A 201 (Created) response carries no Location header field. Which resource does the 201 identify as the one created?
The target URI of the request✓Respuesta correcta
The response is malformed, because Location is mandatory with 201
No resource; the client must issue a follow-up GET to discover it
The URI given in Content-Location, which becomes mandatory in that case
Explicación
The primary created resource is identified by Location when present, and otherwise by the request's target URI, which is the usual situation for a PUT that creates. Location is a SHOULD for POST, not a universal requirement of the status code.