@For OAuth it is also questionable the extent to which its use should be dictated. For instance in CloudEvents "modeling the security layer" is only facilitated by the protocol spec, another extensibility point.
@smallcircles🫧 socialcoding.. 
@julian I think we might have different ideas about what the ActivityPub API task force is for.
To me, it's about making it possible for clients to use different servers, and different implementations of the API. That's going to include the social API defined in the ActivityPub standard, but it will also encompass things like rate limits, authentication, caching, CORS, and so on.
How that all gets documented will probably be in one or more community group reports.
If you have a fediverse account, you can quote this note from your own instance. Search https://cosocial.ca/users/evan/statuses/116275021300962889 on your instance and quote it. (Note that quoting is not supported in Mastodon.)