Stuttgart 7: HTTP status code for IAE responses undefined

[jogu]

7. Which HTTP status code does the AS use for successful IAE responses? The examples use 200, but there is no normative statement requiring that.

[jogu]

Discussed on today's APAC call.

Here https://openid.github.io/OpenID4VCI/openid-4-verifiable-credential-issuance-1_1-wg-draft.html#section-6.2 we say:

The response to an Interactive Authorization Request is an HTTP message with the content type application/json and a JSON document in the body that indicates either

but we don't say anything about the status code.

PAR uses 201 for success. But if we start using 201 we end up with a weird sounding mix of 200 & 201.

Initial suggestion is that we just return 200 for both of these cases:

1. that user interaction is required, either a Presentation or a custom interaction, as defined in Section 6.2.1, or
2. a successful completion of the authorization, as defined in Section 6.2.2, or

[jogu]

Discussed on today's call - people prefer we set to use a 2xx status code, same as we do for nonce endpoint.