Nobody's forcing the operator of the api to respond to those requests. HTTP 401 is right there.