explain base64url and padding

Author: sebbader-sap

documentation/IDTA-01002-3/modules/ROOT/pages/changelog.adoc

@@ -41,6 +41,7 @@ Minor Changes:
 * Clarification on how to handle duplicate query parameters
 * Replace "servers" clause in OpenAPI files
 * Add notes for base64url-encoded values and order of "assetIds" query parameters
+* Design Decisions for the HTTP API: Clarify that padding is not allowed for base64url-encoded values (https://github.com/admin-shell-io/aas-specs-api/issues/423[#423])
 
 === Interface Changes w.r.t. V3.0.3 to V3.1
 

documentation/IDTA-01002-3/modules/ROOT/pages/http-rest-api/http-rest-api.adoc

@@ -83,6 +83,7 @@ Identifiers may also be passed as base64url-encoded query parameters, e.g. for s
 Such query parameters are typically used when a list of objects may be retrieved in the resulting payload.
 A list of base64url-encoded ids is simply passed as comma-separated query parameters.
 * Please note that base64url-encoding differs slightly from base64-encoding and has been specifically defined for passing URLs.
+In particular, base64url-encoded values shall contain or end with the `=` character (so-called 'padding') to keep them URL-safe.
 An appropriate base64url implementation needs to be used for encoding/decoding.
 See RFC 4648 for further details.