HTTP
Enable an AI agent to recognise HTTP interactions, assess their semantic and operational state, and determine which requests, retries, reuse and forwarding actions are justified.
Research draft, second pass
A second pass drafted this model: the structure a model of this thing needs, and what is known about it in the world. The line under this one says how the second half was obtained - researched against sources, or recalled without web access, in which case nothing here was read anywhere and every claim is a lead to verify. Unreviewed either way.
Researched by: Codex + Grok
Purpose and description
Enable an AI agent to recognise HTTP interactions, assess their semantic and operational state, and determine which requests, retries, reuse and forwarding actions are justified.
HTTP is a generic, stateless, application-layer request/response protocol that transfers representations of URI-identified resources using self-descriptive messages, with version-specific mappings onto TCP (HTTP/1.x), a binary framed layer over TLS/TCP (HTTP/2), or QUIC (HTTP/3), as defined by the IETF HTTP specifications centred on RFC 9110.
It can be Interpret a request and its response sequence using the applicable HTTP semantics.; Construct a request with suitable method, target, negotiation fields and preconditions.; Assess whether a failed or interrupted request may be retried and record the justification.; Decide whether a stored response may be reused, validated or replaced.; Evaluate a redirect or authentication challenge before choosing a follow-up request.; Diagnose protocol inconsistencies across message framing, intermediaries and version boundaries..
Distinguishing features
An interaction uses HTTP method and status semantics; carrying bytes over TCP or QUIC alone does not make it HTTP.
An HTTPS URI identifies HTTP communication secured through TLS, rather than a separate application semantics model.
HTTP can carry many representation formats; HTML or JSON content alone does not identify the protocol.
HTTP does not require REST architectural constraints, and a REST claim does not establish which HTTP semantics an API honours.
HTTP/1.1, HTTP/2 and HTTP/3 share core semantics while differing in message encoding and connection or stream handling; textual start lines are not a universal recognition test.
Scope
+ Request methods, target URIs, fields and response status semantics
+ Representation metadata, content negotiation and message content
+ Conditional requests, partial transfers and cache reuse
+ HTTP versions, message framing, streams and intermediary behaviour
+ Protocol-level evidence governing authentication, redirection, retries and completion
- Application-specific resource schemas, business rules and transaction guarantees
- DNS resolution and domain ownership
- TCP and QUIC transport internals
- TLS cryptography, certificate lifecycle and trust administration
- Browser document rendering, JavaScript execution and browser policy configuration
- Service deployment, infrastructure capacity and organisational access governance
Characteristics
- Observed HTTP version
- HTTP/1.0 | HTTP/1.1 | HTTP/2 | HTTP/3 | other | unknown; recorded per hop Determines applicable messaging rules without assuming that every intermediary uses the same version.
- Request method
- Case-sensitive method token with known, extension or unknown semantics Constrains expected effects, content interpretation, caching and retry decisions.
- Target resource
- Target URI, its scheme and authority, and its relationship to the contacted peer Separates the resource being addressed from proxies and other participants carrying the request.
- Response status
- Observed three-digit status code, informational or final role, and known or unknown meaning Supports protocol-level interpretation without treating a successful status as proof of a business outcome.
- Exchange completion
- Not sent | in progress | informational response received | final response incomplete | complete | failed | outcome unknown Distinguishes a complete response from a request whose server-side effects remain uncertain.
- Representation description
- Declared media type, content coding, language and presence or absence of relevant metadata Controls interpretation and negotiation while preserving uncertainty about undeclared or inconsistent content.
- Cache reuse eligibility
- Not evaluated | reusable while fresh | validation required | stale reuse permitted under recorded conditions | reuse prohibited Prevents reuse decisions based only on possession of an earlier response.
- Freshness lifetime and current age
- Seconds, with calculation inputs and observation time Provides evidence for freshness decisions rather than relying on a timestamp alone.
- Retry justification
- Not assessed | justified by method and failure evidence | justified by an application guarantee | unjustified | uncertain Makes duplicate-effect risk explicit when the first request's outcome is unknown.
Also called
Where this came from
wikidata · CC0 1.0
Drafted structure
Bundle to layer to finding to question, as the second pass will find it: 6 bundles · 11 layers · 18 findings · 29 questions.
Request intent and resource Records which resource an HTTP request addresses and what its method asks the recipient to do.
An agent needs a grounded interpretation of request intent before judging effects or issuing a follow-up.
Target and authority
Distinguishes the target URI and authority from the peer or intermediary receiving the message.
Effective request target
Record the target URI and the evidence used to establish its scheme, authority and resource identifier.
- Which URI is targeted, and how do the request-target form, authority fields or pseudo-fields establish it? definition
- Is the contacted peer the origin server, a forward proxy, a gateway or a tunnel endpoint? boundary
Method and effect
Separates standard method properties from observed or documented application behaviour.
Method semantics and guarantees
Record the method's defined semantics, safety and idempotency, together with evidence of any application-specific guarantees or deviations.
- What does this method request, and are its safety and idempotency properties defined by an applicable specification? definition
- What evidence supports the expected effects at this resource, including any request-content semantics or restrictions? provenance
Responses and representations Records what a response means and how its content relates to a selected representation.
Status codes and content metadata jointly constrain interpretation; neither alone proves application success.
Status and response sequence
Interprets informational and final responses in the context of the originating request.
Response meaning
Record the response sequence and distinguish HTTP-level outcomes from application results requiring separate evidence.
- Which responses are informational, which is final, and what does the final status mean for this request method? definition
- What remains unproven about the application outcome, particularly for accepted processing, absent content or an interrupted response? boundary
Content and negotiation
Connects representation metadata and selection criteria to the content actually exchanged.
Selected representation
Record declared representation properties, negotiation inputs and any mismatch between metadata and observed content.
- Which media type, content coding and language are declared, and what evidence confirms or contradicts those declarations? measurement
- Which request preferences influenced representation selection, and is content expected or permitted for this method and status? boundary
Caching and conditional transfer Records when an HTTP response can be reused and how validators or ranges constrain subsequent transfers.
HTTP permits avoiding or reducing transfers, but only when cache selection, freshness and precondition rules justify the action.
Stored response reuse
Evaluates storage and reuse in the context of a private or shared cache.
Cache selection and freshness
Record cache context, matching criteria, directives, age and freshness evidence before reusing a response.
- May this cache store and reuse the response, considering its private or shared role, method, status and applicable directives? action
- Do the target, method and Vary-selected request fields match, and what calculated age and freshness lifetime govern reuse? measurement
Validators, preconditions and ranges
Uses representation validators to condition operations and assess partial transfers.
Conditional operation
Record available entity tags or modification dates, their comparison requirements, and the intended role of preconditions or ranges.
- Which validators are available, and does the proposed precondition require a strong or weak comparison? definition
- Which conditional fields would validate a cached response or guard an update, and how should a 304 or 412 response change the next action? action
- If a range is requested, what supports range handling and representation continuity, and how will 206, 416 or a full response be handled? action
Messaging path and completion Records version-specific message boundaries, intermediary transformations and evidence of exchange completion.
Correct semantics depend on knowing what was actually transmitted and whether each hop interpreted the message consistently.
Version, framing and intermediaries
Relates shared HTTP semantics to the encoding and forwarding rules used on each observed hop.
Message boundaries and forwarding
Record the HTTP version, framing evidence and known intermediary changes without assuming end-to-end wire equivalence.
- Which HTTP version is observed on each known hop, and what establishes the end of the message content and any trailers? measurement
- Could conflicting length indicators, invalid fields or intermediary transformations cause different recipients to interpret different message boundaries? boundary
Failure and retry
Separates transport or stream failure from knowledge of whether the requested operation took effect.
Completion evidence and repetition
Record how far the exchange progressed and what evidence justifies repeating it.
- What evidence shows whether the request was transmitted, processed or answered completely, and where does the outcome remain unknown? measurement
- Do method semantics, a version-specific failure signal or a documented application guarantee justify a retry, and what timing guidance applies? action
Credentials and follow-up boundaries Records HTTP authentication and routing signals that affect the authority and scope of subsequent requests.
An agent must interpret protocol prompts without assuming that they authorise credential disclosure or a new action.
Authentication and state context
Distinguishes origin authentication, proxy authentication and application state carried in HTTP fields.
Credential recipient and scope
Record challenges and credential or cookie scope through references that avoid retaining secret values unnecessarily.
- Does the response challenge origin authentication or proxy authentication, and which scheme and protection space does it identify? definition
- Which credentials or cookies may accompany the next request, based on recipient scope, applicable client policy and the agent's existing authority? action
Redirects and protocol transitions
Evaluates changes to the request destination, method or communication mode.
Follow-up request boundary
Record what a redirect, successful CONNECT or protocol upgrade proposes and which semantics continue to apply.
- For a redirect, how is Location resolved, what method and content behaviour applies, and does the destination change origin or scheme? action
- If a tunnel or protocol upgrade is established, where does ordinary HTTP message interpretation stop and the neighbouring protocol model take over? boundary
Evidence and external alignment What the world already says about this thing, gathered so the model can be checked against it.
A model that cannot be lined up against existing standards, identifiers and practice cannot be adopted by anyone who already uses them.
Reported evidence
Findings from the breadth pass, kept separate from the structural claims.
Kinds and varieties
Reported by the breadth pass; each item needs checking against its source before it becomes normative.
- HTTP/0.9 (historical one-line GET with no headers)
- HTTP/1.0
- HTTP/1.1 (Host, persistent connections, chunked transfer)
- HTTP/2 (binary multiplexing and HPACK over TLS/TCP)
- HTTP/3 (HTTP semantics over QUIC/UDP)
- HTTP over TLS (HTTPS; same semantics, encrypted channel)
- Cleartext HTTP (http URI scheme, typically port 80)
- HTTP through intermediaries (origin, proxy, gateway, cache, CDN)
- Which of these kinds and varieties hold for the sense of HTTP this model covers, and on what evidence? provenance
Identifiers and schemes
Reported by the breadth pass; each item needs checking against its source before it becomes normative.
- Wikidata - Q8777 - Item for Hypertext Transfer Protocol
- IANA URI scheme - http | https - Registered schemes; https denotes HTTP over TLS
- TCP/UDP port - 80 (http), 443 (https) - Default ports; HTTPS and HTTP/3 commonly use 443
- ALPN protocol ID - http/1.1 | h2 | h3 - TLS Application-Layer Protocol Negotiation identifiers
- IANA HTTP Status Code Registry - NNN in 1xx-5xx - Assigned numeric status codes
- IANA HTTP Method Registry - token (e.g. GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS, CONNECT) - Registered method names
- Internet media type - message/http - Type for an HTTP message as a payload
- Which of these identifiers and schemes hold for the sense of HTTP this model covers, and on what evidence? provenance
Standards and regulation
Reported by the breadth pass; each item needs checking against its source before it becomes normative.
- IETF RFC 9110 HTTP Semantics (Internet Engineering Task Force)
- IETF RFC 9111 HTTP Caching (Internet Engineering Task Force)
- IETF RFC 9112 HTTP/1.1 (Internet Engineering Task Force)
- IETF RFC 9113 HTTP/2 (Internet Engineering Task Force)
- IETF RFC 9114 HTTP/3 (Internet Engineering Task Force)
- IETF RFC 9204 QPACK: Field Compression for HTTP/3 (Internet Engineering Task Force)
- IETF RFC 2818 HTTP Over TLS (Internet Engineering Task Force)
- IETF RFC 8446 The Transport Layer Security Protocol Version 1.3, when HTTP runs over TLS (Internet Engineering Task Force)
- IETF RFC 3986 Uniform Resource Identifier (URI): Generic Syntax (Internet Engineering Task Force)
- IETF RFC 6265 HTTP State Management Mechanism (cookies) (Internet Engineering Task Force)
- IANA HTTP method, status-code, and field-name registries (Internet Assigned Numbers Authority, under IETF)
- WHATWG Fetch Standard (Web Hypertext Application Technology Working Group)
- EU GDPR and ePrivacy rules as they apply to cookies, identifiers, and tracking carried over HTTP (European Union)
- PCI DSS requirements to use TLS (HTTPS) when HTTP carries payment-card data (PCI Security Standards Council)
- Which of these standards and regulation hold for the sense of HTTP this model covers, and on what evidence? provenance
Real-world use
Reported by the breadth pass; each item needs checking against its source before it becomes normative.
- Web browsers fetch HTML documents and subresources (scripts, styles, images, fonts) from origin servers.
- Native and web applications call JSON/REST, GraphQL, and similar APIs over HTTP.
- Reverse proxies, load balancers, and CDNs terminate or forward HTTP and apply caching, TLS, and routing.
- Services notify one another with HTTP webhooks and callbacks.
- Package registries, container registries, and software-update systems download artefacts over HTTP.
- Orchestrators and operators probe liveness and readiness with HTTP health-check endpoints.
- An HTTP Upgrade or CONNECT exchange is used to bootstrap WebSocket, tunnelling, or other protocols.
- Which of these real-world use hold for the sense of HTTP this model covers, and on what evidence? provenance
Typical measurements
Reported by the breadth pass; each item needs checking against its source before it becomes normative.
- Protocol version - 0.9, 1.0, 1.1, 2, 3 - version identifier
- Status code - 100-599 (commonly 200, 301/302/304, 400/401/403/404, 500/502/503/504) - code
- Time to first byte / round-trip latency - about 1 ms on loopback; tens to a few hundred ms on typical Internet paths; seconds when congested or failing - ms
- Request or response body size - 0 B to multi-GB downloads; typical HTML/API bodies from a few hundred bytes to a few MB - byte
- Header block size - a few hundred bytes to about 8-16 KiB before many servers reject the request - byte
- HTTP/2 max concurrent streams - often default 100; configurable from 1 to hundreds - stream
- Redirect chain length - 0-5 in normal use; user agents commonly abort around 20 hops - hop
- Which of these typical measurements hold for the sense of HTTP this model covers, and on what evidence? provenance
Failure modes and hazards
Reported by the breadth pass; each item needs checking against its source before it becomes normative.
- HTTP request smuggling (Content-Length vs Transfer-Encoding desynchronisation) at HTTP/1.1 intermediaries
- Header injection and response splitting
- Web cache poisoning and inconsistent cache keys across CDNs and reverse proxies
- Cleartext HTTP exposing credentials, cookies, and bodies to interception (TLS stripping, mixed content)
- Connection-exhaustion denial of service (e.g. Slowloris) and HTTP/2 Rapid Reset style stream attacks
- Compression side-channels on HTTPS bodies (BREACH)
- Redirect loops and open redirects
- Origin or gateway 5xx failures, timeouts, and broken persistent connections
- Cookie theft and session fixation, especially without Secure/HttpOnly and without HTTPS
- QUIC/UDP blocking that breaks or delays HTTP/3 with fallback to HTTP/2 or HTTP/1.1
- Which of these failure modes and hazards hold for the sense of HTTP this model covers, and on what evidence? provenance
Regional variation
Reported by the breadth pass; each item needs checking against its source before it becomes normative.
- Some networks and national filters block or degrade UDP/443, so HTTP/3 is unavailable while HTTP/1.1 and HTTP/2 still work.
- State inspection and blocking is far more effective against cleartext HTTP than against HTTPS.
- Cookie consent, tracking, and retention rules differ (EU GDPR/ePrivacy versus other jurisdictions).
- Browser HTTPS-only mode, HSTS preload, and certificate-authority trust stores are not uniform worldwide.
- Accept-Language and default character encoding historically varied by locale and vendor, affecting content negotiation.
- Which of these regional variation hold for the sense of HTTP this model covers, and on what evidence? provenance
Neighbouring kinds and how to tell them apart
Reported by the breadth pass; each item needs checking against its source before it becomes normative.
- HTTPS - HTTPS is HTTP over TLS (https URI, typically port 443 and a TLS handshake). HTTP semantics are the same; confidentiality and server authentication come from TLS, not from a different application protocol.
- QUIC - QUIC is the transport. HTTP/3 is HTTP semantics mapped onto QUIC streams (ALPN h3). Other ALPN protocols can run on QUIC without being HTTP.
- WebSocket - WebSocket is a separate framed protocol. It may start with an HTTP Upgrade; after 101 Switching Protocols, subsequent frames are not HTTP messages.
- REST - REST is an architectural style that often uses HTTP. HTTP can carry non-REST payloads (RPC, file transfer, SOAP); REST constraints can be applied on other transfers.
- HTML - HTML is a document format commonly carried as an HTTP representation (Content-Type text/html). The protocol is the request line, status line, and fields, not the markup.
- gRPC - gRPC is an RPC system typically multiplexed on HTTP/2 or HTTP/3 with content-type application/grpc and protobuf messages, not ordinary resource representations.
- SPDY - SPDY was Google's obsolete predecessor to HTTP/2. Distinguish by ALPN/NPN tokens spdy/* versus h2.
- CoAP - CoAP is a constrained request/response protocol over UDP (commonly port 5683) with its own binary header; it is analogous in role, not a version of HTTP.
- Which of these neighbouring kinds and how to tell them apart hold for the sense of HTTP this model covers, and on what evidence? provenance
Sources
- RFC 9110: HTTP Semantics - Normative definition of HTTP as a protocol family, methods, status codes, fields, and resource/representation model
- RFC 9112: HTTP/1.1 - HTTP/1.1 message syntax, persistent connections, and chunked transfer coding
- RFC 9113: HTTP/2 - HTTP/2 binary framing, streams, and HPACK; ALPN token h2
- RFC 9114: HTTP/3 - HTTP/3 mapping onto QUIC; distinction from the QUIC transport itself
- RFC 2818: HTTP Over TLS - HTTPS as HTTP over TLS, https URI scheme, and default port 443
- Fetch Standard - Browser-facing HTTP client behaviour, CORS, and redirects as implemented on the Web
- Hypertext Transfer Protocol (Q8777) - Stable public identifier for the protocol as a catalogue item
What the second pass must settle
- With no registry definition recorded, should this entry cover only the HTTP protocol family or also provide reusable records for individual exchanges and endpoint capabilities?
- Which specification baseline and extension set should be adopted, including treatment of legacy HTTP/1.0, registered extension methods and evolving field definitions?
- Where should the catalogue place cookie handling and browser-enforced policies so that this model can reference their effects without duplicating ownership?
- What evidence will normally be available across intermediaries, and how should the model express conclusions that are valid only for one observed hop?
- Which neighbouring model owns application-level idempotency keys and asynchronous operation completion, and what evidence must HTTP retry decisions obtain from it?