



Network Working Group                                           J. Gould
Internet-Draft                                                   P. Garg
Intended status: Standards Track                      M.S. Malang Khader
Expires: 6 March 2027                                     VeriSign, Inc.
                                                        2 September 2026


 Status Set Extension Mapping for the Extensible Provisioning Protocol
                  draft-gould-regext-epp-status-set-04

Abstract

   This document describes an Extensible Provisioning Protocol (EPP)
   extension for the provisioning and management of status sets applied
   to EPP objects, such as the domain name object in RFC 5731.  The EPP
   status values defined in the EPP object mappings, such as Section 2.3
   of RFC 5731, support human-readable text that describes the rationale
   or reason for the status applied to the object.  There can be many
   overlapping reasons for a status value being applied to the object,
   such as implementing a lock service, complying with a court order, or
   addressing domain abuse.  A status set defines an object representing
   the reason for setting a list of status values, so clients and
   servers can manage the status sets in place of individual status
   values to effectively manage the overlapping reasons.  The EPP
   extension supports the provisioning of client status sets, disclosure
   of the server status sets, and an enhanced authorization model for
   client status sets with the EPP Authentication Token in
   [I-D.gould-regext-auth-token].

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on 6 March 2027.






Gould, et al.             Expires 6 March 2027                  [Page 1]

Internet-Draft          EPP Status Set Extension          September 2026


Copyright Notice

   Copyright (c) 2026 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents (https://trustee.ietf.org/
   license-info) in effect on the date of publication of this document.
   Please review these documents carefully, as they describe your rights
   and restrictions with respect to this document.  Code Components
   extracted from this document must include Revised BSD License text as
   described in Section 4.e of the Trust Legal Provisions and are
   provided without warranty as described in the Revised BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   3
     1.1.  Conventions Used in This Document . . . . . . . . . . . .   3
     1.2.  Registrar User  . . . . . . . . . . . . . . . . . . . . .   4
   2.  Object Attributes . . . . . . . . . . . . . . . . . . . . . .   4
     2.1.  Status Value  . . . . . . . . . . . . . . . . . . . . . .   4
     2.2.  Status Set  . . . . . . . . . . . . . . . . . . . . . . .   5
     2.3.  Authentication Token  . . . . . . . . . . . . . . . . . .   7
     2.4.  M-of-N  . . . . . . . . . . . . . . . . . . . . . . . . .   7
   3.  EPP Command Mapping . . . . . . . . . . . . . . . . . . . . .   7
     3.1.  EPP Query Commands  . . . . . . . . . . . . . . . . . . .   8
       3.1.1.  EPP <check> Command . . . . . . . . . . . . . . . . .   8
       3.1.2.  EPP <info> Command  . . . . . . . . . . . . . . . . .   8
       3.1.3.  EPP <transfer> Command  . . . . . . . . . . . . . . .  19
     3.2.  EPP Transform Commands  . . . . . . . . . . . . . . . . .  19
       3.2.1.  EPP <create> Command  . . . . . . . . . . . . . . . .  19
       3.2.2.  EPP <delete> Command  . . . . . . . . . . . . . . . .  22
       3.2.3.  EPP <renew> Command . . . . . . . . . . . . . . . . .  24
       3.2.4.  EPP <transfer> Command  . . . . . . . . . . . . . . .  25
       3.2.5.  EPP <update> Command  . . . . . . . . . . . . . . . .  26
   4.  Formal Syntax . . . . . . . . . . . . . . . . . . . . . . . .  33
   5.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .  36
     5.1.  XML Namespace . . . . . . . . . . . . . . . . . . . . . .  36
     5.2.  EPP Extension Registry  . . . . . . . . . . . . . . . . .  37
   6.  Security Considerations . . . . . . . . . . . . . . . . . . .  37
   7.  References  . . . . . . . . . . . . . . . . . . . . . . . . .  38
     7.1.  Normative References  . . . . . . . . . . . . . . . . . .  38
     7.2.  Informative References  . . . . . . . . . . . . . . . . .  39
   Appendix A.  Change History . . . . . . . . . . . . . . . . . . .  40
     A.1.  Change from 00 to 01  . . . . . . . . . . . . . . . . . .  40
     A.2.  Change from 01 to 02  . . . . . . . . . . . . . . . . . .  40
     A.3.  Change from 02 to 03  . . . . . . . . . . . . . . . . . .  40
     A.4.  Change from 03 to 04  . . . . . . . . . . . . . . . . . .  40



Gould, et al.             Expires 6 March 2027                  [Page 2]

Internet-Draft          EPP Status Set Extension          September 2026


   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  40

1.  Introduction

   This document describes an Extensible Provisioning Protocol (EPP)
   extension for the provisioning and management of status sets applied
   to EPP objects, such as the domain name object in [RFC5731] and the
   host object in [RFC5732].  The EPP status values defined in the EPP
   object mappings, such as Section 2.3 of [RFC5731], support human-
   readable text that describes the rationale or reason for the status
   applied to the object.  There can be many overlapping reasons for a
   status value being applied to the object, such as implementing a lock
   service, complying with a court order, or addressing domain abuse.  A
   status set defines an object representing the reason for setting a
   list of status values, so clients and servers can manage the status
   sets in place of individual status values to effectively manage the
   overlapping reasons.  The EPP extension supports the provisioning of
   client status sets, disclosure of the server status sets, and an
   enhanced authorization model for client status sets with the
   Authentication Token in [I-D.gould-regext-auth-token].  This document
   defines new EPP commands in the form of the Status Set Info, Status
   Set Create, Status Set Delete, Status Set Renew, and Status Set
   Update.

   This document describes a Status Set Extension Mapping for version
   1.0 of the Extensible Provisioning Protocol (EPP) [RFC5730].  This
   extension is specified using the XML 1.0 as described in
   [W3C.REC-xml-20040204] and XML Schema notation as described in
   [W3C.REC-xmlschema-1-20041028] and [W3C.REC-xmlschema-2-20041028].

1.1.  Conventions Used in This Document

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
   "OPTIONAL" in this document are to be interpreted as described in
   [BCP14] when, and only when, they appear in all capitals, as shown
   here.

   In examples, "C:" represents lines sent by a protocol client and "S:"
   represents lines returned by a protocol server.  Indentation and
   white space in examples is provided only to illustrate element
   relationships and is not a REQUIRED feature of this specification.

   XML is case sensitive.  Unless stated otherwise, XML specifications
   and examples provided in this document MUST be interpreted in the
   character case presented to develop a conforming implementation.





Gould, et al.             Expires 6 March 2027                  [Page 3]

Internet-Draft          EPP Status Set Extension          September 2026


   The XML namespace prefix "statusSet" is used for the namespace
   "urn:ietf:params:xml:ns:epp:statusSet-0.2", but implementations MUST
   NOT depend on it; instead, they should employ a proper namespace-
   aware XML parser and serializer to interpret and output the XML
   documents.

1.2.  Registrar User

   [RFC8499] defines the registrar as "a service provider that acts as a
   go-between for registrants and registries." and defines the
   registrant and registry.  A registrar can have many users that
   interface with the registry across many channels, such as EPP and Web
   User Interface (UI), which is referred to as a Registrar User in this
   document.  The EPP client in [RFC5730], referred to as the EPP
   Registrar User is this document, is a registrar system that uses the
   EPP Registrar User credentials to authenticate with the <login>
   command to establish an EPP session.  The Registrar User
   authenticates to create the Authentication Token, defined in
   [I-D.gould-regext-auth-token], that MUST NOT be the EPP Registrar
   User since the EPP Registrar User is used only to create the EPP
   session.  The ability to provision Status Sets using an
   Authentication Token is based on enabling a Registrar User to
   generate an Authentication Token and having the required set of
   authorization groups to authorize a Status Set action.

2.  Object Attributes

   This extension adds additional elements to EPP objects, such as the
   domain name mapping described in [RFC5731] and the host mapping
   described in [RFC5732].  Common attributes are described here.

2.1.  Status Value

   A Status Value is defined for EPP objects in the EPP extensions, such
   as Status Values in Section 2.3 of [RFC5731] and Section 3.1 of
   [RFC3915].  There is a single Status Value assigned to an object by
   type, such as the "clientUpdateProhibited" Status Value in [RFC5731]
   and the "redemptionPeriod" Status Value in [RFC3915].  The Status
   Value can include a text message indicating the reason(s) that the
   Status Value is set, such as:

   <domain:status s="clientUpdateProhibited">
   Auth Token Lock,Registrar Lock
   </domain:status>

              Figure 1: Status Value Text Message with Reasons





Gould, et al.             Expires 6 March 2027                  [Page 4]

Internet-Draft          EPP Status Set Extension          September 2026


   Inclusion and format of the Status Value reason(s) is specific to
   each server implemenation, and the client needs to implement the
   server-specific format.  The Status Set, described in Section 2.2,
   makes the reason string into a named object with a set of attributes,
   including the associated Status Values.

2.2.  Status Set

   A Status Set is an object that defines the reason for the Status
   Values (Section 2.1) for an EPP object, such as the domain name
   object in [RFC5731] and the host object in [RFC5732].  The Status Set
   can also be used as a Marker Status Set when there are no mapped
   Status Values that can drive additional business logic and publishing
   use cases.  An EPP object can have many assigned Status Sets, and the
   Status Sets can include an overlapping set of Status Values.  The
   Status Value will be assigned to the object if there is at least one
   Status Set assigned to the object with the mapped Status Value.  The
   Status Value will be unassigned from the object when all Status Sets
   are unassigned with the mapped Status Value.  For example, both the
   "Registrar Lock" Status Set and the "Auth Token Lock" Status Set are
   mapped to the "clientUpdateProhibited" Status Value, where if either
   of the Status Sets are assigned to the EPP object, the
   "clientUpdateProhibited" Status Value will be assigned.
   "clientUpdateProhibited" Status Value will be unassigned if both
   "Registrar Lock" Status Set and "Auth Token Lock" Status Sets are
   unassigned.  A Status Set has the following attributes:

   *  "name": The unique name for the Status Set that is up to server
      policy.  The reserved name "REDACTED" can be used for a Server
      Status Set where the server cannot disclose the reason, such as
      the case for a sealed court order.  Example names include
      "Registrar Lock", "Auth Token Lock", and "Registry Lock".

   *  "type": The type of Status Set, which is either "client" for a
      Client Status Set or "server" for a Server Status Set.  A Client
      Status Set MAY be set, unset, and overridden with authorization
      defined in the Authentication Token (Section 2.3) by the client.
      A Server Status Set MUST only be set and unset by the server and
      MUST NOT be overridden by the client.

   *  "authTokenUsed": A boolean value indicating whether or not an
      Authentication Token (Section 2.3) is used with the Client Status
      Set.  If "true", an Authentication Token (Section 2.3) is needed
      to authorize setting, unsetting, and overriding the Client Status
      Set; otherwise the Authentication Token (Section 2.3) does not
      need to be passed.  This value MUST be set only when the "type"
      attribute is set to "client".




Gould, et al.             Expires 6 March 2027                  [Page 5]

Internet-Draft          EPP Status Set Extension          September 2026


   *  "inherited": A boolean value indicating whether or not the Status
      Set is inherited from the parent object (domain name) and is
      inherited by the child objects (hosts).  The Status Values of the
      object only include Status Sets directly assigned and not
      inherited by the object.  Inherited Status Values are enforced by
      the server but NOT persisted to the child object.

   *  "assigned": A boolean value indicating whether or not the Status
      Set is directly assigned to the object.  The <info> command
      supports returning "all" Status Sets for the client to see what
      Client Status Sets are available and directly assigned to the
      object.  Only "assigned" Server Status Sets will be returned in
      the <info> response extension.

   *  "crDate": Date and time that the Status Set was assigned to the
      EPP object.

   *  "status": List of 0 or more Status Values (Section 2.1) mapped to
      the Status Set.  A Status Set with zero Status Values is
      considered a Marker Status Set.  Example Status Values include the
      lock statuses from [RFC5731] and [RFC5732] with
      "clientUpdateProhibited", "clientDeleteProhibited",
      "clientTransferProhibited", "serverUpdateProhibited",
      "serverDeleteProhibited", and "serverTransferProhibited".

   *  "reason": Reason that the Status Set was assigned to the object.
      This is only needed when the "name" attribute alone doesn't
      clearly indicate the reason.  An example is providing the more
      detailed reason "Botnet domain name" for the "Domain Abuse" Status
      Set.

   *  "attribute": List of 0 or more attribute name, value pairs.  The
      set of "attribute" names supported per Status Set is up to server
      policy.  Example attributes for the "For Sale" Status Set include
      "Currency" and "Price".

   A client can manage Client Status Values using Client Status Sets
   instead of setting individual Client Status Values, since the Status
   Set represents a container of Status Values that can overlap.  The
   Status Set provides an explicit signal of the Status Value reasons
   that improves the status management when there are overlapping
   reasons.  The support for the Authentication Token (Section 2.3)
   provides an additional layer of authorization with the ability to
   override Client Status Sets in Status Set transform commands.







Gould, et al.             Expires 6 March 2027                  [Page 6]

Internet-Draft          EPP Status Set Extension          September 2026


2.3.  Authentication Token

   The Authentication Token, defined in section 2.1 of
   [I-D.gould-regext-auth-token], uses JSON Web Signature (JWS), defined
   in [RFC7515], with JWS Compact Serialization, defined in Section 3.1
   of [RFC7515], to digitally sign the JWS Protected Header properties
   and JWS Payload claims in a single string that is embedded in the
   <statusSet:authToken> XML element.  An Authentication Token is used
   to authorize provisioning and overriding a Client Status Set that has
   the <statusSet:authTokenUsed> element set to "1" or "true" in the
   Status Set Info Response (Section 3.1.2).  The overriding capability
   MUST only apply to Client Status Sets.

   Example Authentication Token XML element:

         <statusSet:authToken>
   eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN
   URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW
   VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL
   VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl
   l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y
   MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z
   5PFZeR5k-ScmDEDdFl9nIFCLd5-mF
         </statusSet:authToken>

                 Figure 2: Authentication Token XML Element

2.4.  M-of-N

   M-of-N applies to the use of Authentication Tokens (Section 2.3),
   where M defines the number of registrar users (Section 1.2) with a
   valid Authentication Token (Section 2.3) needed to authorize a Status
   Set action out of N registrar users (Section 1.2) that can generate
   an Authentication Token.  The Status Set transform commands support
   providing a list of Authentication Tokens (Section 2.3), using the
   <statusSet:authToken> elements.  The value of M is up to server
   policy and can be at the server-level that applies to all registrars
   or can apply at the registrar-level and configured on a per-registrar
   basis.  The value of N is dynamic and is based on the number of
   registrar users (Section 1.2) that support the generation of
   Authentication Tokens (Section 2.3) in the server.

3.  EPP Command Mapping

   A detailed description of the EPP syntax and semantics can be found
   in the EPP core protocol specification [RFC5730].





Gould, et al.             Expires 6 March 2027                  [Page 7]

Internet-Draft          EPP Status Set Extension          September 2026


3.1.  EPP Query Commands

   This document defines one EPP Query Command with <info> to retrieve
   the Status Set information for the object.  This document does not
   define a mapping for the EPP <check> command or the <transfer>
   command.

3.1.1.  EPP <check> Command

   This extension does not add any elements to the EPP <check> command
   or <check> response.

3.1.2.  EPP <info> Command

   A new Status Set Info Command by extending the EPP <info> command to
   get information for an EPP object with the inclusion of the Status
   Set information, defined in Section 2.2, that is optionally
   authorized by applying the Authentication Tokens and their
   authorization groups, defined in Section 2.3.

   In addition to the EPP command elements described in the EPP <info>
   command, the command MAY contain an <extension> element.  The
   <extension> element MUST contain a child <statusSet:info> element
   with an OPTIONAL "sets" attribute that can be either "assigned" or
   "all", with "assigned" being the default value.  The value "assigned"
   can be used to return the Status Sets directly assigned to or
   inherited by the EPP object, and "all" to return the Status Sets that
   are assigned to and available for the EPP object.  The
   <statusSet:info> element contains the following child elements:

   *  An OPTIONAL list of <statusSet:authToken> elements, defined in
      Section 2.3, that supports authorizing the data returned in the
      Status Set Info Response in support of M-of-N authorization,
      defined in Section 2.4.  The authorization groups in the list of
      Authentication Tokens (Section 2.3) are intersected to determine
      the data that will be returned.  If no <statusSet:authToken>
      elements are provided, the server will return the default data
      based on the EPP Registrar User (Section 1.2) authorization of the
      EPP session.

   Example Domain Name Status Set Info Command that uses the default
   "assigned" form:









Gould, et al.             Expires 6 March 2027                  [Page 8]

Internet-Draft          EPP Status Set Extension          September 2026


   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp
   C:  xmlns="urn:ietf:params:xml:ns:epp-1.0">
   C:  <command>
   C:    <info>
   C:      <domain:info
   C:        xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>domain.example</domain:name>
   C:      </domain:info>
   C:    </info>
   C:   <extension>
   C:      <statusSet:info
   C:      xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.2"/>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

    Figure 3: Domain Name Status Set Info Command Default Assigned Form

   Example Domain Name Status Set Info Command that uses the "assigned"
   form with two authentication tokens to determine the data returned:





























Gould, et al.             Expires 6 March 2027                  [Page 9]

Internet-Draft          EPP Status Set Extension          September 2026


   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp
   C:  xmlns="urn:ietf:params:xml:ns:epp-1.0">
   C:  <command>
   C:    <info>
   C:      <domain:info
   C:        xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>domain.example</domain:name>
   C:      </domain:info>
   C:    </info>
   C:    <extension>
   C:      <statusSet:info
   C:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.2"
   C:        sets="assigned">
   C:        <statusSet:authToken>
   C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN
   C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW
   C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL
   C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl
   C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y
   C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z
   C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF
   C:        </statusSet:authToken>
   C:        <statusSet:authToken>
   C:eyJ0eXAiOiJKV1QiLA0KICabcJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJ
   C:leHAiOjEzMDAabc4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp
   C:0cnVlfQ.dBjftJeZ4CVP-mB92K27abcuhbUJU1p1r_wW1gFWFOEjXk
   C:        </statusSet:authToken>
   C:      </statusSet:info>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

           Figure 4: Domain Name Status Set Info Command with Two
                           Authentication Tokens

   Example Domain Name Status Set Info Command that uses the "all" form:













Gould, et al.             Expires 6 March 2027                 [Page 10]

Internet-Draft          EPP Status Set Extension          September 2026


   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp
   C:  xmlns="urn:ietf:params:xml:ns:epp-1.0">
   C:  <command>
   C:    <info>
   C:      <domain:info
   C:        xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>domain.example</domain:name>
   C:      </domain:info>
   C:    </info>
   C:    <extension>
   C:      <statusSet:info
   C:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.2"
   C:        sets="all"/>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

           Figure 5: Domain Name Status Set Info Command All Form

   If the query was successful, the server replies with a
   <statusSet:infData> element along with the regular EPP <resData>.
   The <statusSet:infData> contains an OPTIONAL list of zero or more
   <statusSet:statusSet> child elements.  The <statusSet:statusSet>
   element has the REQUIRED "name" attribute with the unique name for
   the Status Set that is up to server policy.  Example names include
   "Registrar Lock", "Auth Token Lock", and "Registry Lock".  There is a
   reserved value of "REDACTED" that is used for a Server Status Set,
   where the name must be redacted based on server policy.  The
   <statusSet:statusSet> element has the following child elements:

   *  A <statusSet:type> element that indicates whether the Status Set
      is a Client Status Set with a value of "client" or the Status Set
      is a Server Status Set with a value of "server".

   *  An OPTIONAL <statusSet:authTokenUsed> element that is a boolean
      with a default value of "false" that indicates whether the Status
      Set uses the Authentication Token, defined in Section 2.3.  If "1"
      or "true", an Authentication Token is needed to authorize the
      setting, unsetting, and overriding the Client Status Set;
      otherwise with a value of "0" or "false" the Authentication Token
      does not need to be passed.  An OPTIONAL "num" attribute, with a
      default value of "1", indicates the M value in M-of-N, defined in
      Section 2.4.






Gould, et al.             Expires 6 March 2027                 [Page 11]

Internet-Draft          EPP Status Set Extension          September 2026


   *  An OPTIONAL <statusSet:inherited> element that is a boolean with a
      default value of "false" that indicates whether the Status Set is
      inherited from the parent object (domain name), in the case of the
      EPP Host object in [RFC5732], and is inherited by the child
      objects (hosts), in the case of the EPP Domain Name object in
      [RFC5731].

   *  An OPTIONAL <statusSet:assigned> element that is a boolean with a
      default value of "true" that indicates whether the Status Set is
      assigned to the EPP object.  A value of "false" indicates that the
      Status Set is available to be set, which only applies to Client
      Status Sets.

   *  An OPTIONAL <statusSet:crDate> element that is the date and time
      that the Status Set was assigned to the object.

   *  An OPTIONAL list of zero or more <statusSet:status> elements that
      includes the Status Values, defined in Section 2.1, mapped to the
      Status Set.

   *  An OPTIONAL <statusSet:reason> element that indicates the free-
      form text reason that Status Set was assigned to the object.

   *  An OPTIONAL list of zero or more <statusSet:attribute> elements
      that includes the Status Set attributes that have been set when
      the <statusSet:assigned> element is "1" or "true" or the possible
      set of Status Set attribute names that can be set when the
      <statusSet:assigned> element is "0" or "false".  The
      <statusSet:attribute> element values are empty for possible Status
      Set attribute names.

   Example Domain Name Status Set Info Response that includes the
   assigned Client Status Sets ("Auth Token Lock" and "Registrar Lock")
   and the assigned Server Status Set ("Registry Lock"):

   S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
   S:  <response>
   S:    <result code="1000">
   S:      <msg>Command completed successfully</msg>
   S:    </result>
   S:    <resData>
   S:      <domain:infData
   S:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   S:        <domain:name>example.com</domain:name>
   S:        <domain:roid>EXAMPLE1-REP</domain:roid>
   S:        <domain:status s="clientUpdateProhibited">
   S:        Auth Token Lock,Registrar Lock



Gould, et al.             Expires 6 March 2027                 [Page 12]

Internet-Draft          EPP Status Set Extension          September 2026


   S:        </domain:status>
   S:        <domain:status s="clientDeleteProhibited">
   S:        Auth Token Lock,Registrar Lock
   S:        </domain:status>
   S:        <domain:status s="clientTransferProhibited">
   S:        Auth Token Lock,Registrar Lock
   S:        </domain:status>
   S:        <domain:status s="serverUpdateProhibited">
   S:        Registry Lock
   S:        </domain:status>
   S:        <domain:status s="serverDeleteProhibited">
   S:        Registry Lock
   S:        </domain:status>
   S:        <domain:status s="serverTransferProhibited">
   S:        Registry Lock
   S:        </domain:status>
   S:        <domain:ns>
   S:          <domain:hostObj>ns1.example.com</domain:hostObj>
   S:          <domain:hostObj>ns1.example.net</domain:hostObj>
   S:        </domain:ns>
   S:        <domain:host>ns1.example.com</domain:host>
   S:        <domain:host>ns2.example.com</domain:host>
   S:        <domain:clID>ClientX</domain:clID>
   S:        <domain:crID>ClientY</domain:crID>
   S:        <domain:crDate>2000-04-03T22:00:00.0Z</domain:crDate>
   S:        <domain:upID>ClientX</domain:upID>
   S:        <domain:upDate>2026-05-03T09:10:00.0Z</domain:upDate>
   S:        <domain:exDate>2027-04-03T22:00:00.0Z</domain:exDate>
   S:        <domain:trDate>2022-04-08T09:00:00.0Z</domain:trDate>
   S:        <domain:authInfo>
   S:          <domain:pw>2fooBAR</domain:pw>
   S:        </domain:authInfo>
   S:      </domain:infData>
   S:    </resData>
   S:    <extension>
   S:      <statusSet:infData
   S:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.2">
   S:        <statusSet:statusSet name="Auth Token Lock">
   S:          <statusSet:type>client</statusSet:type>
   S:          <statusSet:authTokenUsed>true</statusSet:authTokenUsed>
   S:          <statusSet:inherited>true</statusSet:inherited>
   S:          <statusSet:assigned>true</statusSet:assigned>
   S:          <statusSet:crDate>2026-05-03T09:00:00.0Z
   S:          </statusSet:crDate>
   S:          <statusSet:status>clientUpdateProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>clientDeleteProhibited
   S:          </statusSet:status>



Gould, et al.             Expires 6 March 2027                 [Page 13]

Internet-Draft          EPP Status Set Extension          September 2026


   S:          <statusSet:status>clientTransferProhibited
   S:          </statusSet:status>
   S:        </statusSet:statusSet>
   S:       <statusSet:statusSet name="Registrar Lock">
   S:          <statusSet:type>client</statusSet:type>
   S:          <statusSet:authTokenUsed>false</statusSet:authTokenUsed>
   S:          <statusSet:inherited>false</statusSet:inherited>
   S:          <statusSet:assigned>true</statusSet:assigned>
   S:          <statusSet:crDate>2026-05-03T09:00:00.0Z
   S:          </statusSet:crDate>
   S:          <statusSet:status>clientUpdateProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>clientDeleteProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>clientTransferProhibited
   S:          </statusSet:status>
   S:        </statusSet:statusSet>
   S:        <statusSet:statusSet name="Registry Lock">
   S:          <statusSet:type>server</statusSet:type>
   S:          <statusSet:authTokenUsed>false</statusSet:authTokenUsed>
   S:          <statusSet:inherited>false</statusSet:inherited>
   S:          <statusSet:assigned>true</statusSet:assigned>
   S:          <statusSet:crDate>2026-05-03T09:10:00.0Z
   S:          </statusSet:crDate>
   S:          <statusSet:status>serverUpdateProhibited
   S:          </statusSet:status>
   S:         <statusSet:status>serverDeleteProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>serverTransferProhibited
   S:          </statusSet:status>
   S:        </statusSet:statusSet>
   S:      </statusSet:infData>
   S:    </extension>
   S:    <trID>
   S:      <clTRID>ABC-12345</clTRID>
   S:     <svTRID>54322-XYZ</svTRID>
   S:    </trID>
   S:  </response>
   S:</epp>

        Figure 6: Domain Name Status Set Info Response Assigned Form

   Example Domain Name Status Set Info Response with the "all" form that
   includes the two assigned Client Status Sets ("Registrar Lock", "Auth
   Token Lock"), the two assigned Server Status Sets ("Registry Lock"
   and the reserved "REDACTED"), and the available Client Status Set
   ("Registrar Court Order Lock"):




Gould, et al.             Expires 6 March 2027                 [Page 14]

Internet-Draft          EPP Status Set Extension          September 2026


   S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
   S:  <response>
   S:    <result code="1000">
   S:      <msg>Command completed successfully</msg>
   S:    </result>
   S:    <resData>
   S:      <domain:infData
   S:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   S:        <domain:name>example.com</domain:name>
   S:        <domain:roid>EXAMPLE1-REP</domain:roid>
   S:        <domain:status s="clientUpdateProhibited">
   S:        Auth Token Lock,Registrar Lock
   S:        </domain:status>
   S:        <domain:status s="clientDeleteProhibited">
   S:        Auth Token Lock,Registrar Lock
   S:        </domain:status>
   S:        <domain:status s="clientTransferProhibited">
   S:        Auth Token Lock,Registrar Lock
   S:        </domain:status>
   S:        <domain:status s="serverUpdateProhibited">
   S:        Registry Lock
   S:        </domain:status>
   S:        <domain:status s="serverDeleteProhibited">
   S:        Registry Lock
   S:        </domain:status>
   S:        <domain:status s="serverTransferProhibited">
   S:        Registry Lock
   S:        </domain:status>
   S:        <domain:status s="serverHold">
   S:        REDACTED
   S:        </domain:status>
   S:        <domain:ns>
   S:          <domain:hostObj>ns1.example.com</domain:hostObj>
   S:          <domain:hostObj>ns1.example.net</domain:hostObj>
   S:        </domain:ns>
   S:        <domain:host>ns1.example.com</domain:host>
   S:        <domain:host>ns2.example.com</domain:host>
   S:       <domain:clID>ClientX</domain:clID>
   S:        <domain:crID>ClientY</domain:crID>
   S:        <domain:crDate>2000-04-03T22:00:00.0Z</domain:crDate>
   S:        <domain:upID>ClientX</domain:upID>
   S:        <domain:upDate>2026-05-03T09:10:00.0Z</domain:upDate>
   S:        <domain:exDate>2027-04-03T22:00:00.0Z</domain:exDate>
   S:        <domain:trDate>2022-04-08T09:00:00.0Z</domain:trDate>
   S:        <domain:authInfo>
   S:          <domain:pw>2fooBAR</domain:pw>
   S:        </domain:authInfo>



Gould, et al.             Expires 6 March 2027                 [Page 15]

Internet-Draft          EPP Status Set Extension          September 2026


   S:      </domain:infData>
   S:    </resData>
   S:    <extension>
   S:      <statusSet:infData
   S:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.2">
   S:        <statusSet:statusSet name="Auth Token Lock">
   S:          <statusSet:type>client</statusSet:type>
   S:          <statusSet:authTokenUsed>true</statusSet:authTokenUsed>
   S:          <statusSet:inherited>true</statusSet:inherited>
   S:          <statusSet:assigned>true</statusSet:assigned>
   S:          <statusSet:crDate>2026-05-03T09:00:00.0Z
   S:          </statusSet:crDate>
   S:          <statusSet:status>clientUpdateProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>clientDeleteProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>clientTransferProhibited
   S:          </statusSet:status>
   S:        </statusSet:statusSet>
   S:       <statusSet:statusSet name="Registrar Lock">
   S:          <statusSet:type>client</statusSet:type>
   S:          <statusSet:authTokenUsed>false</statusSet:authTokenUsed>
   S:          <statusSet:inherited>false</statusSet:inherited>
   S:          <statusSet:assigned>true</statusSet:assigned>
   S:          <statusSet:crDate>2026-05-03T09:00:00.0Z
   S:          </statusSet:crDate>
   S:          <statusSet:status>clientUpdateProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>clientDeleteProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>clientTransferProhibited
   S:          </statusSet:status>
   S:        </statusSet:statusSet>
   S:        <statusSet:statusSet name="Registry Lock">
   S:          <statusSet:type>server</statusSet:type>
   S:          <statusSet:authTokenUsed>false</statusSet:authTokenUsed>
   S:          <statusSet:inherited>false</statusSet:inherited>
   S:          <statusSet:assigned>true</statusSet:assigned>
   S:          <statusSet:crDate>2026-05-03T09:10:00.0Z
   S:          </statusSet:crDate>
   S:          <statusSet:status>serverUpdateProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>serverDeleteProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>serverTransferProhibited
   S:          </statusSet:status>
   S:       </statusSet:statusSet>
   S:        <statusSet:statusSet name="REDACTED">



Gould, et al.             Expires 6 March 2027                 [Page 16]

Internet-Draft          EPP Status Set Extension          September 2026


   S:          <statusSet:type>server</statusSet:type>
   S:          <statusSet:authTokenUsed>false</statusSet:authTokenUsed>
   S:          <statusSet:inherited>false</statusSet:inherited>
   S:          <statusSet:assigned>true</statusSet:assigned>
   S:          <statusSet:crDate>2026-05-01T10:11:00.0Z
   S:          </statusSet:crDate>
   S:          <statusSet:status>serverHold</statusSet:status>
   S:        </statusSet:statusSet>
   S:       <statusSet:statusSet name="For Sale">
   S:          <statusSet:type>client</statusSet:type>
   S:          <statusSet:authTokenUsed>false</statusSet:authTokenUsed>
   S:          <statusSet:inherited>false</statusSet:inherited>
   S:          <statusSet:assigned>false</statusSet:assigned>
   S:          <statusSet:attribute name="Currency"/>
   S:          <statusSet:attribute name="Price"/>
   S:        </statusSet:statusSet>
   S:       <statusSet:statusSet name="Registrar Court Order Lock">
   S:          <statusSet:type>client</statusSet:type>
   S:          <statusSet:authTokenUsed>false</statusSet:authTokenUsed>
   S:          <statusSet:inherited>false</statusSet:inherited>
   S:          <statusSet:assigned>false</statusSet:assigned>
   S:          <statusSet:status>clientUpdateProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>clientDeleteProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>clientTransferProhibited
   S:          </statusSet:status>
   S:          <statusSet:attribute name="Authority"/>
   S:          <statusSet:attribute name="Identifier"/>
   S:        </statusSet:statusSet>
   S:      </statusSet:infData>
   S:    </extension>
   S:    <trID>
   S:      <clTRID>ABC-12345</clTRID>
   S:      <svTRID>54322-XYZ</svTRID>
   S:    </trID>
   S:  </response>
   S:</epp>

          Figure 7: Domain Name Status Set Info Response All Form

   Example Host Status Set Info Response that includes an the inherited
   Client Status Set ("Auth Token Lock") from the parent domain name:








Gould, et al.             Expires 6 March 2027                 [Page 17]

Internet-Draft          EPP Status Set Extension          September 2026


   S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
   S:  <response>
   S:    <result code="1000">
   S:      <msg>Command completed successfully</msg>
   S:    </result>
   S:    <resData>
   S:      <host:infData
   S:       xmlns:host="urn:ietf:params:xml:ns:host-1.0">
   S:        <host:name>ns1.example.com</host:name>
   S:        <host:roid>NS1_EXAMPLE1-REP</host:roid>
   S:        <host:status s="ok"/>
   S:        <host:addr ip="v4">192.0.2.2</host:addr>
   S:        <host:addr ip="v4">192.0.2.29</host:addr>
   S:        <host:addr ip="v6">1080:0:0:0:8:800:200C:417A</host:addr>
   S:        <host:clID>ClientY</host:clID>
   S:        <host:crID>ClientX</host:crID>
   S:        <host:crDate>2000-04-03T22:00:00.0Z</host:crDate>
   S:        <host:upID>ClientX</host:upID>
   S:        <host:upDate>2026-05-03T09:00:00.0Z</host:upDate>
   S:        <host:trDate>2022-04-08T09:00:00.0Z</host:trDate>
   S:      </host:infData>
   S:    </resData>
   S:    <extension>
   S:      <statusSet:infData
   S:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.2">
   S:        <statusSet:statusSet name="Auth Token Lock">
   S:          <statusSet:type>client</statusSet:type>
   S:          <statusSet:authTokenUsed>true</statusSet:authTokenUsed>
   S:          <statusSet:inherited>true</statusSet:inherited>
   S:          <statusSet:assigned>false</statusSet:assigned>
   S:          <statusSet:crDate>2026-05-03T09:00:00.0Z
   S:          </statusSet:crDate>
   S:          <statusSet:status>clientUpdateProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>clientDeleteProhibited
   S:          </statusSet:status>
   S:          <statusSet:status>clientTransferProhibited
   S:          </statusSet:status>
   S:        </statusSet:statusSet>
   S:      </statusSet:infData>
   S:    </extension>
   S:    <trID>
   S:      <clTRID>ABC-12345</clTRID>
   S:      <svTRID>54322-XYZ</svTRID>
   S:    </trID>
   S:  </response>
   S:</epp>



Gould, et al.             Expires 6 March 2027                 [Page 18]

Internet-Draft          EPP Status Set Extension          September 2026


        Figure 8: Host Name Status Set Info Response with Inherited
                                 Status Set

3.1.3.  EPP <transfer> Command

   This extension does not add any elements to the EPP <transfer> query
   command or <transfer> query response.

3.2.  EPP Transform Commands

   This document defines a new EPP Status Set Command for each of the
   EPP Transform Commands, defined in [RFC5730], to enable the
   provisioning of the Client Status Sets in the <create> and <update>
   commands and the overriding of the Client Status Sets with the
   passing of one or more Authentication Tokens in each of the EPP
   Status Set Transform Commands.  An example is the definition of the
   EPP Domain Status Set Update Command in Section 3.2.5 extending the
   domain name <update> command in [RFC5731].

3.2.1.  EPP <create> Command

   A new Status Set Create Command by extending the EPP <create> command
   to create an EPP object, such as the domain name in [RFC5731] or a
   host in [RFC5732], with a list of Status Sets (Section 2.2) that will
   be assigned initially.  In addition to the EPP command elements
   described in the EPP <create> command, the command MAY contain an
   <extension> element.  The <extension> element MUST contain a child
   <statusSet:create> element that contains the following child
   elements:

   *  An OPTIONAL list of <statusSet:authToken> elements, defined in
      Section 2.3, that supports authorizing the assigning of the Status
      Sets in support of M-of-N authorization, defined in Section 2.4.

   *  An OPTIONAL list of zero or more <statusSet:statusSet> elements to
      set.  The <statusSet:statusSet> element includes the unique name
      of the Status Set in the REQUIRED "name" attribute and contains
      the following child elements:

      -  An OPTIONAL <statusSet:reason> element that indicates the free-
         form text reason that Status Set is assigned to the object.

      -  An OPTIONAL list of zero or more <statusSet:attribute>
         elements, with the attribute name set in the REQUIRED "name"
         attribute, and the attribute value set in the value of the
         element.





Gould, et al.             Expires 6 March 2027                 [Page 19]

Internet-Draft          EPP Status Set Extension          September 2026


   Example Domain Name Status Set Create Command that sets the
   "Registrar Lock" Status Set:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
   C:  <command>
   C:    <create>
   C:      <domain:create
   C:      xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>example.com</domain:name>
   C:        <domain:period unit="y">2</domain:period>
   C:        <domain:ns>
   C:          <domain:hostObj>ns1.example.net</domain:hostObj>
   C:          <domain:hostObj>ns2.example.net</domain:hostObj>
   C:        </domain:ns>
   C:        <domain:authInfo>
   C:          <domain:pw>2fooBAR</domain:pw>
   C:        </domain:authInfo>
   C:      </domain:create>
   C:    </create>
   C:    <extension>
   C:      <statusSet:create
   C:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.2">
   C:        <statusSet:statusSet name="Registrar Lock">
   C:          <statusSet:reason>Customer request</statusSet:reason>
   C:        </statusSet:statusSet>
   C:      </statusSet:create>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

      Figure 9: Domain Name Status Set Create Command with Status Set

   Example Domain Name Status Set Create Command that sets the
   "Registrar Lock" Status Set and the "Auth Token Lock", which includes
   2 Authentication Tokens to meet an M value of 2, in M-of-N:














Gould, et al.             Expires 6 March 2027                 [Page 20]

Internet-Draft          EPP Status Set Extension          September 2026


   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
   C:  <command>
   C:    <create>
   C:      <domain:create
   C:      xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>example.com</domain:name>
   C:        <domain:period unit="y">2</domain:period>
   C:        <domain:ns>
   C:          <domain:hostObj>ns1.example.net</domain:hostObj>
   C:          <domain:hostObj>ns2.example.net</domain:hostObj>
   C:        </domain:ns>
   C:        <domain:authInfo>
   C:          <domain:pw>2fooBAR</domain:pw>
   C:        </domain:authInfo>
   C:      </domain:create>
   C:    </create>
   C:    <extension>
   C:      <statusSet:create
   C:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.2">
   C:        <statusSet:authToken>
   C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN
   C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW
   C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL
   C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl
   C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y
   C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z
   C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF
   C:        </statusSet:authToken>
   C:        <statusSet:authToken>
   C:eyJ0eXAiOiJKV1QiLA0KICabcJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJ
   C:leHAiOjEzMDAabc4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp
   C:0cnVlfQ.dBjftJeZ4CVP-mB92K27abcuhbUJU1p1r_wW1gFWFOEjXk
   C:        </statusSet:authToken>
   C:        <statusSet:statusSet>Registrar Lock</statusSet:statusSet>
   C:        <statusSet:statusSet>Auth Token Lock</statusSet:statusSet>
   C:      </statusSet:create>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

           Figure 10: Domain Name Status Set Create Command with
                           Authentication Tokens

   Example Host Status Set Create Command that includes an
   Authentication Token to authorize the create of a child host of a
   locked parent domain name:



Gould, et al.             Expires 6 March 2027                 [Page 21]

Internet-Draft          EPP Status Set Extension          September 2026


   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
   C:  <command>
   C:    <create>
   C:      <host:create
   C:       xmlns:host="urn:ietf:params:xml:ns:host-1.0">
   C:        <host:name>ns1.example.com</host:name>
   C:        <host:addr ip="v4">192.0.2.2</host:addr>
   C:        <host:addr ip="v4">192.0.2.29</host:addr>
   C:        <host:addr ip="v6">1080:0:0:0:8:800:200C:417A</host:addr>
   C:      </host:create>
   C:    </create>
   C:    <extension>
   C:      <statusSet:create
   C:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.2">
   C:        <statusSet:authToken>
   C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN
   C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW
   C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL
   C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl
   C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y
   C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z
   C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF
   C:        </statusSet:authToken>
   C:      </statusSet:create>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

    Figure 11: Host Status Set Create Command with Authentication Token

   This extension does not define any extension to the response of a
   <create> command.  After processing the command, the server replies
   with a standard EPP response as defined in the EPP object mapping,
   such as defined in Section 3.2.1 of [RFC5731].

3.2.2.  EPP <delete> Command

   A new Status Set Delete Command by extending the EPP <delete> command
   to delete an EPP object that is authorized by applying the
   Authentication Tokens and their authorization groups, defined in
   Section 2.3, to override the assigned Client Status Sets that uses
   Authentication Tokens.  In addition to the EPP command elements
   described in the EPP <delete> command, the command MAY contain an
   <extension> element.  The <extension> element MUST contain a child
   <statusSet:delete> element that contains the following child
   elements:



Gould, et al.             Expires 6 March 2027                 [Page 22]

Internet-Draft          EPP Status Set Extension          September 2026


   *  One or more <statusSet:authToken> elements, defined in
      Section 2.3, that authorizes the overriding of the Client Status
      Sets in support of M-of-N authorization, defined in Section 2.4.

   Example Domain Name Status Set Delete Command that includes a single
   Authentication Token (M = 1 with M-of-N authorization) to authorize
   the delete:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
   C:  <command>
   C:    <delete>
   C:      <domain:delete
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>example.com</domain:name>
   C:      </domain:delete>
   C:    </delete>
   C:    <extension>
   C:      <statusSet:delete
   C:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.2">
   C:        <statusSet:authToken>
   C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN
   C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW
   C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL
   C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl
   C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y
   C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z
   C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF
   C:        </statusSet:authToken>
   C:      </statusSet:delete>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

              Figure 12: Domain Name Status Set Delete Command

   This extension does not define any extension to the response of an
   <delete> command.  After processing the command, the server replies
   with a standard EPP response as defined in the EPP object mapping,
   such as defined in Section 3.2.2 of [RFC5731].










Gould, et al.             Expires 6 March 2027                 [Page 23]

Internet-Draft          EPP Status Set Extension          September 2026


3.2.3.  EPP <renew> Command

   A new Status Set Renew Command by extending the EPP <renew> command
   to renew an EPP object that is authorized by applying the
   Authentication Tokens and their authorization groups, defined in
   Section 2.3, to override the assigned Client Status Sets that uses
   Authentication Tokens.  In addition to the EPP command elements
   described in the EPP <renew> command, the command MAY contain an
   <extension> element.  The <extension> element MUST contain a child
   <statusSet:renew> element that contains the following child elements:

   *  One or more <statusSet:authToken> elements, defined in
      Section 2.3, that authorizes the overriding of the Client Status
      Sets in support of M-of-N authorization, defined in Section 2.4.

   Example Domain Name Status Set Renew Command that includes a single
   Authentication Token (M = 1 with M-of-N authorization) to authorize
   the renew:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
   C:  <command>
   C:    <renew>
   C:      <domain:renew
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>example.com</domain:name>
   C:        <domain:curExpDate>2026-04-03</domain:curExpDate>
   C:        <domain:period unit="y">5</domain:period>
   C:      </domain:renew>
   C:    </renew>
   C:    <extension>
   C:      <statusSet:renew
   C:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.2">
   C:        <statusSet:authToken>
   C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN
   C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW
   C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL
   C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl
   C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y
   C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z
   C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF
   C:        </statusSet:authToken>
   C:     </statusSet:renew>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>




Gould, et al.             Expires 6 March 2027                 [Page 24]

Internet-Draft          EPP Status Set Extension          September 2026


              Figure 13: Domain Name Status Set Renew Command

   This extension does not define any extension to the response of an
   <renew> command.  After processing the command, the server replies
   with a standard EPP response as defined in the EPP object mapping,
   such as defined in Section 3.2.3 of [RFC5731].

3.2.4.  EPP <transfer> Command

   A new Status Set Transfer Command by extending the EPP <transfer>
   command to transfer an EPP object that is authorized by applying the
   Authentication Tokens and their authorization groups, defined in
   Section 2.3, to override the assigned Client Status Sets that uses
   Authentication Tokens.  In addition to the EPP command elements
   described in the EPP <transfer> command, the command MAY contain an
   <extension> element.  The <extension> element MUST contain a child
   <statusSet:transfer> element that contains the following child
   elements:

   *  One or more <statusSet:authToken> elements, defined in
      Section 2.3, that authorizes the overriding of the Client Status
      Sets in support of M-of-N authorization, defined in Section 2.4.

   Example Domain Name Status Set Transfer Command that includes a
   single Authentication Token (M = 1 with M-of-N authorization) to
   authorize the transfer:

























Gould, et al.             Expires 6 March 2027                 [Page 25]

Internet-Draft          EPP Status Set Extension          September 2026


   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
   C:  <command>
   C:    <transfer op="request">
   C:      <domain:transfer
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>example.com</domain:name>
   C:        <domain:period unit="y">1</domain:period>
   C:        <domain:authInfo>
   C:          <domain:pw roid="JD1234-REP">2fooBAR</domain:pw>
   C:        </domain:authInfo>
   C:      </domain:transfer>
   C:    </transfer>
   C:    <extension>
   C:      <statusSet:transfer
   C:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.2">
   C:        <statusSet:authToken>
   C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN
   C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW
   C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL
   C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl
   C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y
   C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z
   C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF
   C:        </statusSet:authToken>
   C:      </statusSet:transfer>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

             Figure 14: Domain Name Status Set Transfer Command

   This extension does not define any extension to the response of an
   <transfer> command.  After processing the command, the server replies
   with a standard EPP response as defined in the EPP object mapping,
   such as defined in Section 3.2.4 of [RFC5731].

3.2.5.  EPP <update> Command

   A new Status Set Update Command by extending the EPP <update> command
   to transfer an EPP object that is authorized by applying the
   Authentication Tokens and their authorization groups, defined in
   Section 2.3, to override the assigned Client Status Sets that uses
   Authentication Tokens.  In addition to the EPP command elements
   described in the EPP <update> command, the command MAY contain an
   <extension> element.  The <extension> element MUST contain a child
   <statusSet:update> element that contains the following child



Gould, et al.             Expires 6 March 2027                 [Page 26]

Internet-Draft          EPP Status Set Extension          September 2026


   elements:

   *  An OPTIONAL list of <statusSet:authToken> elements, defined in
      Section 2.3, that authorizes the overriding of the Client Status
      Sets in support of M-of-N authorization, defined in Section 2.4.

   *  An OPTIONAL <statusSet:add> element that includes zero or more
      <statusSet:statusSet> elements that includes the unique name of
      the Status Set in the REQUIRED "name" attribute to add to the EPP
      object.  The <statusSet:statusSet> element contains the following
      child elements:

      -  An OPTIONAL <statusSet:reason> element that indicates the free-
         form text reason that Status Set is assigned to the object.

      -  An OPTIONAL list of zero or more <statusSet:attribute>
         elements, with the attribute name set in the REQUIRED "name"
         attribute, and the attribute value set in the value of the
         element.

   *  An OPTIONAL <statusSet:rem> element that includes zero or more
      <statusSet:statusSet> elements that includes the unique name of
      the Status Set in the REQUIRED "name" attribute to remove from the
      EPP object.  The Status Set removes MUST be processed prior to the
      adds.

   *  An OPTIONAL <statusSet:chg> element that includes zero or more
      <statusSet:statusSet> elements that includes the unique name of
      the Status Set in the REQUIRED "name" attribute to change the list
      of set Status Set attributes.  Existing Status Set attributes not
      specified will be removed from the Status Set, and Status Set
      attributes specified will be set.  The <statusSet:statusSet>
      element contains the following child elements:

      -  An OPTIONAL <statusSet:reason> element that indicates the free-
         form text reason that Status Set is assigned to the object.

      -  An OPTIONAL list of zero or more <statusSet:attribute>
         elements, with the attribute name set in the REQUIRED "name"
         attribute, and the attribute value set in the value of the
         element.

   Example Domain Name Status Set Update Command that includes a single
   Authentication Token (M = 1 with M-of-N authorization) to authorize
   the update:






Gould, et al.             Expires 6 March 2027                 [Page 27]

Internet-Draft          EPP Status Set Extension          September 2026


   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   C:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
   C:     epp-1.0.xsd">
   C:  <command>
   C:    <update>
   C:      <domain:update
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
   C:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
   C:       domain-1.0.xsd">
   C:        <domain:name>example.com</domain:name>
   C:        <domain:add>
   C:          <domain:ns>
   C:            <domain:hostObj>ns2.example.com</domain:hostObj>
   C:          </domain:ns>
   C:        </domain:add>
   C:        <domain:rem>
   C:          <domain:ns>
   C:            <domain:hostObj>ns1.example.com</domain:hostObj>
   C:          </domain:ns>
   C:        </domain:rem>
   C:      </domain:update>
   C:    </update>
   C:    <extension>
   C:      <statusSet:update
   C:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.2">
   C:        <statusSet:authToken>
   C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN
   C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW
   C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL
   C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl
   C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y
   C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z
   C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF
   C:        </statusSet:authToken>
   C:      </statusSet:update>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

           Figure 15: Domain Name Status Set Update Command with
                            Authentication Token

   Example Domain Name Status Set Update Command that includes a two
   Authentication Tokens (M = 2 with M-of-N authorization) to authorize
   the update:



Gould, et al.             Expires 6 March 2027                 [Page 28]

Internet-Draft          EPP Status Set Extension          September 2026


   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   C:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
   C:     epp-1.0.xsd">
   C:  <command>
   C:    <update>
   C:      <domain:update
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
   C:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
   C:       domain-1.0.xsd">
   C:        <domain:name>example.com</domain:name>
   C:        <domain:add>
   C:          <domain:ns>
   C:            <domain:hostObj>ns2.example.com</domain:hostObj>
   C:          </domain:ns>
   C:        </domain:add>
   C:        <domain:rem>
   C:          <domain:ns>
   C:            <domain:hostObj>ns1.example.com</domain:hostObj>
   C:          </domain:ns>
   C:        </domain:rem>
   C:      </domain:update>
   C:    </update>
   C:    <extension>
   C:      <statusSet:update
   C:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.2">
   C:        <statusSet:authToken>
   C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN
   C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW
   C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL
   C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl
   C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y
   C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z
   C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF
   C:        </statusSet:authToken>
   C:        <statusSet:authToken>
   C:eyJ0eXAiOiJKV1QiLA0KICabcJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJ
   C:leHAiOjEzMDAabc4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp
   C:0cnVlfQ.dBjftJeZ4CVP-mB92K27abcuhbUJU1p1r_wW1gFWFOEjXk
   C:        </statusSet:authToken>
   C:       </statusSet:update>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>





Gould, et al.             Expires 6 March 2027                 [Page 29]

Internet-Draft          EPP Status Set Extension          September 2026


           Figure 16: Domain Name Status Set Update Command with
                           Authentication Tokens

   Example Domain Name Status Set Update Command that includes a single
   Authentication Token (M = 1 with M-of-N authorization) to authorize
   removing the "Auth Token Lock" Status Set and adding the "Auth Token
   Lock - Transfer Allowed" Status Set, which removes the
   "clientTransferProhibited" Status Value from the domain name and
   keeps the "clientUpdateProhibited" and "clientDeleteProhibited"
   Status Values:









































Gould, et al.             Expires 6 March 2027                 [Page 30]

Internet-Draft          EPP Status Set Extension          September 2026


   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   C:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
   C:     epp-1.0.xsd">
   C:  <command>
   C:    <update>
   C:      <domain:update
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
   C:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
   C:       domain-1.0.xsd">
   C:        <domain:name>example.com</domain:name>
   C:        <domain:chg/>
   C:      </domain:update>
   C:    </update>
   C:    <extension>
   C:      <statusSet:update
   C:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.2">
   C:        <statusSet:authToken>
   C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN
   C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW
   C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL
   C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl
   C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y
   C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z
   C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF
   C:        </statusSet:authToken>
   C:        <statusSet:add>
   C:          <statusSet:statusSet
   C:            name="Auth Token Lock - Transfer Allowed"/>
   C:        </statusSet:add>
   C:        <statusSet:rem>
   C:          <statusSet:statusSet name="Auth Token Lock"/>
   C:        </statusSet:rem>
   C:      </statusSet:update>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

      Figure 17: Domain Name Status Set Update Command with Replacing
                                Status Sets

   Example Domain Name Status Set Update Command that adds, removes, and
   changes a status set.  The "For Sale" Status Set is added with a
   "Currency" and "Price" attribute, the "Registrar Lock" Status Set is
   removed, and the "Registrar Lock" Status Set is changed to set the
   "Authority" and "Identifier" attributes.



Gould, et al.             Expires 6 March 2027                 [Page 31]

Internet-Draft          EPP Status Set Extension          September 2026


   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   C:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
   C:     epp-1.0.xsd">
   C:  <command>
   C:    <update>
   C:      <domain:update
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
   C:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
   C:       domain-1.0.xsd">
   C:        <domain:name>example.com</domain:name>
   C:        <domain:chg/>
   C:      </domain:update>
   C:    </update>
   C:    <extension>
   C:      <statusSet:update
   C:        xmlns:statusSet="urn:ietf:params:xml:ns:epp:statusSet-0.2">
   C:        <statusSet:add>
   C:          <statusSet:statusSet name="For Sale">
   C:            <statusSet:attribute name="Currency">USD
   C:            </statusSet:attribute>
   C:            <statusSet:attribute name="Price">100.00
   C:            </statusSet:attribute>
   C:          </statusSet:statusSet>
   C:        </statusSet:add>
   C:        <statusSet:rem>
   C:          <statusSet:statusSet name="Registrar Lock"/>
   C:        </statusSet:rem>
   C:        <statusSet:chg>
   C:          <statusSet:statusSet name="Registrar Court Order Lock">
   C:            <statusSet:attribute name="Authority">US
   C:            </statusSet:attribute>
   C:            <statusSet:attribute name="Identifier">US-12345
   C:            </statusSet:attribute>
   C:          </statusSet:statusSet>
   C:        </statusSet:chg>
   C:      </statusSet:update>
   C:   </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

       Figure 18: Domain Name Status Set Update Command with Adding,
                     Removing, and Changing Status Sets






Gould, et al.             Expires 6 March 2027                 [Page 32]

Internet-Draft          EPP Status Set Extension          September 2026


   This extension does not define any extension to the response of an
   <update> command.  After processing the command, the server replies
   with a standard EPP response as defined in the EPP object mapping,
   such as defined in Section 3.2.4 of [RFC5731].

4.  Formal Syntax

   An EPP object mapping is specified in XML Schema notation.  The
   formal syntax presented here is a complete schema representation of
   the object mapping suitable for automated validation of EPP XML
   instances.  The BEGIN and END tags are not part of the schema; they
   are used to note the beginning and ending of the schema for URI
   registration purposes.

   BEGIN
   <?xml version="1.0" encoding="UTF-8"?>
   <schema
     targetNamespace=
       "urn:ietf:params:xml:ns:epp:statusSet-0.2"
     xmlns:statusSet=
       "urn:ietf:params:xml:ns:epp:statusSet-0.2"
     xmlns:authToken=
       "urn:ietf:params:xml:ns:epp:authToken-0.1"
     xmlns="http://www.w3.org/2001/XMLSchema"
     elementFormDefault="qualified">

     <annotation>
       <documentation>
         Extensible Provisioning Protocol v1.0
         Status Set Extension.
       </documentation>
     </annotation>

     <import namespace="urn:ietf:params:xml:ns:epp:authToken-0.1"/>

     <!-- status set info command element -->
     <element name="info" type="statusSet:infoType"/>

     <complexType name="infoType">
       <sequence>
         <element name="authToken" type="authToken:authTokenType"
         minOccurs="0" maxOccurs="unbounded"/>
       </sequence>
       <attribute name="sets"
         type="statusSet:setsEnum" default="assigned"/>
     </complexType>

     <simpleType name="setsEnum">



Gould, et al.             Expires 6 March 2027                 [Page 33]

Internet-Draft          EPP Status Set Extension          September 2026


       <restriction base="token">
         <enumeration value="assigned"/>
         <enumeration value="all"/>
       </restriction>
     </simpleType>


     <!-- status set info response element -->
     <element name="infData" type="statusSet:infDataType"/>

     <complexType name="infDataType">
       <sequence>
         <element name="statusSet"
           type="statusSet:statusSetDataType"
           minOccurs="0" maxOccurs="unbounded"/>
       </sequence>
     </complexType>

     <complexType name="statusSetType">
       <sequence>
         <element name="reason" type="token"
           minOccurs="0"/>
         <element name="attribute" type="statusSet:attributeType"
           minOccurs="0" maxOccurs="unbounded"/>
       </sequence>
       <attribute name="name" type="token"/>
     </complexType>

     <complexType name="statusSetDataType">
       <sequence>
         <element name="type"
           type="statusSet:statusSetTypeEnum"/>
         <element name="authTokenUsed"
           type="statusSet:authTokenUsedType"
           minOccurs="0" default="false"/>
         <element name="inherited" type="boolean"
           minOccurs="0" default="false"/>
         <element name="assigned" type="boolean"
           minOccurs="0" default="true"/>
         <element name="crDate" type="dateTime"
           minOccurs="0"/>
         <element name="status" type="token"
           minOccurs="0" maxOccurs="unbounded"/>
         <element name="reason" type="token"
           minOccurs="0"/>
         <element name="attribute" type="statusSet:attributeType"
           minOccurs="0" maxOccurs="unbounded"/>
       </sequence>



Gould, et al.             Expires 6 March 2027                 [Page 34]

Internet-Draft          EPP Status Set Extension          September 2026


       <attribute name="name" type="token"/>
     </complexType>

     <complexType name="authTokenUsedType">
       <simpleContent>
         <extension base="boolean">
           <attribute name="num"
           type="int" default="1"/>
         </extension>
       </simpleContent>
     </complexType>

     <complexType name="attributeType">
       <simpleContent>
         <extension base="token">
           <attribute name="name" type="token"/>
         </extension>
       </simpleContent>
     </complexType>

     <simpleType name="statusSetTypeEnum">
       <restriction base="token">
         <enumeration value="client"/>
         <enumeration value="server"/>
       </restriction>
     </simpleType>


    <complexType name="authTokenListType">
       <sequence>
         <element name="authToken" type="authToken:authTokenType"
         minOccurs="1" maxOccurs="unbounded"/>
       </sequence>
     </complexType>

     <!-- status set create command element -->
     <element name="create" type="statusSet:createType"/>

     <complexType name="createType">
       <sequence>
         <element name="authToken" type="authToken:authTokenType"
         minOccurs="0" maxOccurs="unbounded"/>
         <element name="statusSet" type="statusSet:statusSetType"
         minOccurs="0" maxOccurs="unbounded"/>
       </sequence>
     </complexType>

     <!-- status set delete command element -->



Gould, et al.             Expires 6 March 2027                 [Page 35]

Internet-Draft          EPP Status Set Extension          September 2026


     <element name="delete" type="statusSet:authTokenListType"/>

     <!-- status set renew command element -->
     <element name="renew" type="statusSet:authTokenListType"/>

     <!-- status set transfer command element -->
     <element name="transfer" type="statusSet:authTokenListType"/>

     <!-- status set update command element -->
     <element name="update" type="statusSet:updateType"/>

     <complexType name="updateType">
       <sequence>
         <element name="authToken" type="authToken:authTokenType"
          minOccurs="0" maxOccurs="unbounded"/>
         <element name="add" type="statusSet:statusSetListType"
          minOccurs="0"/>
         <element name="rem" type="statusSet:statusSetListType"
          minOccurs="0"/>
         <element name="chg" type="statusSet:statusSetListType"
          minOccurs="0"/>
       </sequence>
     </complexType>

     <complexType name="statusSetListType">
       <sequence>
         <element name="statusSet" type="statusSet:statusSetType"
          minOccurs="0" maxOccurs="unbounded"/>
       </sequence>
     </complexType>

   </schema>
   END

5.  IANA Considerations

5.1.  XML Namespace

   This document uses URNs to describe XML namespaces and XML schemas
   conforming to a registry mechanism described in [RFC3688].  The
   following URI assignment has been made by IANA:

   Registration request for the Status Set Extension Mapping namespace:

   URI:  urn:ietf:params:xml:ns:epp:statusSet-0.2
   Registrant Contact:  Registrant Contact: IESG
   XML:  None.  Namespace URIs do not represent an XML specification.




Gould, et al.             Expires 6 March 2027                 [Page 36]

Internet-Draft          EPP Status Set Extension          September 2026


   Registration request for the Status Set Extension Mapping XML Schema:

   URI:  urn:ietf:params:xml:schema:epp:statusSet-0.2
   Registrant Contact:  Registrant Contact: IESG
   XML:  See the "Formal Syntax" section of this document.

5.2.  EPP Extension Registry

   The EPP extension described in this document has been registered by
   IANA in the "Extensions for the Extensible Provisioning Protocol
   (EPP)" registry described in [RFC7451].  The details of the
   registration are as follows:

   Name of Extension:  "Status Set Extension Mapping for the Extensible
      Provisioning Protocol"
   Document Status:  Standards Track
   Reference:  (insert reference to RFC version of this document)
   Registrant Name and Email Address:  IESG, <iesg@ietf.org>
   TLDs:  Any
   IPR Disclosure:  None
   Status:  Active
   Notes:  None

6.  Security Considerations

   The mapping extensions described in this document extends the
   security services described by EPP [RFC5730] and protocol layers used
   by EPP by using an Authentication Token, in
   [I-D.gould-regext-auth-token], that is passed on top of EPP for
   registrar users to perform more fine grained authorization in the
   form of overriding a Client Status Set.

   The security considerations for the server include:

   1.  The Server Status Sets and the associated Server Status Values
       can only be managed by the server.  The server MUST NOT allow the
       client to set, unset, or override a Server Status Set.

   2.  The authorization model for a server operation is driven by the
       mapping of the Status Values to the asasigned Status Sets.  The
       server applies the Authentication Token, in
       [I-D.gould-regext-auth-token], by matching the operation, the
       entitlements in the Authentication Token, and the assigned Client
       Status Sets to determine which Client Status Sets are overriden
       to authorize the execution of the operation.






Gould, et al.             Expires 6 March 2027                 [Page 37]

Internet-Draft          EPP Status Set Extension          September 2026


   3.  Applying the inherited Client Staus Sets to the child objects
       (child host for parent domain name) MAY be enforced by the server
       business logic without having to directly change the child
       objects.  There can be an unlimited number of child objects, so
       there is a resource consumption issue associated with cascading
       inherited Status Sets directly to the child objects.

   4.  Implementing the M-of-N authorization performs a intersection of
       the "entitlements" in the Authentication Tokens, in
       [I-D.gould-regext-auth-token], when authorizing a Status Set
       Command.

   The security considerations for the client include:

   1.  There are no additional client security considerations other than
       what's defined for the Authentication Token in
       [I-D.gould-regext-auth-token].

7.  References

7.1.  Normative References

   [BCP14]    Best Current Practice 14,
              <https://www.rfc-editor.org/info/bcp14>.
              At the time of writing, this BCP comprises the following:

              Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119,
              DOI 10.17487/RFC2119, March 1997,
              <https://www.rfc-editor.org/info/rfc2119>.

              Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
              2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
              May 2017, <https://www.rfc-editor.org/info/rfc8174>.

   [I-D.gould-regext-auth-token]
              Gould, J., Garg, 8. 7. 7. 7. 6. 7. 3. 7. 6. 8., and M. S.
              M. Khader, "Extensible Provisioning Protocol (EPP)
              Authentication Token Mapping", Work in Progress, Internet-
              Draft, draft-gould-regext-auth-token-00, 20 July 2026,
              <https://datatracker.ietf.org/doc/html/draft-gould-regext-
              auth-token-00>.

   [RFC3688]  Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688,
              DOI 10.17487/RFC3688, January 2004,
              <https://www.rfc-editor.org/info/rfc3688>.





Gould, et al.             Expires 6 March 2027                 [Page 38]

Internet-Draft          EPP Status Set Extension          September 2026


   [RFC3915]  Hollenbeck, S., "Domain Registry Grace Period Mapping for
              the Extensible Provisioning Protocol (EPP)", RFC 3915,
              DOI 10.17487/RFC3915, October 2004,
              <https://www.rfc-editor.org/info/rfc3915>.

   [RFC5730]  Hollenbeck, S., "Extensible Provisioning Protocol (EPP)",
              STD 69, RFC 5730, DOI 10.17487/RFC5730, August 2009,
              <https://www.rfc-editor.org/info/rfc5730>.

   [RFC5731]  Hollenbeck, S., "Extensible Provisioning Protocol (EPP)
              Domain Name Mapping", STD 69, RFC 5731,
              DOI 10.17487/RFC5731, August 2009,
              <https://www.rfc-editor.org/info/rfc5731>.

   [RFC5732]  Hollenbeck, S., "Extensible Provisioning Protocol (EPP)
              Host Mapping", STD 69, RFC 5732, DOI 10.17487/RFC5732,
              August 2009, <https://www.rfc-editor.org/info/rfc5732>.

   [RFC7515]  Jones, M., Bradley, J., and N. Sakimura, "JSON Web
              Signature (JWS)", RFC 7515, DOI 10.17487/RFC7515, May
              2015, <https://www.rfc-editor.org/info/rfc7515>.

   [RFC8499]  Hoffman, P., Sullivan, A., and K. Fujiwara, "DNS
              Terminology", RFC 8499, DOI 10.17487/RFC8499, January
              2019, <https://www.rfc-editor.org/info/rfc8499>.

   [W3C.REC-xml-20040204]
              Bray, T., Paoli, J., Sperberg-McQueen, C., Maler, E., and
              F. Yergeau, ""Extensible Markup Language (XML) 1.0 (Third
              Edition)", World Wide Web Consortium FirstEdition REC-xml-
              20040204", February 2004,
              <http://www.w3.org/TR/2004/REC-xml-20040204>.

   [W3C.REC-xmlschema-1-20041028]
              Thompson, H., Beech, D., Maloney, M., and N. Mendelsohn,
              ""XML Schema Part 1: Structures Second Edition", World
              Wide Web Consortium Recommendation REC-xmlschema-
              1-20041028", October 2004,
              <http://www.w3.org/TR/2004/REC-xmlschema-1-20041028>.

   [W3C.REC-xmlschema-2-20041028]
              Biron, P. and A. Malhotra, ""XML Schema Part 2: Datatypes
              Second Edition", World Wide Web Consortium Recommendation
              REC-xmlschema-2-20041028", October 2004,
              <http://www.w3.org/TR/2004/REC-xmlschema-2-20041028>.

7.2.  Informative References




Gould, et al.             Expires 6 March 2027                 [Page 39]

Internet-Draft          EPP Status Set Extension          September 2026


   [RFC7451]  Hollenbeck, S., "Extension Registry for the Extensible
              Provisioning Protocol", RFC 7451, DOI 10.17487/RFC7451,
              February 2015, <https://www.rfc-editor.org/info/rfc7451>.

Appendix A.  Change History

A.1.  Change from 00 to 01

   1.  Added normative reference to draft-gould-regext-auth-token.

A.2.  Change from 01 to 02

   1.  Added reference to the authToken XML schema from the statusSet
       XML schema via an import and use of the authToken:authTokenType.

A.3.  Change from 02 to 03

   1.  Fixed "freefrom" to "free-form" in the description of the
       <statusSet:reason> element.
   2.  Corrected the description of the <statusSet:infData> element,
       which contains an OPTIONAL list of zero or more
       <statusSet:statusSet> child elements.
   3.  Made the inclusion of a status set in the extension of the create
       optional.  For the create of child hosts of a protected parent
       domain name, an authentication token may be required without
       inclusion of a status set.

A.4.  Change from 03 to 04

   1.  Added support for status set attributes, which required changing
       the status set from a simple type ot a complex type, and
       therefore the XML namespace URI needed to be bumped to
       "statusSet-0.2".
   2.  Added support for setting the status set reason in the create and
       update commands.
   3.  Added figure titles to each of the examples.

Authors' Addresses

   James Gould
   VeriSign, Inc.
   12061 Bluemont Way
   Reston, VA 20190
   United States of America
   Email: jgould@verisign.com
   URI:   http://www.verisign.com





Gould, et al.             Expires 6 March 2027                 [Page 40]

Internet-Draft          EPP Status Set Extension          September 2026


   Poonam Garg
   VeriSign, Inc.
   12061 Bluemont Way
   Reston, VA 20190
   United States of America
   Email: pogarg@verisign.com
   URI:   http://www.verisign.com


   Mohammad Suhale Malang Khader
   VeriSign, Inc.
   12061 Bluemont Way
   Reston, VA 20190
   United States of America
   Email: mmalangkhader@verisign.com
   URI:   http://www.verisign.com



































Gould, et al.             Expires 6 March 2027                 [Page 41]
