Werk #22431: REST API: 401 and 403 are now documented on every endpoint
| Component | REST API | ||||
| Title | REST API: 401 and 403 are now documented on every endpoint | ||||
| Date | Sep 17, 2026 | ||||
| Level | Trivial Change | ||||
| Class | Bug Fix | ||||
| Compatibility | Compatible - no manual interaction needed | ||||
| Checkmk versions & editions |
|
The REST API documentation now lists a 401 response on every endpoint.
Every endpoint can answer 401, because Checkmk checks the credentials of a request before it ever reaches the endpoint. Until now the generated OpenAPI documentation said so on only four endpoints, and those four declared 401 for reasons that have nothing to do with authentication. A client generated from the spec now knows that any call can come back unauthenticated.
The descriptions of both access-related status codes were wrong too, and have been corrected:
- 401 previously read "The user is not authorized to do this request", which actually describes 403. It now states that either no credentials were provided or the credentials sent were invalid, and that retrying with valid credentials is the correct reaction.
- 403 previously read "Configuration via Setup is disabled", which is a narrow special case. Since permission denials started returning 403 (Werk #18241), a 403 almost always means a missing permission, so that is what the description says now, along with the hint that retrying as the same user will not help.
The introduction of the API documentation has gained a section "Authentication and authorization status codes" under "Authentication", which states the distinction once for the whole API.
This is a documentation change. No endpoint changed the status code it actually returns.