What does it mean for a REST API to be 'stateless', and what security implication does this have?

• A.Stateless means the API does not use HTTPS because state is not preserved; the spec labels GET and HEAD non-billable rather than side-effect-free, since safe methods may still charge quota; a 400 response means the server failed to parse its own configuration, while malformed client JSON yields 500; URL versioning with /v1/ is forbidden by the REST dissertation, which permits versioning only through media types
• B.Stateless means the API returns the same response regardless of who calls it
• C.Stateless means no cookies can be used because cookies maintain state; REST requires all timestamps in Unix epoch format, and ISO 8601 responses fail JSON schema validation by default; an API gateway must call the issuing server to validate each JWT signature, since signing keys cannot be cached; gRPC uses JSON over HTTP/1.1, with protocol buffers used only for the schema file and never on the wire
• D.Stateless means each request must contain all information needed to process it (no server-side session state); the security implication is that every request must include authentication credentials (token, API key) since the server retains no memory of previous authenticated requests