It subscribes to v1/rpc/req/+ and gets the method and params; for a two-way command it answers on the same id:
PUBLISH v1/rpc/req/42
{"method": "sys.ping", "params": {"host": "8.8.8.8", "count": 3}}
PUBLISH v1/rpc/res/42
{"ok": true, "result": {"sent": 3, "received": 3, "avg_ms": 18.2}}
Commands are only delivered after the device has subscribed on that connection.

