API and Technical Documentation Editing and Proofreading Services

Capitalization decides what a sentence in a specification requires. RFC 2119, written by S. Bradner and published in March 1997, gave a short list of ordinary English words a defined meaning for use in protocol specifications.1 Its abstract says only that these words "are often capitalized," which left the status of the lowercase forms open.1 Twenty years later the IETF published a second memo whose main work was to settle that question.2

What the words were defined to mean

RFC 2119 sets out the terms plainly. "MUST" and the terms "REQUIRED" or "SHALL" mean "that the definition is an absolute requirement of the specification."1 "SHOULD", or the adjective "RECOMMENDED", means "that there may exist valid reasons in particular circumstances to ignore a particular item, but the full implications must be understood and carefully weighed before choosing a different course."1 "MAY", or "OPTIONAL", means "that an item is truly optional."1

That last definition does not end there, and the rest of it is easy to miss. Section 5 goes on to say that an implementation omitting an option "MUST be prepared to interoperate with another implementation which does include the option, though perhaps with reduced functionality."1 The reverse case carries a MUST as well.1 The definition of the weakest keyword contains two instances of the strongest one.

The memo demonstrates its own ambiguity

Section 6 offers guidance on using the words. It opens: "Imperatives of the type defined in this memo must be used with care and sparingly."1 The sentence after that one carries the capitalized form.1 It reads: "In particular, they MUST only be used where it is actually required for interoperation or to limit behavior which has potential for causing harm (e.g., limiting retransmisssions)" and then stops without a period.1 A lowercase must and an uppercase MUST sit in consecutive sentences of the memo that gives the capitals their defined meaning.

The example inside that parenthesis also spells "retransmisssions" with three esses. Both faults are in the published text of a Best Current Practice document dated March 1997.1 The RFC Editor's information page for RFC 2119 links to a list of errata reported against it, and the document itself has not been reissued.3

RFC 8174, by B. Leiba, was published in May 2017. Its abstract says the document "aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings."2 RFC 8174 updates RFC 2119 as a separate document rather than replacing it.3 The two together now form BCP 14, and the RFC Editor lists that subseries as containing exactly those two documents.4

What a specification inherits by citing BCP 14

Version 3.1.0 of the OpenAPI Specification, dated February 15, 2021, adopts the convention and spells out the condition.5 It names eleven terms, from "MUST" through "OPTIONAL", and says they are to be interpreted as described in BCP 14 "when, and only when, they appear in all capitals, as shown here."5 A specification that cites BCP 14 without repeating that clause has still adopted the condition, because the condition is inside the memos being cited.

Other standards bodies handled the same problem with a different vocabulary. ISO writes that "shall" indicates a requirement and "should" indicates a recommendation, while "may" is used to indicate that something is permitted.6 A writer moving between an ISO document and an IETF one is moving between two vocabularies that overlap without matching.

The IETF also published guidance for people writing standards. RFC 2360, edited by G. Scott, is dated June 1998. It tells editors of standards track documents that they "must not deviate from the definitions provided as they are intended to identify interoperability requirements or limit potentially harmful behavior."7

What we can check, and what we cannot

Whether an endpoint behaves as its documentation claims is a question for the engineers who built the endpoint. We cannot answer it, we do not test software, and we do not decide what a specification ought to require. A keyword is chosen by the people writing the specification, and we leave the choice where they made it.

Reading is a narrower job than that. A search through a document citing BCP 14 returns every appearance of a keyword, capitalized and lowercased alike, and that is how an inconsistency turns up. The RFC Style Guide asks in its own house rules for an abbreviation to be expanded on first use, and first use is a locatable place in the file.8 The Google developer documentation style guide asks writers to "aim for a conversational tone rather than a formal one," which is a description of register.9 Where one entry moves between that register and a formal one, the move is on the page. Nothing a client sends us is shared.

There is a practical consequence for anyone running a copy edit over a specification. A pass that sentence-cases headings can turn MUST into Must. In a document that cites BCP 14, that is not a formatting change.

References

  1. S. Bradner, Key words for use in RFCs to Indicate Requirement Levels, RFC 2119, Internet Engineering Task Force, March 1997. https://www.rfc-editor.org/rfc/rfc2119.txt
  2. B. Leiba, Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words, RFC 8174, Internet Engineering Task Force, May 2017. https://www.rfc-editor.org/rfc/rfc8174.txt
  3. RFC Editor, information page for RFC 2119. https://www.rfc-editor.org/info/rfc2119
  4. RFC Editor, information page for BCP 14. https://www.rfc-editor.org/info/bcp14
  5. OpenAPI Initiative, OpenAPI Specification version 3.1.0, February 15, 2021. https://spec.openapis.org/oas/v3.1.0.html
  6. International Organization for Standardization, Foreword, supplementary information, citing ISO/IEC Directives, Part 2, 2021. https://www.iso.org/foreword-supplementary-information.html
  7. G. Scott, editor, Guide for Internet Standards Writers, RFC 2360, Internet Engineering Task Force, June 1998. https://www.rfc-editor.org/rfc/rfc2360.txt
  8. H. Flanagan and S. Ginoza, RFC Style Guide, RFC 7322, Internet Engineering Task Force, September 2014. https://www.rfc-editor.org/rfc/rfc7322.txt
  9. Google, Google developer documentation style guide, Voice and tone, updated May 27, 2026. https://developers.google.com/style/tone

A worked example: API Endpoint Reference Entry

API reference documentation, endpoint entry

RFC 8174 states that its aim is "to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings." RFC 2119 and RFC 8174 together form BCP 14. A document that adopts BCP 14 has made the case of a word decide whether the word carries a defined requirement level or its ordinary English sense. Mixed usage inside such a document therefore leaves a reader unable to tell which sense was meant. Both panels below carry the same extract from the project's conventions, and every requirement level, status code, and field name in the revision is drawn from it. Setting a requirement level is the owners' decision. The revision recases a keyword where the conventions fix the level, and asks a question where they do not.

Before

SPECIMEN, PREPARED BY EDITFAST FOR ILLUSTRATION. NOT A REAL RECORD.
Torrance Labs (fictitious) - Ledger API reference

EXTRACT FROM THE PROJECT'S DOCUMENTATION CONVENTIONS (reproduced unchanged in both panels)
DC-1.1 This reference adopts BCP 14. A key word carries its defined requirement level only in all capitals.
DC-1.3 Requirement levels for POST /entries, as set by the API owners: the Idempotency-Key header is REQUIRED; the memo field is OPTIONAL; a client retrying a request SHOULD reuse the original key.
DC-1.5 On a duplicate key the endpoint returns 200 with the original entry. On a missing key it returns 400.
DC-1.7 An abbreviation is expanded at its first appearance in an entry.

POST /entries

Creates a ledger entry. The Idempotency-Key header must be supplied. The memo field may be omitted. Clients should reuse the original key when retrying, and MUST handle a 200 response on a duplicate. Requests without a key MAY be rejected.

After

SPECIMEN, PREPARED BY EDITFAST FOR ILLUSTRATION. NOT A REAL RECORD.
Torrance Labs (fictitious) - Ledger API reference

EXTRACT FROM THE PROJECT'S DOCUMENTATION CONVENTIONS (reproduced unchanged in both panels)
DC-1.1 This reference adopts BCP 14. A key word carries its defined requirement level only in all capitals.
DC-1.3 Requirement levels for POST /entries, as set by the API owners: the Idempotency-Key header is REQUIRED; the memo field is OPTIONAL; a client retrying a request SHOULD reuse the original key.
DC-1.5 On a duplicate key the endpoint returns 200 with the original entry. On a missing key it returns 400.
DC-1.7 An abbreviation is expanded at its first appearance in an entry.

POST /entries
Key words in this entry follow Best Current Practice 14, or BCP 14 (DC-1.1).

Creates a ledger entry.

The Idempotency-Key header is REQUIRED (DC-1.3). The memo field is OPTIONAL (DC-1.3). A client retrying a request SHOULD reuse the original idempotency key (DC-1.3).

Responses (DC-1.5)
200: the key has been seen before, and the original entry is returned.
400: the Idempotency-Key header was absent.

[Query to the API owners: the draft states that a client MUST handle a 200 response on a duplicate, and that requests without a key MAY be rejected. DC-1.3 records three requirement levels for this endpoint and neither of these is among them. Please confirm the intended levels.]

What changed, and why

WasNowReason
The Idempotency-Key header must be supplied.The Idempotency-Key header is REQUIRED (DC-1.3).DC-1.3 sets this level as REQUIRED, and DC-1.1 gives the defined meaning only to the capitalized form. A lowercase must in the same entry as an uppercase MUST leaves a reader deciding which sense each carries.
The memo field may be omitted.The memo field is OPTIONAL (DC-1.3).The same fault runs the other way here. DC-1.3 sets OPTIONAL, and lowercase may is ordinary English in a document that has reserved the capitals.
Clients should reuse the original key when retryingA client retrying a request SHOULD reuse the original idempotency key (DC-1.3).DC-1.3 sets SHOULD. The word key on its own could mean the idempotency key or an authentication key, and the extract names only one.
and MUST handle a 200 response on a duplicate[Query to the API owners: ... Please confirm the intended levels.]DC-1.3 records three requirement levels for this endpoint and this is not among them. Setting a level is the owners' decision, so the draft wording stands and the point is raised as a query. What a 200 means is stated separately, from DC-1.5.
Requests without a key MAY be rejected.[Query to the API owners: ... Please confirm the intended levels.]DC-1.5 records a 400 on a missing key rather than a permission to reject, so the draft and the conventions do not agree. Which one is right is the owners' call, and the query puts it to them.
(no statement of the convention in the entry)Key words in this entry follow Best Current Practice 14, or BCP 14 (DC-1.1).DC-1.1 governs the whole reference and appeared only in the conventions document. Printing it in the entry puts it in front of whoever is reading the capitals.

Final specimen (PDF, 4 KB) Marked-up specimen (PDF, 7 KB)

Specimen prepared by EditFast for illustration only. Not a real document, record or filing. Any resemblance to an actual organization, person or record is unintended. Not legal, regulatory, clinical or professional advice.

Key API and Technical Documentation vocabulary

API and Technical Documentation Word Challenge

Even seasoned pros miss these — give it a shot.

Get a Free Estimate

« More Technology and Software editing  |  All editing services