QUIC R. Marx, Ed. Internet-Draft Akamai Intended status: Standards Track L. Niccolini, Ed. Expires: 6 May 2027 Meta M. Seemann, Ed. L. Pardue, Ed. Apple 2 November 2026 HTTP/3 qlog event definitions draft-ietf-quic-qlog-h3-events-14 Abstract This document defines qlog event schemas containing concrete events for the core HTTP/3 protocol and selected extensions. It also defines an http namespace for the Capsule Protocol. Note to Readers Note to RFC editor: Please remove this section before publication. Feedback and discussion are welcome at https://github.com/quicwg/qlog (https://github.com/quicwg/qlog). Readers are advised to refer to the "editor's draft" at that URL for an up-to-date version of this document. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 6 May 2027. Marx, et al. Expires 6 May 2027 [Page 1] Internet-Draft HTTP/3 qlog event definitions November 2026 Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 1.1. Usage with QUIC . . . . . . . . . . . . . . . . . . . . . 4 1.2. Notational Conventions . . . . . . . . . . . . . . . . . 5 2. HTTP/3 Event Schema Definition . . . . . . . . . . . . . . . 5 2.1. Draft Event Schema Identification . . . . . . . . . . . . 5 3. HTTP/3 Events . . . . . . . . . . . . . . . . . . . . . . . . 6 3.1. parameters_set . . . . . . . . . . . . . . . . . . . . . 6 3.2. parameters_restored . . . . . . . . . . . . . . . . . . . 8 3.3. stream_type_set . . . . . . . . . . . . . . . . . . . . . 8 3.4. priority_updated . . . . . . . . . . . . . . . . . . . . 9 3.5. frame_created . . . . . . . . . . . . . . . . . . . . . . 10 3.6. frame_parsed . . . . . . . . . . . . . . . . . . . . . . 10 3.7. datagram_created . . . . . . . . . . . . . . . . . . . . 11 3.8. datagram_parsed . . . . . . . . . . . . . . . . . . . . . 11 3.9. push_resolved . . . . . . . . . . . . . . . . . . . . . . 12 4. HTTP/3 Data Type Definitions . . . . . . . . . . . . . . . . 12 4.1. Initiator . . . . . . . . . . . . . . . . . . . . . . . . 12 4.2. HTTP3Frame . . . . . . . . . . . . . . . . . . . . . . . 13 4.2.1. HTTP3DataFrame . . . . . . . . . . . . . . . . . . . 13 4.2.2. HTTP3HeadersFrame . . . . . . . . . . . . . . . . . . 13 4.2.3. HTTP3CancelPushFrame . . . . . . . . . . . . . . . . 15 4.2.4. HTTP3SettingsFrame . . . . . . . . . . . . . . . . . 15 4.2.5. HTTP3PushPromiseFrame . . . . . . . . . . . . . . . . 16 4.2.6. HTTP3GoawayFrame . . . . . . . . . . . . . . . . . . 16 4.2.7. HTTP3MaxPushIDFrame . . . . . . . . . . . . . . . . . 17 4.2.8. HTTP3ReservedFrame . . . . . . . . . . . . . . . . . 17 4.2.9. HTTP3UnknownFrame . . . . . . . . . . . . . . . . . . 17 4.2.10. HTTP3PriorityUpdateFrame . . . . . . . . . . . . . . 17 4.2.11. HTTP3OriginFrame . . . . . . . . . . . . . . . . . . 18 4.3. HTTP3ApplicationError . . . . . . . . . . . . . . . . . . 18 5. HTTP Event Schema Definition . . . . . . . . . . . . . . . . 19 5.1. Draft Event Schema Identification . . . . . . . . . . . . 19 Marx, et al. Expires 6 May 2027 [Page 2] Internet-Draft HTTP/3 qlog event definitions November 2026 6. HTTP Events . . . . . . . . . . . . . . . . . . . . . . . . . 20 6.1. capsule_created . . . . . . . . . . . . . . . . . . . . . 20 6.2. capsule_parsed . . . . . . . . . . . . . . . . . . . . . 20 7. HTTP Data Type Definitions . . . . . . . . . . . . . . . . . 21 7.1. HTTPCapsule . . . . . . . . . . . . . . . . . . . . . . . 21 7.1.1. HTTPCapsuleDatagram . . . . . . . . . . . . . . . . . 21 7.1.2. HTTPCapsuleUnknown . . . . . . . . . . . . . . . . . 22 8. Security and Privacy Considerations . . . . . . . . . . . . . 22 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 22 10. Normative References . . . . . . . . . . . . . . . . . . . . 22 Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 24 Change Log . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Since draft-ietf-quic-qlog-h3-events-13: . . . . . . . . . . . 24 Since draft-ietf-quic-qlog-h3-events-12: . . . . . . . . . . . 24 Since draft-ietf-quic-qlog-h3-events-11: . . . . . . . . . . . 24 Since draft-ietf-quic-qlog-h3-events-09: . . . . . . . . . . . 24 Since draft-ietf-quic-qlog-h3-events-08: . . . . . . . . . . . 25 Since draft-ietf-quic-qlog-h3-events-07: . . . . . . . . . . . 25 Since draft-ietf-quic-qlog-h3-events-06: . . . . . . . . . . . 25 Since draft-ietf-quic-qlog-h3-events-05: . . . . . . . . . . . 25 Since draft-ietf-quic-qlog-h3-events-04: . . . . . . . . . . . 25 Since draft-ietf-quic-qlog-h3-events-03: . . . . . . . . . . . 25 Since draft-ietf-quic-qlog-h3-events-02: . . . . . . . . . . . 26 Since draft-ietf-quic-qlog-h3-events-01: . . . . . . . . . . . 26 Since draft-ietf-quic-qlog-h3-events-00: . . . . . . . . . . . 26 Since draft-marx-qlog-event-definitions-quic-h3-02: . . . . . . 26 Since draft-marx-qlog-event-definitions-quic-h3-01: . . . . . . 26 Since draft-marx-qlog-event-definitions-quic-h3-00: . . . . . . 28 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 28 1. Introduction This document defines a qlog event schema (Section 8 of [QLOG-MAIN]) containing concrete events for the core HTTP/3 protocol [HTTP/3] and selected extensions: Extended CONNECT ([EXTENDED-CONNECT]), PRIORITY_UPDATE (Section 7 of [PRIORITIZATION]), ORIGIN ([ORIGIN]), and HTTP/3 Datagrams (Section 2.1 of [DGRAM-AND-CAPSULE]). It also defines a schema for the HTTP Capsule Protocol (Section 3 of [DGRAM-AND-CAPSULE]). This document defines two event namespaces: http3 (Section 2) and http (Section 5). In each namespace, multiple events derive from the qlog abstract Event class (Section 7 of [QLOG-MAIN]), each extending the data field and defining their name field values and semantics. Table 1 summarizes the name value of each event type in the http3 namespace. The data types that the events use are defined in Section 4 and Section 7. Marx, et al. Expires 6 May 2027 [Page 3] Internet-Draft HTTP/3 qlog event definitions November 2026 +===========================+============+=============+ | Name value | Importance | Definition | +===========================+============+=============+ | http3:parameters_set | Base | Section 3.1 | +---------------------------+------------+-------------+ | http3:parameters_restored | Base | Section 3.2 | +---------------------------+------------+-------------+ | http3:stream_type_set | Base | Section 3.3 | +---------------------------+------------+-------------+ | http3:priority_updated | Base | Section 3.4 | +---------------------------+------------+-------------+ | http3:frame_created | Core | Section 3.5 | +---------------------------+------------+-------------+ | http3:frame_parsed | Core | Section 3.6 | +---------------------------+------------+-------------+ | http3:datagram_created | Base | Section 3.7 | +---------------------------+------------+-------------+ | http3:datagram_parsed | Base | Section 3.8 | +---------------------------+------------+-------------+ | http3:push_resolved | Extra | Section 3.9 | +---------------------------+------------+-------------+ Table 1: HTTP/3 Events Table 2 summarizes the name value of each event type in the http namespace. +======================+============+=============+ | Name value | Importance | Definition | +======================+============+=============+ | http:capsule_created | Core | Section 6.1 | +----------------------+------------+-------------+ | http:capsule_parsed | Core | Section 6.2 | +----------------------+------------+-------------+ Table 2: HTTP Events 1.1. Usage with QUIC The events described in this document can be used with or without logging the related QUIC events defined in [QLOG-QUIC]. When they are logged together, the guidance in [QLOG-QUIC] on group IDs, file names, and events without a known connection applies. When they are logged without QUIC events, an implementation can assign a unique identifier to each HTTP/3 connection and use it as the value of the qlog group_id field; see Section 7.3 of [QLOG-MAIN]. The identifier can also be used as the qlog filename or file Marx, et al. Expires 6 May 2027 [Page 4] Internet-Draft HTTP/3 qlog event definitions November 2026 identifier, optionally suffixed by the vantage point type. For example, abcd1234_server.qlog would contain the server-side trace of the connection with identifier abcd1234. 1.2. Notational Conventions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. The event and data structure definitions in this document are expressed in the Concise Data Definition Language [CDDL] and its extensions described in Section 1.2 of [QLOG-MAIN]. This document uses the following from [QLOG-MAIN]: the event namespace and event type concepts; the name, data, group_id, and time-related fields; and the RawInfo type. Events are defined with an importance level as described in Section 8.3 of [QLOG-MAIN]. As is the case for [QLOG-MAIN], the qlog schema definitions in this document are intentionally agnostic to serialization formats. The choice of format is an implementation decision. 2. HTTP/3 Event Schema Definition This document describes how the core HTTP/3 protocol and selected extensions can be expressed in qlog using a newly defined event schema. Per the requirements in Section 8 of [QLOG-MAIN], this document registers the http3 namespace. The event schema URI is urn:ietf:params:qlog:events:http3. 2.1. Draft Event Schema Identification This section is to be removed before publishing as an RFC. Only implementations of the final, published RFC can use the events belonging to the event schema with the URI urn:ietf:params:qlog:events:http3. Until such an RFC exists, implementations MUST NOT identify themselves using this URI. Implementations of draft versions of the event schema MUST append the string "-" and the corresponding draft number to the URI. For example, draft 07 of this document is identified using the URI urn:ietf:params:qlog:events:http3-07. Marx, et al. Expires 6 May 2027 [Page 5] Internet-Draft HTTP/3 qlog event definitions November 2026 The namespace identifier itself is not affected by this requirement. 3. HTTP/3 Events HTTP/3 events extend the $ProtocolEventData extension point defined in Section 8.2 of [QLOG-MAIN]. Additionally, they allow for direct extensibility by their use of per-event extension points via the $$ CDDL "group socket" syntax, as also described in Section 8.2 of [QLOG-MAIN]. HTTP3EventData = HTTP3ParametersSet / HTTP3ParametersRestored / HTTP3StreamTypeSet / HTTP3PriorityUpdated / HTTP3FrameCreated / HTTP3FrameParsed / HTTP3DatagramCreated / HTTP3DatagramParsed / HTTP3PushResolved $ProtocolEventData /= HTTP3EventData Figure 1: HTTP3EventData definition and ProtocolEventData extension HTTP/3 events describe what happens at the HTTP/3 layer, and they don't always map one-to-one to QUIC events. Data exchanged between the HTTP/3 and QUIC layers is logged with the stream_data_moved and datagram_data_moved events in [QLOG-QUIC]. HTTP/3 frames are transmitted on QUIC streams, which allows them to span multiple QUIC packets. Some implementations might send a single large frame, rather than a sequence of smaller frames, in order to amortize frame header overhead. HTTP/3 frame headers are represented by the frame_created (Section 3.5) and frame_parsed (Section 3.6) events. Subsequent frame payload data transfer is indicated by stream_data_moved events. Furthermore, stream_data_moved events can appear before frame_parsed events because implementations need to read data from a stream in order to parse the frame header. The concrete HTTP/3 event types are further defined below, their type identifier is the heading name. 3.1. parameters_set The parameters_set event contains HTTP/3 and QPACK-level settings, mostly those received from the HTTP/3 SETTINGS frame. It has Base importance level. Marx, et al. Expires 6 May 2027 [Page 6] Internet-Draft HTTP/3 qlog event definitions November 2026 All these parameters are typically set once and never change. However, they might be set at different times during the connection, so a trace can contain multiple instances of parameters_set with different fields set. The initiator field is "local" for settings that this endpoint sent, and "remote" for settings that it received. The initiator field is required. HTTP3ParametersSet = { initiator: Initiator ; RFC9114 ? max_field_section_size: uint64 ; RFC9204 ? max_table_capacity: uint64 ? blocked_streams_count: uint64 ; RFC9220 (SETTINGS_ENABLE_CONNECT_PROTOCOL) ? extended_connect: uint64 ; RFC9297 (SETTINGS_H3_DATAGRAM) ? h3_datagram: uint64 ; qlog-specific ; indicates whether this implementation waits for a SETTINGS ; frame before processing requests ? waits_for_settings: bool ; settings that this implementation does not recognize, including ; reserved (GREASE) settings ? unknown_settings: [* HTTP3Setting] * $$http3-parametersset-extension } Figure 2: HTTP3ParametersSet definition The unknown_settings field can log settings that the implementation does not recognize, including reserved settings (Section 7.2.4.1 of [HTTP/3]). Each entry's name is "unknown" or "reserved", and name_bytes holds the setting identifier. Settings defined by extensions can instead be added through $$http3-parametersset- extension. Marx, et al. Expires 6 May 2027 [Page 7] Internet-Draft HTTP/3 qlog event definitions November 2026 3.2. parameters_restored The parameters_restored event indicates which of the server's settings a client restored from a previous connection to use for 0-RTT, and their values; see Section 7.2.4.2 of [HTTP/3]. It has Base importance level. When the server's SETTINGS frame arrives, the settings it carries can be logged with the parameters_set event (Section 3.1). HTTP3ParametersRestored = { ; RFC9114 ? max_field_section_size: uint64 ; RFC9204 ? max_table_capacity: uint64 ? blocked_streams_count: uint64 ; RFC9220 (SETTINGS_ENABLE_CONNECT_PROTOCOL) ? extended_connect: uint64 ; RFC9297 (SETTINGS_H3_DATAGRAM) ? h3_datagram: uint64 * $$http3-parametersrestored-extension } Figure 3: HTTP3ParametersRestored definition 3.3. stream_type_set The stream_type_set event is emitted when the type of an HTTP/3 stream becomes known; see Sections 6.1 and 6.2 of [HTTP/3]. It has Base importance level. Client bidirectional streams always have a stream_type value of "request". Server bidirectional streams have no defined use, although extensions could change that. Unidirectional streams in either direction begin with a variable- length integer type. If the type has no known string, stream_type can be "unknown"; for a reserved type (Section 6.2.3 of [HTTP/3]), it can be "reserved". In both cases, stream_type_bytes then holds the numerical value without variable-length integer encoding. The generic $HTTP3StreamType is defined here as a CDDL "type socket" extension point. It can be extended to support additional HTTP/3 stream types. Marx, et al. Expires 6 May 2027 [Page 8] Internet-Draft HTTP/3 qlog event definitions November 2026 HTTP3StreamTypeSet = { ? initiator: Initiator stream_id: uint64 stream_type: $HTTP3StreamType ; only when stream_type === "unknown" or "reserved" ? stream_type_bytes: uint64 ; only when stream_type === "push" ? associated_push_id: uint64 * $$http3-streamtypeset-extension } $HTTP3StreamType /= "request" / "control" / "push" / "reserved" / "unknown" / "qpack_encode" / "qpack_decode" Figure 4: HTTP3StreamTypeSet definition 3.4. priority_updated The priority_updated event is emitted when the priority of a request stream or push stream is initialized or updated through mechanisms defined in [PRIORITIZATION]. It has Base importance level. There can be several reasons why a priority_updated event occurs, and why a particular value was chosen. For example, the priority can follow signals from the client or server (see [PRIORITIZATION]), or local policy can change or override it. The trigger and reason fields can capture these details. Marx, et al. Expires 6 May 2027 [Page 9] Internet-Draft HTTP/3 qlog event definitions November 2026 HTTP3PriorityUpdated = { ; if the prioritized element is a request stream ? stream_id: uint64 ; if the prioritized element is a push stream ? push_id: uint64 ? old: HTTP3Priority new: HTTP3Priority ? trigger: "client_signal_received" / "local" / "other" ? reason: "client_signal_only" / "client_server_merged" / "local_policy" / "other" * $$http3-priorityupdated-extension } Figure 5: HTTP3PriorityUpdated definition 3.5. frame_created The frame_created event is emitted when an HTTP/3 frame is created. It has Core importance level. This event does not necessarily coincide with HTTP/3 data being passed to the QUIC layer. For that, see the stream_data_moved event in [QLOG-QUIC]. HTTP3FrameCreated = { stream_id: uint64 frame: $HTTP3Frame * $$http3-framecreated-extension } Figure 6: HTTP3FrameCreated definition 3.6. frame_parsed The frame_parsed event is emitted when an HTTP/3 frame is parsed. It has Core importance level. Marx, et al. Expires 6 May 2027 [Page 10] Internet-Draft HTTP/3 qlog event definitions November 2026 This event does not necessarily coincide with HTTP/3 data being passed from the QUIC layer. For that, see the stream_data_moved event in [QLOG-QUIC]. HTTP3FrameParsed = { stream_id: uint64 frame: $HTTP3Frame * $$http3-frameparsed-extension } Figure 7: HTTP3FrameParsed definition 3.7. datagram_created The datagram_created event is emitted when an HTTP/3 Datagram (Section 2.1 of [DGRAM-AND-CAPSULE]) is created. It has Base importance level. Beyond the Quarter Stream ID field, the remaining contents of HTTP Datagrams are defined by the protocol that uses them. The datagram_created event can be extended through the $$http3- datagramcreated-extension socket to log that information. This event does not necessarily coincide with the HTTP/3 Datagram being passed to the QUIC layer. For that, see the datagram_data_moved event in [QLOG-QUIC]. HTTP3DatagramCreated = { quarter_stream_id: uint64 ? raw: RawInfo * $$http3-datagramcreated-extension } Figure 8: HTTP3DatagramCreated definition 3.8. datagram_parsed The datagram_parsed event is emitted when an HTTP/3 Datagram (Section 2.1 of [DGRAM-AND-CAPSULE]) is parsed. It has Base importance level. Beyond the Quarter Stream ID field, the remaining contents of HTTP Datagrams are defined by the protocol that uses them. The datagram_parsed event can be extended through the $$http3- datagramparsed-extension socket to log that information. Marx, et al. Expires 6 May 2027 [Page 11] Internet-Draft HTTP/3 qlog event definitions November 2026 This event does not necessarily coincide with the HTTP/3 Datagram being passed from the QUIC layer. For that, see the datagram_data_moved event in [QLOG-QUIC]. HTTP3DatagramParsed = { quarter_stream_id: uint64 ? raw: RawInfo * $$http3-datagramparsed-extension } Figure 9: HTTP3DatagramParsed definition 3.9. push_resolved The push_resolved event is emitted when a resource sent with server push (Section 4.6 of [HTTP/3]) is claimed (used) or abandoned (rejected) by the application on top of HTTP/3, such as a web browser. It has Extra importance level. HTTP3PushResolved = { ? push_id: uint64 ; in case this is logged from a place that does not have access ; to the push_id ? stream_id: uint64 decision: HTTP3PushDecision * $$http3-pushresolved-extension } HTTP3PushDecision = "claimed" / "abandoned" Figure 10: HTTP3PushResolved definition 4. HTTP/3 Data Type Definitions The following data type definitions can be used in HTTP/3 events. 4.1. Initiator Initiator = "local" / "remote" Figure 11: Initiator definition Marx, et al. Expires 6 May 2027 [Page 12] Internet-Draft HTTP/3 qlog event definitions November 2026 4.2. HTTP3Frame The generic $HTTP3Frame is defined here as a CDDL "type socket" extension point. It can be extended to support additional HTTP/3 frame types. ; The HTTP3Frame is any key-value map (e.g., JSON object) $HTTP3Frame /= { * text => any } Figure 12: HTTP3Frame type socket definition The HTTP/3 frame types defined in this document are as follows: HTTP3BaseFrames = HTTP3DataFrame / HTTP3HeadersFrame / HTTP3CancelPushFrame / HTTP3SettingsFrame / HTTP3PushPromiseFrame / HTTP3GoawayFrame / HTTP3MaxPushIDFrame / HTTP3ReservedFrame / HTTP3UnknownFrame HTTP3ExtensionFrames = HTTP3PriorityUpdateFrame / HTTP3OriginFrame $HTTP3Frame /= HTTP3BaseFrames / HTTP3ExtensionFrames Figure 13: HTTP3BaseFrames and HTTP3ExtensionFrames definition 4.2.1. HTTP3DataFrame HTTP3DataFrame = { frame_type: "data" ? raw: RawInfo } Figure 14: HTTP3DataFrame definition 4.2.2. HTTP3HeadersFrame The payload of an HTTP/3 HEADERS frame is the QPACK-encoding of an HTTP field section; see Section 7.2.2 of [HTTP/3]. HTTP3HeadersFrame, in contrast, contains the HTTP field section without QPACK encoding. Marx, et al. Expires 6 May 2027 [Page 13] Internet-Draft HTTP/3 qlog event definitions November 2026 HTTP3HTTPField = { ? name: text ? name_bytes: hexstring ? value: text ? value_bytes: hexstring } Figure 15: HTTP3HTTPField definition HTTP3HeadersFrame = { frame_type: "headers" headers: [* HTTP3HTTPField] ? raw: RawInfo } Figure 16: HTTP3HeadersFrame definition For example, the HTTP field section :path: /index.html :method: GET :authority: example.org :scheme: https would be represented in a JSON serialization as: "headers": [ { "name": ":path", "value": "/index.html" }, { "name": ":method", "value": "GET" }, { "name": ":authority", "value": "example.org" }, { "name": ":scheme", "value": "https" } ] Figure 17: HTTP3HeadersFrame example Marx, et al. Expires 6 May 2027 [Page 14] Internet-Draft HTTP/3 qlog event definitions November 2026 Section 4.2 of [HTTP/3] and Section 5.1 of [HTTP] define rules for the characters used in HTTP field section names and values. Characters outside the range are invalid and result in the message being treated as malformed. It can however be useful to also log these invalid HTTP fields. Characters in the allowed range can be safely logged by the text type used in the name and value fields of HTTP3HTTPField. Characters outside the range are unsafe for the text type and need to be logged using the name_bytes and value_bytes fields. An instance of HTTP3HTTPField MUST include either the name or name_bytes field and MAY include both. An HTTP3HTTPField MAY include a value or value_bytes field or neither. 4.2.3. HTTP3CancelPushFrame HTTP3CancelPushFrame = { frame_type: "cancel_push" push_id: uint64 ? raw: RawInfo } Figure 18: HTTP3CancelPushFrame definition 4.2.4. HTTP3SettingsFrame The settings field can contain zero or more entries. Each setting has a name field, which corresponds to Setting Name as defined (or as would be defined if registered) in the "HTTP/3 Settings" registry maintained at https://www.iana.org/assignments/http3-parameters (https://www.iana.org/assignments/http3-parameters). If a setting has no known name, name can be "unknown"; for a reserved setting, it can be "reserved". In both cases, name_bytes then holds the numerical value without variable-length integer encoding. Marx, et al. Expires 6 May 2027 [Page 15] Internet-Draft HTTP/3 qlog event definitions November 2026 HTTP3SettingsFrame = { frame_type: "settings" settings: [* HTTP3Setting] ? raw: RawInfo } HTTP3Setting = { ? name: $HTTP3SettingsName ; only when name === "unknown" or "reserved" ? name_bytes: uint64 value: uint64 } $HTTP3SettingsName /= "settings_qpack_max_table_capacity" / "settings_max_field_section_size" / "settings_qpack_blocked_streams" / "settings_enable_connect_protocol" / "settings_h3_datagram" / "reserved" / "unknown" Figure 19: HTTP3SettingsFrame definition 4.2.5. HTTP3PushPromiseFrame HTTP3PushPromiseFrame = { frame_type: "push_promise" push_id: uint64 headers: [* HTTP3HTTPField] ? raw: RawInfo } Figure 20: HTTP3PushPromiseFrame definition 4.2.6. HTTP3GoawayFrame HTTP3GoawayFrame = { frame_type: "goaway" ; Either stream_id or push_id. ; This is implicit from the sender of the frame id: uint64 ? raw: RawInfo } Figure 21: HTTP3GoawayFrame definition Marx, et al. Expires 6 May 2027 [Page 16] Internet-Draft HTTP/3 qlog event definitions November 2026 4.2.7. HTTP3MaxPushIDFrame HTTP3MaxPushIDFrame = { frame_type: "max_push_id" push_id: uint64 ? raw: RawInfo } Figure 22: HTTP3MaxPushIDFrame definition 4.2.8. HTTP3ReservedFrame The frame_type_bytes field holds the numerical value of the frame type without variable-length integer encoding. HTTP3ReservedFrame = { frame_type: "reserved" frame_type_bytes: uint64 ? raw: RawInfo } Figure 23: HTTP3ReservedFrame definition 4.2.9. HTTP3UnknownFrame The frame_type_bytes field holds the numerical value of the frame type without variable-length integer encoding. HTTP3UnknownFrame = { frame_type: "unknown" frame_type_bytes: uint64 ? raw: RawInfo } Figure 24: HTTP3UnknownFrame definition 4.2.10. HTTP3PriorityUpdateFrame The PRIORITY_UPDATE frame is defined in Section 7 of [PRIORITIZATION]. Marx, et al. Expires 6 May 2027 [Page 17] Internet-Draft HTTP/3 qlog event definitions November 2026 HTTP3PriorityUpdateFrame = { frame_type: "priority_update" ; if the prioritized element is a request stream ? stream_id: uint64 ; if the prioritized element is a push stream ? push_id: uint64 priority_field_value: HTTP3Priority ? raw: RawInfo } ; The priority value in ASCII text, encoded using Structured Fields ; Example: u=5, i HTTP3Priority = text Figure 25: HTTP3PriorityUpdateFrame definition 4.2.11. HTTP3OriginFrame The ORIGIN frame is defined in Section 2 of [ORIGIN]. HTTP3OriginEntry = { origin_len: uint16 ? ascii_origin: text } HTTP3OriginFrame = { frame_type: "origin" origin_entries: [* HTTP3OriginEntry] ? raw: RawInfo } Figure 26: HTTP3OriginFrame definition 4.3. HTTP3ApplicationError Marx, et al. Expires 6 May 2027 [Page 18] Internet-Draft HTTP/3 qlog event definitions November 2026 HTTP3ApplicationError = "http_no_error" / "http_general_protocol_error" / "http_internal_error" / "http_stream_creation_error" / "http_closed_critical_stream" / "http_frame_unexpected" / "http_frame_error" / "http_excessive_load" / "http_id_error" / "http_settings_error" / "http_missing_settings" / "http_request_rejected" / "http_request_cancelled" / "http_request_incomplete" / "http_message_error" / "http_connect_error" / "http_version_fallback" / ; RFC9204 "qpack_decompression_failed" / "qpack_encoder_stream_error" / "qpack_decoder_stream_error" / ; RFC9297 "http_datagram_error" Figure 27: HTTP3ApplicationError definition HTTP3ApplicationError extends the $ApplicationError type socket defined in [QLOG-QUIC]. ; ensure HTTP errors are properly validated in QUIC events as well ; e.g., QUIC's ConnectionClose Frame $ApplicationError /= HTTP3ApplicationError 5. HTTP Event Schema Definition This document describes how the Capsule Protocol can be expressed in qlog using a newly defined event schema. Per the requirements in Section 8 of [QLOG-MAIN], this document registers the http namespace. The event schema URI is urn:ietf:params:qlog:events:http. 5.1. Draft Event Schema Identification This section is to be removed before publishing as an RFC. Only implementations of the final, published RFC can use the events belonging to the event schema with the URI urn:ietf:params:qlog:events:http. Until such an RFC exists, implementations MUST NOT identify themselves using this URI. Marx, et al. Expires 6 May 2027 [Page 19] Internet-Draft HTTP/3 qlog event definitions November 2026 Implementations of draft versions of the event schema MUST append the string "-" and the corresponding draft number to the URI. For example, draft 07 of this document is identified using the URI urn:ietf:params:qlog:events:http-07. The namespace identifier itself is not affected by this requirement. 6. HTTP Events HTTP events extend the $ProtocolEventData extension point defined in Section 8.2 of [QLOG-MAIN]. Additionally, they allow for direct extensibility by their use of per-event extension points via the $$ CDDL "group socket" syntax, as also described in Section 8.2 of [QLOG-MAIN]. HTTPEventData = HTTPCapsuleCreated / HTTPCapsuleParsed $ProtocolEventData /= HTTPEventData Figure 28: HTTPEventData definition and ProtocolEventData extension The concrete HTTP event types are further defined below, their type identifier is the heading name. 6.1. capsule_created The capsule_created event is emitted when a Capsule is created (see Section 3 of [DGRAM-AND-CAPSULE]). It has Core importance level. This event does not necessarily coincide with data being passed to the transport layer. In HTTP/3, capsules are sent inside DATA frames, so the frame_created event can be logged separately. HTTPCapsuleCreated = { stream_id: uint64 capsule: $HTTPCapsule * $$http-capsulecreated-extension } Figure 29: HTTPCapsuleCreated definition 6.2. capsule_parsed The capsule_parsed event is emitted when a Capsule is parsed (see Section 3 of [DGRAM-AND-CAPSULE]). It has Core importance level. Marx, et al. Expires 6 May 2027 [Page 20] Internet-Draft HTTP/3 qlog event definitions November 2026 This event does not necessarily coincide with data being passed from the transport layer. In HTTP/3, capsules are received inside DATA frames, so the frame_parsed event can be logged separately. HTTPCapsuleParsed = { stream_id: uint64 capsule: $HTTPCapsule * $$http-capsuleparsed-extension } Figure 30: HTTPCapsuleParsed definition 7. HTTP Data Type Definitions The following data type definitions can be used in HTTP events. 7.1. HTTPCapsule The generic $HTTPCapsule is defined here as a CDDL "type socket" extension point. It can be extended to support additional capsule types. ; The HTTPCapsule is any key-value map (e.g., JSON object) $HTTPCapsule /= { * text => any } Figure 31: HTTPCapsule type socket definition The capsule types defined in this document are as follows: HTTPBaseCapsules = HTTPCapsuleDatagram / HTTPCapsuleUnknown $HTTPCapsule /= HTTPBaseCapsules Figure 32: HTTPBaseCapsules definition 7.1.1. HTTPCapsuleDatagram HTTPCapsuleDatagram = { capsule_type: "datagram" ? raw: RawInfo } Figure 33: HTTPCapsuleDatagram definition Marx, et al. Expires 6 May 2027 [Page 21] Internet-Draft HTTP/3 qlog event definitions November 2026 7.1.2. HTTPCapsuleUnknown The capsule_type_value field holds the numerical value of the capsule type without variable-length integer encoding. HTTPCapsuleUnknown = { capsule_type: "unknown" ? capsule_type_value: uint64 ? raw: RawInfo } Figure 34: HTTPCapsuleUnknown definition 8. Security and Privacy Considerations The security and privacy considerations discussed in Section 14 of [QLOG-MAIN] apply to this document as well. 9. IANA Considerations This document registers two new entries in the "qlog event schema URIs" registry, which was created in Section 15 of [QLOG-MAIN]: Event schema URI: urn:ietf:params:qlog:events:http3 Namespace: http3 Event Types: parameters_set, parameters_restored, stream_type_set, priority_updated, frame_created, frame_parsed, datagram_created, datagram_parsed, push_resolved Description: Event definitions related to the HTTP/3 application protocol. Reference: This document Event schema URI: urn:ietf:params:qlog:events:http Namespace: http Event Types: capsule_created, capsule_parsed Description: Event definitions for the Capsule Protocol. Reference: This document 10. Normative References Marx, et al. Expires 6 May 2027 [Page 22] Internet-Draft HTTP/3 qlog event definitions November 2026 [CDDL] Birkholz, H., Vigano, C., and C. Bormann, "Concise Data Definition Language (CDDL): A Notational Convention to Express Concise Binary Object Representation (CBOR) and JSON Data Structures", RFC 8610, DOI 10.17487/RFC8610, June 2019, . [DGRAM-AND-CAPSULE] Schinazi, D. and L. Pardue, "HTTP Datagrams and the Capsule Protocol", RFC 9297, DOI 10.17487/RFC9297, August 2022, . [EXTENDED-CONNECT] Hamilton, R., "Bootstrapping WebSockets with HTTP/3", RFC 9220, DOI 10.17487/RFC9220, June 2022, . [HTTP] Fielding, R., Ed., Nottingham, M., Ed., and J. Reschke, Ed., "HTTP Semantics", STD 97, RFC 9110, DOI 10.17487/RFC9110, June 2022, . [HTTP/3] Bishop, M., Ed., "HTTP/3", RFC 9114, DOI 10.17487/RFC9114, June 2022, . [ORIGIN] Bishop, M., "The ORIGIN Extension in HTTP/3", RFC 9412, DOI 10.17487/RFC9412, June 2023, . [PRIORITIZATION] Oku, K. and L. Pardue, "Extensible Prioritization Scheme for HTTP", RFC 9218, DOI 10.17487/RFC9218, June 2022, . [QLOG-MAIN] Marx, R., Niccolini, L., Seemann, M., and L. Pardue, "qlog: Structured Logging for Network Protocols", Work in Progress, Internet-Draft, draft-ietf-quic-qlog-main- schema-14, 6 July 2026, . [QLOG-QUIC] Marx, R., Niccolini, L., Seemann, M., and L. Pardue, "QUIC event definitions for qlog", Work in Progress, Internet- Draft, draft-ietf-quic-qlog-quic-events-13, 6 July 2026, . Marx, et al. Expires 6 May 2027 [Page 23] Internet-Draft HTTP/3 qlog event definitions November 2026 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, . Acknowledgements Much of the initial work by Robin Marx was done at the Hasselt and KU Leuven Universities. Thanks to Jana Iyengar, Brian Trammell, Dmitri Tikhonov, Stephen Petrides, Jari Arkko, Marcus Ihlar, Victor Vasiliev, Mirja Kuehlewind, Jeremy Laine, Kazu Yamamoto, Christian Huitema, Hugo Landau, Kazuho Oku, and Jonathan Lennox for their feedback and suggestions. Change Log This section is to be removed before publishing as an RFC. Since draft-ietf-quic-qlog-h3-events-13: * Wide range of editorial and consistency changes Since draft-ietf-quic-qlog-h3-events-12: * Added HTTP3OriginFrame (#504) * Added support for Capsule Protocol (#504) * Wide range of editorial changes Since draft-ietf-quic-qlog-h3-events-11: * Replaced all length fields with raw.length (#495) * Renamed owner to initiator (#498) Since draft-ietf-quic-qlog-h3-events-09: * Several editorial changes * Consistent use of RawInfo and _bytes fields to log raw data (#450) Marx, et al. Expires 6 May 2027 [Page 24] Internet-Draft HTTP/3 qlog event definitions November 2026 Since draft-ietf-quic-qlog-h3-events-08: * Removed individual categories and put every event in the single http3 event schema namespace. Major change (#439) * Changed protocol id from HTTP3 to HTTP/3 (#428) Since draft-ietf-quic-qlog-h3-events-07: * TODO (we forgot...) Since draft-ietf-quic-qlog-h3-events-06: * ProtocolEventBody is now called ProtocolEventData (#352) * Editorial changes (#402) Since draft-ietf-quic-qlog-h3-events-05: * Removed all qpack event definitions (#335) * Various editorial changes Since draft-ietf-quic-qlog-h3-events-04: * Renamed 'http' category to 'h3' (#300) * H3HTTPField.value is now optional (#296) * Added definitions for RFC9297 (HTTP/3 Datagram extension) (#310) * Added definitions for RFC9218 (HTTP Extensible Prioritizations extension) (#312) * Added definitions for RFC9220 (Extended Connect extension) (#325) * Editorial and formatting changes (#298, #258, #299, #304, #327) Since draft-ietf-quic-qlog-h3-events-03: * Ensured consistent use of RawInfo to indicate raw wire bytes (#243) * Changed HTTPStreamTypeSet:raw_stream_type to stream_type_value (#54) * Changed HTTPUnknownFrame:raw_frame_type to frame_type_value (#54) Marx, et al. Expires 6 May 2027 [Page 25] Internet-Draft HTTP/3 qlog event definitions November 2026 * Renamed max_header_list_size to max_field_section_size (#282) Since draft-ietf-quic-qlog-h3-events-02: * Renamed HTTPStreamType data to request (#222) * Added HTTPStreamType value unknown (#227) * Added HTTPUnknownFrame (#224) * Replaced old and new fields with stream_type in HTTPStreamTypeSet (#240) * Changed HTTPFrame to a CDDL plug type (#257) * Moved data definitions out of the appendix into separate sections * Added overview Table of Contents Since draft-ietf-quic-qlog-h3-events-01: * No changes - new draft to prevent expiration Since draft-ietf-quic-qlog-h3-events-00: * Change the data definition language from TypeScript to CDDL (#143) Since draft-marx-qlog-event-definitions-quic-h3-02: * These changes were done in preparation of the adoption of the drafts by the QUIC working group (#137) * Split QUIC and HTTP/3 events into two separate documents * Moved RawInfo, Importance, Generic events and Simulation events to the main schema document. Since draft-marx-qlog-event-definitions-quic-h3-01: Major changes: * Moved data_moved from http to transport. Also made the "from" and "to" fields flexible strings instead of an enum (#111,#65) * Moved packet_type fields to PacketHeader. Moved packet_size field out of PacketHeader to RawInfo:length (#40) Marx, et al. Expires 6 May 2027 [Page 26] Internet-Draft HTTP/3 qlog event definitions November 2026 * Made events that need to log packet_type and packet_number use a header field instead of logging these fields individually * Added support for logging retry, stateless reset and initial tokens (#94,#86,#117) * Moved separate general event categories into a single category "generic" (#47) * Added "transport:connection_closed" event (#43,#85,#78,#49) * Added version_information and alpn_information events (#85,#75,#28) * Added parameters_restored events to help clarify 0-RTT behaviour (#88) Smaller changes: * Merged loss_timer events into one loss_timer_updated event * Field data types are now strongly defined (#10,#39,#36,#115) * Renamed qpack instruction_received and instruction_sent to instruction_created and instruction_parsed (#114) * Updated qpack:dynamic_table_updated.update_type. It now has the value "inserted" instead of "added" (#113) * Updated qpack:dynamic_table_updated. It now has an "owner" field to differentiate encoder vs decoder state (#112) * Removed push_allowed from http:parameters_set (#110) * Removed explicit trigger field indications from events, since this was moved to be a generic property of the "data" field (#80) * Updated transport:connection_id_updated to be more in line with other similar events. Also dropped importance from Core to Base (#45) * Added length property to PaddingFrame (#34) * Added packet_number field to transport:frames_processed (#74) * Added a way to generically log packet header flags (first 8 bits) to PacketHeader Marx, et al. Expires 6 May 2027 [Page 27] Internet-Draft HTTP/3 qlog event definitions November 2026 * Added additional guidance on which events to log in which situations (#53) * Added "simulation:scenario" event to help indicate simulation details * Added "packets_acked" event (#107) * Added "datagram_ids" to the datagram_X and packet_X events to allow tracking of coalesced QUIC packets (#91) * Extended connection_state_updated with more fine-grained states (#49) Since draft-marx-qlog-event-definitions-quic-h3-00: * Event and category names are now all lowercase * Added many new events and their definitions * "type" fields have been made more specific (especially important for PacketType fields, which are now called packet_type instead of type) * Events are given an importance indicator (issue #22) * Event names are more consistent and use past tense (issue #21) * Triggers have been redefined as properties of the "data" field and updated for most events (issue #23) Authors' Addresses Robin Marx (editor) Akamai Email: rmarx@akamai.com Luca Niccolini (editor) Meta Email: lniccolini@meta.com Marten Seemann (editor) Email: martenseemann@gmail.com Marx, et al. Expires 6 May 2027 [Page 28] Internet-Draft HTTP/3 qlog event definitions November 2026 Lucas Pardue (editor) Apple Email: lucas@lucaspardue.com Marx, et al. Expires 6 May 2027 [Page 29]