A 401 HTTP response code is returned when calling a REST API. What is the error state identified by this response code?

The HTTP 401 Unauthorized response code indicates that the client's request has not been applied because it lacks valid authentication credentials for the target resource. The server is essentially stating that authentication is required to access the resource, and the client has either not provided credentials or the credentials provided are invalid. This response is often accompanied by a WWW-Authenticate header, which provides the client with information on how to authenticate properly (e.g., which authentication scheme to use). It is distinct from a 403 Forbidden response, which implies the server knows the client's identity but is refusing access.

A. This describes a 400 Bad Request error, which indicates a client-side error such as malformed request syntax.
B. This describes a 403 Forbidden error, where the client is authenticated, but lacks the necessary permissions for the resource.
D. This describes a 404 Not Found error, which means the server could not locate the resource at the specified URI.

1. Internet Engineering Task Force (IETF). RFC 7235, "Hypertext Transfer Protocol (HTTP/1.1): Authentication," Section 3.1. This document defines the 401 Unauthorized status code, stating it "indicates that the request has not been applied because it lacks valid authentication credentials for the target resource."

2. Cisco DevNet. "Introduction to APIs," Module: "REST APIs," Section: "HTTP Response Status Codes." The official Cisco learning material for the 200-901 exam specifies that 401 Unauthorized means "The request requires user authentication."

3. Fielding, R. T. (2000). Architectural Styles and the Design of Network-based Software Architectures. Doctoral dissertation, University of California, Irvine. Chapter 6, Section 6.1.1, "Status Code and Reason Phrase," discusses the client error 4xx class, where 401 is reserved for cases requiring authentication.