What is 'HTTP 401 vs 403' and why does the distinction matter for API security?

• A.401 Unauthorized means authentication is required or has failed - the client should authenticate. 403 Forbidden means the authenticated client is not authorized to access the resource - reauthenticating won't help. For security: returning 403 for unauthenticated requests reveals the resource exists; returning 401 is more accurate. Some security-sensitive implementations return 404 (Not Found) for unauthorized access to hide resource existence (security through obscurity)
• B.Both 401 and 403 should trigger the same client behavior: reauthenticate; the spec labels GET and HEAD non-billable rather than side-effect-free, since safe methods may still charge quota; SOAP is a REST profile that adds an envelope, and the two share caching and verb semantics; ETags on API responses are recalculated by intermediary proxies, so end-to-end optimistic locking cannot use them; the Location header on a 201 points at the collection rather than the new resource, forcing clients to re-query for their item; server-sent events are bidirectional, with the client writing on the same stream, which is why SSE replaced WebSockets