Why It Matters

An undefined auth-header placeholder in server.json means the registry document is incomplete: consumers cannot reliably resolve the intended secret input for the remote.

What Triggers

SEC322 applies to server.json auth-like header values and triggers when a placeholder in headers[].value is not defined under the same header object's variables map.

Example that triggers:

{
  "headers": [
    {
      "name": "Authorization",
      "value": "Bearer {TOKEN}"
    }
  ]
}

Example that stays clean:

{
  "headers": [
    {
      "name": "Authorization",
      "value": "Bearer {TOKEN}",
      "variables": {
        "TOKEN": { "description": "API token", "isSecret": true }
      }
    }
  ]
}

False Positives

This is a deterministic structural check over parsed placeholders and local variable definitions. It does not depend on prose interpretation or remote reachability.

Remediation

Define every auth-header placeholder under the same headers[].variables object or remove the unresolved placeholder from the header value.