I'm building a REST API and any time you change an object, the backend updates the "last modified date" to now.  I have no control over this backend code so it has to stay this way.  Another thing it changes is the "last modified by" which stores a username.  
In my eyes, this changed "last modified date" and "last modified by" makes updating anything non-idempotent. Does that mean that updates should occur with POST instead of PUT?  
My concern is that these days people assume that PUT is for updating, and my API will violate the principle of least surprises.
 
     
     
    