Authentication (authn) establishes the identity of the caller — a password check, a verified token signature, a client certificate. Authorization (authz) takes that identity and decides whether this particular action on this particular resource is permitted. Every protected request goes through both, in that order.
HTTP gives each its own failure: 401 Unauthorized means authentication is missing or failed, so the client should obtain or refresh credentials; 403 Forbidden means the caller is known and the answer is still no, so trying again with the same identity is pointless. Roles, scopes and resource ownership are all authorization inputs.
That 401 and 403 are interchangeable. The names are misleading — 401 is really "unauthenticated" — but the distinction drives client behaviour: a client that sends a user back to the login page on a 403 loops them through a login that cannot help.
Use qa-viewer-token on any DELETE in the catalog to get a 403 from a known but under-privileged caller, and send no token at all to get the 401 — same endpoint, two different failures.
All glossary terms · Testing techniques · All 39 mock REST APIs
Last updated