Currently the 401 code is mapped to CANCELLED instead of UNAUTHENTICATED.

The implementation in the status_conversion.cc

case 401:
      return GRPC_STATUS_UNAUTHENTICATED;

aligns with documentation: https://github.com/grpc/grpc/blob/master/doc/http-grpc-status-mapping.md

However, it seems to me that grpc_http2_status_to_grpc_status() function is not getting called anywhere in the code base.

In http_client_filter.cc: client_filter_incoming_metadata, the function checks for grpc status, if it doesn't exist, it defaults to GRPC_STATUS_CANCELLED instead of GRPC_STATUS_UNAUTHENTICATED