[atlas] Changes to RIPE Atlas API auth status codes on 2 Oct

This change has now been made, so some endpoints will return a 401 
status code instead of 403.

As a reminder, you can keep the previous behaviour for the rest of this 
year by including the following HTTP header in your requests:

X-Compat: auth-2023

or alternatively, thanks to my generalized calendar confusion:

X-Compat: auth-2022

This migration measure will be dropped some time in January (of whatever 
year comes after this one).

Regards,
Chris


On 19/09/2023 10:38, Chris Amin wrote:
> Dear colleagues,
> 
> Currently the RIPE Atlas REST API (https://atlas.ripe.net/api/v2/) 
> returns a 403 Forbidden status code in two cases:
> 
> * When a request requires authentication but the user has not provided 
> any credentials, or has provided incorrect credentials
> * When a user has authenticated correctly, but they or their API key 
> lacks the permissions needed for a particular request
> 
> Distinguishing between these two cases is important because in the first 
> case the client can potentially get access by authenticating, and in the 
> second case there is no point in retrying authentication with the same 
> credentials.
> 
> In order to enable this distinction, and to generally conform to web 
> standards and best practices, on Monday, 2nd October we will change the 
> REST API so that a completely unauthenticated request will receive a 
> response with a 401 Unauthorized status code. The 403 Forbidden status 
> code will still be returned for users and API keys that are 
> authenticated but lack the necessary permissions for the request.
> 
> As a temporary migration measure, the API will keep the same behaviour 
> (always return 403) if either:
> 
> * The "Referer" header contains "RIPE Atlas Tools" and a version string 
> <= 3.1.1, or
> * An "X-Compat" header is set and contains the string "auth-2022"
> 
> This temporary measure is guaranteed to work for the rest of 2022, after 
> which it will be removed and the API will always make the 401/403 
> distinction.
> 
> Kind regards,
> Chris Amin
> RIPE Atlas team
>