The response MUST include a WWW-Authenticate header field (section 14.47) containing a challenge applicable to the requested resource. The client MAY repeat the request with a suitable Authorization header field (section 14.8).
To verify the client's credentials, this response must include a WWW-Authenticate header field (section 14.47) that presents a relevant authentication challenge for the desired resource, enabling clients to potentially retransmit the request accompanied by an Authorization header field (section 14.8).