- From: John McGraw <j.mcgraw@taskhawktech.com>
- Date: Tue, 16 Jun 2026 00:31:31 +0000
- To: "ietf-http-wg@w3.org" <ietf-http-wg@w3.org>
Hi all, I would appreciate HTTP Working Group guidance on a status-code question arising from an individual HTTPAPI draft: https://datatracker.ietf.org/doc/draft-mcgraw-httpapi-agent-budget/ The current revision defines a Delegation HTTP authentication scheme for request-bound delegated authority. The general pattern is that a client presents signed, bounded authority from a principal before an origin server or gateway performs protected processing. Budget is the initial authority profile, but the HTTP mechanism is intended to be broader than payment or agent-specific deployments. Earlier revisions proposed a dedicated 427 Budget Required status code. In -02, that is no longer requested. The draft now uses existing HTTP semantics as the baseline: - 401 with WWW-Authenticate: Delegation when no acceptable Delegation credential is present, invalid, incomplete, or needs to be obtained. - 403 when a Delegation credential is understood but insufficient under local policy. - Problem Details for machine-readable authority requirements and public reason tokens. The dedicated status-code question is now left open as a possible 4NN Delegated Authority Required code, if the Working Group sees an interoperability reason for that path. The question I would value guidance on is: Is 401/403 + WWW-Authenticate: Delegation + Problem Details the appropriate interoperable baseline for this behavior, or is there a distinct HTTP semantics, intermediary, or API-gateway reason to consider a dedicated 4xx status code? Related feedback would also be useful on whether defining a new Delegation authentication scheme is the right shape, or whether this work should instead define fields and Problem Details members around existing authentication semantics. Best, John
Received on Tuesday, 16 June 2026 11:29:01 UTC