In the Creating Resources section, it is stated:

The request MUST include a single resource object as primary data.

It is not said anything about other potentially valid top level members (like jsonapi, included, links, none of which would make sense a priori in a client-issued payload, and meta, which could).