Reference
HTTP standards, server and client
Every published standard api-toolbox or sdk-toolbox implements, what each package does with it, and where apiguide.dev explains it. Read from each package's own documentation, so it changes when they do.
- 32Standards implemented
- 13On both sides of the wire
- 17Served by api-toolbox
- 28Consumed by sdk-toolbox
The standards. RFCs by number, then drafts, then the rest.
RFC 3986
URI
Internet Standard
sdk-toolbox parsing, resolution and dot-segment removal, tested against every §5.4 exampleRFC 6585
Additional Status Codes
Proposed Standard
sdk-toolbox 428 and 429; 429 never cachedRFC 6749
OAuth 2.0
Proposed Standard
apiguide.dev OAuth 2.0 and OAuth 2.1sdk-toolbox client credentials, authorisation code, refreshRFC 6750
Bearer
Proposed Standard
apiguide.dev OAuth 2.0 and OAuth 2.1sdk-toolbox authenticators;WWW-Authenticatechallenges parsed (RFC 9110 §11.6.1)RFC 6901
JSON Pointer
Proposed Standard
apiguide.dev JSON Pointer (RFC 6901)sdk-toolbox a body builder with pointer validationRFC 6902
JSON Patch
Proposed Standard
apiguide.dev JSON Patch (RFC 6902)sdk-toolbox a body builder with pointer validationRFC 7240
Prefer
Proposed Standard
sdk-toolboxPreferandPreference-Applied; the 202 polling pattern is convention, not RFCRFC 7396
JSON Merge Patch
Proposed Standard
apiguide.dev JSON Merge Patch (RFC 7396)api-toolbox Merge Patchsdk-toolbox a body, anddiff()that refuses what Merge Patch can't expressRFC 7578
multipart/form-data
Proposed Standard
sdk-toolbox a streamed bodyRFC 7617
Basic
Proposed Standard
sdk-toolbox authenticators;WWW-Authenticatechallenges parsed (RFC 9110 §11.6.1)RFC 7636
PKCE
Proposed Standard
sdk-toolbox S256 only, for every clientRFC 8288
Web Linking
Proposed Standard
apiguide.dev Web Linking (RFC 8288)api-toolbox Paginationsdk-toolboxLinkparsing per Appendix B, for pagination and deprecation linksRFC 8594
Sunset header
Informational
apiguide.dev Deprecation and Sunset Headers (RFC 9745, RFC 8594)api-toolbox Deprecation and Sunsetsdk-toolbox read alongside DeprecationRFC 8628
Device Authorization
Proposed Standard
sdk-toolbox start and pollRFC 8631
api-toolbox API CatalogRFC 9110
HTTP Semantics
Internet Standard
apiguide.dev HTTP Semantics (RFC 9110)sdk-toolbox method safety and idempotency (§9.2) for retries;Retry-After(§10.2.3) in all three date forms; conditional requests (§13)RFC 9111
HTTP Caching
Internet Standard
apiguide.dev HTTP Caching (RFC 9111)sdk-toolbox a private cache: freshness, validation, 304s,Vary, invalidation; no heuristic freshnessRFC 9264
apiguide.dev Linkset (RFC 9264)api-toolbox API CatalogRFC 9421
HTTP Message Signatures
Proposed Standard
apiguide.dev HTTP Message Signatures (RFC 9421)api-toolbox Message Signaturessdk-toolbox signing and verifying with hmac-sha256 and ed25519; no component parameters, RSA or ECDSA yetRFC 9457
Problem Details
Proposed Standard
apiguide.dev Problem Details for HTTP APIs (RFC 9457)api-toolbox Problem Detailssdk-toolbox parsed as a consumer should (§3); mapped to exceptions bytypeRFC 9530
Digest Fields
Proposed Standard
apiguide.dev Digest Fields (RFC 9530)api-toolbox Digest Fieldssdk-toolboxContent-Digest, sha-256 and sha-512RFC 9651
Structured Fields
Proposed Standard
apiguide.dev Structured Field Values for HTTP (RFC 9651)sdk-toolbox lists, dictionaries, every bare item type, inner lists and parametersRFC 9700
OAuth Security BCP
Best Current Practice
apiguide.dev OAuth 2.0 Security Best Current Practice (RFC 9700)sdk-toolbox PKCE everywhere, no implicit grant, single-flight refreshRFC 9727
apiguide.dev api-catalog (RFC 9727)api-toolbox API CatalogRFC 9745
Deprecation header
Proposed Standard
apiguide.dev Deprecation and Sunset Headers (RFC 9745, RFC 8594)api-toolbox Deprecation and Sunsetsdk-toolbox read, reported once per endpoint, strict mode for testsdraft-ietf-httpapi-digest-fields-problem-types
api-toolbox Digest Fieldsdraft-ietf-httpapi-idempotency-key-header
Internet-Draft
apiguide.dev Idempotency-Key Header Field (Internet-Draft)sdk-toolbox experimental: keys sent and kept across retriesdraft-ietf-httpapi-privacy
Internet-Draft, in the RFC Editor queue
sdk-toolbox no credentials over plain HTTP without opting indraft-ietf-httpapi-ratelimit-headers
Internet-Draft, expires 2026-11-24
apiguide.dev RateLimit Header Fields (Internet-Draft)sdk-toolbox experimental:RateLimitandRateLimit-PolicyreadOpenTelemetry HTTP semantic conventions
Stable
apiguide.dev OpenTelemetrysdk-toolbox a client span per attemptStandard Webhooks
Community specification
apiguide.dev Standard Webhookssdk-toolboxv1andv1averification, signing for testsW3C Trace Context
Recommendation
apiguide.dev W3C Trace Contextapi-toolbox Negotiationsdk-toolboxtraceparentandtracestatepropagation
How this is worked out.
Nothing in the table is written for this page. The api-toolbox column is the feature table at the top of its README, at v0.3.2: each standard a feature links is a row, with the section of the RFC where the README names one. The sdk-toolbox column is its standards page, at v0.0.1, word for word. PSRs are left out, because they are PHP interfaces rather than HTTP standards.
The apiguide.dev column links one of its 56 specification references only where the match is clear: the RFC's number in the page's title, a draft's name in its description, or a standard's name as its title. Where nothing matches clearly the cell is left empty. 2 links are kept by hand, for standards apiguide.dev covers under a title without the RFC's number: RFC 6749, RFC 6750.
Both packages cite drafts by revision, and not always the same one, so a draft is one row whatever its revision. Each package's own page says which revision it follows.