The Internet Engineering Task Force (IETF) - an open international organization that develops and promotes technical standards for the Internet, such as the TCP/IP, HTTP and DNS protocols - has just released RFC 9745, which defines a standardized way of reporting resource deprecation in the context of HTTP, which is especially relevant for APIs based on this protocol.
In short, from now on, servers can inform their clients about the deprecation status of certain resources using the Deprecation response header, whose value is a date, in the past or future, indicating that the resource has already been or will be deprecated. Additionally, it is possible to use the link header to point to documentation and also Sunset, providing the date on which the resource will become unavailable.
In this article we will evaluate the feasibility of applying this standard in the real world. Using best practices in API development, we will start with definition files that follow the OpenAPI Specification and end up with the KrakenD API gateway.
Impacts As mentioned, this new standard is especially important for web APIs, that is, for APIs that adhere to the HTTP protocol, such as the famous REST. In this context, the RFC provides a means of bringing deprecation policies—once restricted to documentation or design time—to runtime.
Therefore, the novelty has the potential to seriously mitigate integration failures, allowing developers to make the necessary adaptations with a comfortable lead time. By the way, it is worth remembering that we are entering the era of AI (with their agents, MCP servers, etc.), which only increases the impact of this new standard, as they can learn and adapt on their own when faced with depreciation signals.
In the context of governance, the RFC also makes it possible for API gateway vendors (such as Kong, Tyk, KrakenD, Traefik, APISix, etc.) to consider the new standard during automated API deployment processes, especially when we think about APIOps based on OpenAPI specification. Let's see.
The OpenAPI specification provides for the indication of deprecation of operations through the deprecated field. With this new RFC, it is simply natural to think about linking things, that is, making the deprecation indication present in the definition files match the configuration of the gateways, which, once running, start to inject the new response header in the appropriate operations. This improvement would take governance to the next level of quality!
Proving the concept We will use the definition file that adheres to the OpenAPI Specification (OAS) to describe our API, we will build a parser in Go using libopenapi, we will rely on KrakenD as the API gateway and HttpBin as the backend.
Full project details can be found in this repository. So, I'll just highlight the main points: The definition file (openapi.yaml) paths: (...) /users/{userId}: (...) delete: (...) deprecated: true Note that the user delete operation relies on the OAS standard field deprecated with the value true. Well, it is easy to see that we are faced with an impedance mismatch when we try to make this boolean interact with the new headers provided in RFC 9745, since these are much richer in information than that one.
For reasons like this, OAS has extensions, which, in our case, will be used to describe the properties expected by the RFC as follows: paths: (...) /users/{userId}: (...) delete: (...) deprecated: true x-deprecated-at: "2025-06-30T23:59:59Z" x-deprecated-sunset: "2026-01-01T00:00:00Z" x-deprecated-link: https://api.example.com/deprecation-policy The Parser The parser's role is to read and interpret the openapi.yaml definition file, extract the relevant information for the gateway, and create the operations.json file, which will be embedded in the KrakenD image and consumed during its initialization, in an approach called flexible configuration.
This is the result of operations.json: { "list": [ { "path": "/users", "method": "get", "backend": { "path": "/users", "host": "http://backend:8888" } }, { "path": "/users", "method": "post", "backend": { "path": "/users", "host": "http://backend:8888" } }, { "path": "/users/{userId}", "method": "get", "backend": { "path": "/users/{userId}", "host": "http://backend:8888" } }, { "path": "/users/{userId}", "method": "delete", "deprecated": { "at": "@1751327999", "link": "https://api.example.com/deprecation-policy", "sunset": "Thu, 01 Jan 2026 00:00:00 UTC" }, "backend": { "path": "/users/{userId}", "host": "http://backend:8888" } } ] } Notice that the parser has projected the extended OAS elements into the KrakenD configuration file, including doing the appropriate value conversions, like so: OAS KrakenD x-deprecated-at: deprecated.at: x-deprecated-link: deprecated.link: x-deprecated-sunset: deprecated.sunset: The Plugin Now that the gateway configuration has been properly generated from the definition file, our custom plugin comes into play. Its function is to identify deprecated API operations and insert RFC 9745 headers with the appropriate values.
More details can be found in the article repository. But once the plugin was embedded in KrakenD, we got the following results: GET /users/1 DELETE /users/1 Note that only the second operation was deprecated (see operations.json) and the gateway correctly added the headers in the response.
Conclusions The experiment showed the viability of the concept, that is, that it is possible to take depreciation policies beyond definition and documentation, being easily communicated at runtime. In this way, systems can adopt automated actions to communicate obsolescence to interested parties and significantly reduce the chances of integration failures.
Although the OpenAPI Specification extensions have made this possible in the face of the insufficiency of the deprecated boolean, I imagine that the OpenAPI Initiative should include an improvement in future versions. Especially when I think that Eric Wilde, co-author of this RFC, is very active in the world of APIs.
To the readers who have come this far, thank you very much. I hope these few words have added something to you and made your time worthwhile.