Module http 

The JSON-over-HTTP transport both IPAM backends speak.

Why this exists where the four other clients did not get one

http_client already owns the plumbing every outbound client in this tree shares — picking a URL apart, connecting through the shared resolver, the TLS handshake, the hyper handshake — and its module doc is explicit that policy stays per-module, because challenge::http_01 must validate no certificate at all while the others must, and each caps its body, sets its headers and shapes its errors differently.

Two IPAM backends are the case that argument does not cover: they have the same policy. Both authenticate with a static token in a header, both read a small JSON document, both trust the public roots plus an operator’s own CA, both treat an unreachable inventory as this server’s failure rather than the client’s. Writing that out twice is the shape script_hook exists to prevent — it owns the hardening the three custom hooks used to repeat token-for-token.

What stays per-backend is what genuinely differs: the header name, the paths, the wire shapes, and — the reason [JsonApiError] carries a status — what a 404 means. NetBox answers an unknown address with an empty result list; phpIPAM answers it with a 404. One is a failure and one is an answer, and only the backend knows which.

TLS

Unlike the challenge validators — where the certificate is deliberately not checked because the proof is what matters — an inventory’s certificate is the only thing identifying the service whose answers decide who may have a name certified. So the public roots apply, plus any operator-supplied CA, and the one way to switch that off is explicit, logged at startup and documented as temporary.