OAuth2 actor endpoints information and authorization
* Support for .well-known information (webfinger and now, OAuth2 client registration)
* ACLs for accessing them based on recipients list - this includes collection filtering of individual items
* ACL principal extraction from OAuth2 Bearer token (or from HTTP-Signature)
* Outbox Activity validation & processing (which I think is the main one :D)