refitSettings shoudln't default to null as it's called by library code, which we control. refitSettings should never be null.

This is due to the fact that in RestMethodInfo constructor it may be null https://github.com/reactiveui/refit/pull/927/files#diff-12d38083c42706a6ad12f6b11083cea6R43.
Should i do refitSettings not null in IErrorHandler and RestMethodInfo? This will require changing tests in Refit.Tests\RequestBuilder.cs

What happens if the error handler returns null?

Now it will go the way of deserializing the response and the Refit code will return default for this type.

It is possible to alter on when the user implementation considers that this is not an error scenario, they can return null and the refit code can deserialize the response.

For example:
Normal response

{
    "result": true,
    "data" : { ... }
}

Error response

{
    "result": false,
    "error": "error description"
}

and model for this

public class ApiMethodResponse
{
    public bool Result { get; set; }
    public string Error { get; set; }
    public SomeDataModel Data { get; set; }
}

Same, what happens if the error handler returns null?

this will now throw a NullReferenceException
it can be redone with

- throw await restMethod.ErrorHandler.HandleErrorAsync(rq, restMethod.HttpMethod, resp, settings).ConfigureAwait(false);
+ var exception = await restMethod.ErrorHandler.HandleErrorAsync(rq, restMethod.HttpMethod, resp, settings).ConfigureAwait(false);
+ if (exception != null)
+ 
+    throw exception;
+ }

and go according to the scenario described above

It is a breaking change.
Not sure it could be done.

Good point. We could make it so that the custom exception has to derive from ApiException. That would allow people to have custom exception types.

It's not clear to me what other exceptions people are looking to throw here?

Ability to throw UnauthorizedAccessException was requested here:
#562

I'm pretty sure that exception should not be thrown in this context. That's for things wrapping Windows APIs

https://docs.microsoft.com/en-us/dotnet/api/system.unauthorizedaccessexception?view=netcore-3.1