Motor de decisión RFC 9110 y resolución de dilemas para códigos de estado de APIs REST (401 vs 403, 301 vs 308, 400 vs 422)
Aclara decisiones comunes y ambiguas en el diseño de APIs
A user attempts to access an endpoint protected by security policies.
RFC 9110, Section 15.5.2
Authentication is required and has failed or has not been provided.
Missing, expired, or invalid API key or Bearer token.
When the user IS authenticated, but lacks sufficient permissions (use 403).
WWW-Authenticate: Bearer error="invalid_token"{
"error": "Unauthorized",
"message": "Bearer token expired or missing."
}