How prescriptive should we be about which HTTP error codes to return?

[duglin]

404 is one we do mandate, and we sometimes say it must be a 400, but most of the time we just say "an error must be generated". Do we need to be more precise? Should we standardize the error messages?

[duglin]

Yes and consider using: https://datatracker.ietf.org/doc/html/rfc7807 -> https://datatracker.ietf.org/doc/html/rfc9457

[manuelottlik]

We need to provide a way to standardize the non-happy path in an extensible way.

[duglin]

Proposal:

• Define the http response code for each error - MUST use these
• Define the problem/json for each error - MUST use these if they advertise they support problem/json
• Define a capability so people can advertise if they expose problem/json or not ("not" is for s3-like usecases)
• Impls can add extension attributes to the spec defined problems
• Impls can add extension problems (custom "type") for non-spec-defined error situations
• Add the ability to expose a URL so clients can retrieve the list of errors supports + extensions they support