Authentication required

What to do next

• Provide valid credentials using the authentication scheme supported by the API.

HTTP response contract

Set the actual HTTP status to 401 and Content-Type: application/problem+json. The JSON status below must agree with the actual response status.

WWW-Authenticate: Bearer realm="api"

RFC-defined members

type

The canonical URI above; clients use it as the primary problem identifier.

title

Authentication required — a stable human-readable summary (localization is permitted).

status

401 — advisory in the body; it does not set the HTTP status.

detail

A safe explanation specific to this occurrence. Clients should not parse it for machine decisions.

instance

An optional URI reference identifying a specific occurrence. It need not resolve; avoid sensitive identifiers.

These five members are defined by RFC 9457. This template includes type, title, status, and detail in its samples; RFC 9457 does not require all five.

Custom extension fields

This definition declares no custom extensions.

Extensions belong to this type’s contract. Consumers must ignore extensions they do not recognize.

Example response body

Illustrative occurrence data. Construct the response manually in your application or automation.

{
  "type": "https://errors.ctrlbox.dev/problems/authentication-required",
  "title": "Authentication required",
  "status": 401,
  "detail": "The request lacks valid authentication credentials for the target resource."
}