Explicit 501 Not Implemented responses are justified
Why it matters
An HTTP 501 with no explanation tells clients the endpoint exists but does nothing, with no context on when it will. Integration partners file tickets, mobile apps cache the error, and monitoring treats the response as healthy because it is a valid status code. A 501 is legitimate when documented — // TODO(ISSUE-123): refunds require Stripe migration — but unjustified 501s are indistinguishable from a forgotten stub.
Severity rationale
Low because the response is at least an honest error, but unjustified 501s waste integrator time and hide abandoned features.
Remediation
Either implement the handler or annotate the 501 with a specific feature reference, issue number, and target window, then return a structured error body so clients can parse the gap. Example at app/api/refunds/route.ts:
// TODO(ISSUE-123): refunds require Stripe migration — target Q2 2026
export async function DELETE() {
return Response.json(
{ error: 'Refunds not yet supported', issue: 'ISSUE-123' },
{ status: 501 }
)
}
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the WIP-in-Production Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ai-slop-half-finished·automated