rfc-9745

The Deprecation HTTP Response Header Field

S. Dalal, E. Wilde
date2025-03 streamIETF areawit wghttpapi statusPROPOSED STANDARD pages8 canonicalhttps://www.rfc-editor.org/rfc/rfc9745 doi10.17487/RFC9745
The Deprecation HTTP response header field is used to signal to consumers of a resource (identified by a URI) that the resource will be or has been deprecated. Additionally, the deprecation link relation can be used to link to a resource that provides further information about planned or existing deprecation. It may also provide ways in which client application developers can best manage deprecation.

Extracted elements (18)

design-rationale §5

Deprecation does not change any behavior of the resource. It is purely informational, signaling lifecycle state to client application developers without altering the resource's function or semantics.

http

design-rationale §2.2

Deprecation-related information is only a hint; it cannot be depended on. Client applications SHOULD always be implemented in ways that allow them to function without deprecation-related information, making increased scope hints safe to use even if partially invisible to consumers.

http

interoperability-note §4

For historical reasons, the Sunset HTTP header field uses a different date format from the Deprecation header field. Deprecation uses the RFC 9651 structured date (Unix timestamp prefixed with `@`), while Sunset uses HTTP-date format.

http

interoperability-note §2.2

The Deprecation header field applies only to the specific resource identified by the response (per Section 6.4.2 of RFC 9110). Servers may define an increased scope (e.g., all API resources), but consumers unaware of that scope will interpret the header as applying to the single resource only.

http

normative-requirement §4 SHOULD

If the Sunset timestamp is earlier than the Deprecation timestamp (e.g., due to misconfiguration), the client application developer SHOULD consult the resource developer to get clarification.

http

normative-requirement §3.1 MAY

The deprecation documentation MAY provide a migration guide and timeline for transitioning from the deprecated resource to a replacement, if applicable.

http

normative-requirement §2.1 MUST

The Deprecation header field value MUST be a Date structured field. It conveys either a past deprecation date or a future planned deprecation date for the resource identified by the response.

http

normative-requirement §4 MUST NOT

The timestamp given in the Sunset HTTP header field MUST NOT be earlier than the one given in the Deprecation header field.

http

normative-requirement §7 SHOULD

When the Deprecation header field value is a future date, client application developers SHOULD, if possible, consult the resource developer to discuss potential impact and plan transition to a recommended replacement resource.

http

protocol-element §2

The Deprecation HTTP response header field allows a server to signal to a client that a resource will be or has been deprecated. It conveys the deprecation date, which may be in the future or in the past.

http

protocol-element §3

The deprecation link relation type allows a server to link to human- or machine-readable documentation about the deprecation of the resource context. It can be sent before or after the actual deprecation date using a Link header field with `rel="deprecation"`.

http

protocol-element §4

The Sunset HTTP header field (RFC 8594) MAY be used alongside the Deprecation header field to indicate when the deprecated resource is expected to become unresponsive.

http

registry §6.1

The Deprecation HTTP response header field has been registered in the IANA 'Hypertext Transfer Protocol (HTTP) Field Name Registry' with status 'permanent', structured type 'Item', referencing RFC 9745 Section 2.

http, registry

registry §6.2

The 'deprecation' link relation type has been registered in the IANA 'Link Relation Types' registry, described as referring to documentation about the deprecation of the link's context, referencing RFC 9745 Section 3.

http, registry

security-consideration §7 SHOULD

Client application developers SHOULD always check the referred resource's documentation to verify authenticity and accuracy of deprecation information. When a Link header field provides documentation without HTTPS, its content may not be secure, private, or integrity-guaranteed.

http, security

security-consideration §7

The Deprecation header field is a hint only; the resource does not guarantee deprecation with certainty. Deprecated resources function as before, though non-functional aspects (efficiency, response times) may be affected.

http, security

security-consideration §7 MUST

When the Deprecation header field value is in the past, client application developers MUST no longer assume that the resource behavior will remain the same as before the deprecation date.

http, security

wire-format §2.1 MUST

The Deprecation header field is an Item Structured Header Field; its value MUST be a Date as per Section 3.3.7 of RFC 9651 (Structured Field Values for HTTP). Example: `Deprecation: @1688169599`.

http