Context
PR #488 promotes the attribute-release surface to the default Registry Relay build. resolve_requested_claims currently maps empty, duplicate, over-limit, and missing-required explicit claim lists to 400 filter.invalid_value. The status is correct, but the generic detail describes a field-type parse failure rather than the actual request-shape problem.
Unknown claim names must remain collapsed to release.subject_denied so the API does not become a claim-enumeration oracle.
Scope
- Define stable attribute-release request error code(s), or safe structured details, for empty, duplicate, over-limit, and missing-required explicit claim lists.
- Preserve the anti-enumeration response for unknown claims.
- Preserve the subject hash and PDP decision context in audit records.
- Update the error taxonomy, OpenAPI artifact, API documentation, and focused tests.
Related: #487, #488.
Context
PR #488 promotes the attribute-release surface to the default Registry Relay build.
resolve_requested_claimscurrently maps empty, duplicate, over-limit, and missing-required explicit claim lists to400 filter.invalid_value. The status is correct, but the generic detail describes a field-type parse failure rather than the actual request-shape problem.Unknown claim names must remain collapsed to
release.subject_deniedso the API does not become a claim-enumeration oracle.Scope
Related: #487, #488.