My reasoning behind **MUST** was primarily that none of the other documented `2xx` responses seemed applicable to an API "create document" action (I'll admit overlooking `202 Accepted`, which should be allowed).

* `203 Non-Authoritative Information` doesn't seem appropriate as we're asking this server to create the document; we'd expect it to then be the authoritative source (at least from the client's perspective) about that document.
* `205 Reset Content` is not intended (as I read it) for API traffic.
* `206 Partial Content` is intended for partial `GET` requests, which is incompatible with our `POST` (or `PUT`) assumptions.

But you're right, if the server sees a reason to respond with `203 Non-Authoritative Information` or `205 Reset Content` or even a custom `2xx` status, it should be allowed. We just need to make specific that the default conforming-client behavior should be to treat them the same as a `200 OK`. The client **MAY** then take additional action based on what the server may publish about its intentions in using those other `2xx` statuses.

I'll reword this as a **SHOULD** and clarify the default handling of alternate `2xx` responses. I'll also add a section about `202 Accepted` handling.