Headers
The request and response headers HTTP APIs rely on, with what each one does and an example line.
Request headers
37- AcceptSpecifies the media types that the client is willing to receive in the response.
- Accept-EncodingDeclares what compression algorithms the client supports for the response payload.
- Accept-LanguageAdvertises the natural languages the client prefers for the response.
- Access-Control-Request-HeadersSent by the browser in a CORS preflight to announce the custom headers of the actual request.
- Access-Control-Request-MethodSent by the browser in a CORS preflight to announce the method of the actual request.
- AuthorizationContains the credentials to authenticate the client with the server.
- Client-CertLets a TLS-terminating reverse proxy pass the client's mTLS certificate to the origin, as a base64 DER byte sequence.
- Client-Cert-ChainCarries the intermediate certificates behind a client's mTLS certificate from a TLS-terminating proxy to the origin, as a list of byte sequences.
- CookieSends previously stored cookies from the client back to the server.
- DPoPCarries an RFC 9449 proof-of-possession JWT, signed by the client's private key over the method and URI, binding OAuth tokens to that key.
- Early-DataAdded by an intermediary to mark a request that was received in TLS 1.3 early data (0-RTT) and could be a replay.
- ExpectSignals that the client expects a particular server behavior before continuing the request.
- ForwardedStandard header in which proxies record the client address, protocol and host a request arrived with, replacing the X-Forwarded-* family.
- FromAn email address for the human responsible for the requesting user agent. Crawlers and bots should send it; nobody should trust it.
- HostSpecifies the target host and port of the resource being requested.
- Idempotency-KeyCustom request header used to prevent duplicate operations (mutations) on the server.Not standardized
- If-MatchMakes the request conditional; execution occurs only if the client ETag matches the server ETag.
- If-Modified-SinceMakes the request conditional; execution occurs only if the resource has changed since the given date.
- If-None-MatchMakes the request conditional; execution occurs only if the client ETag does not match the server ETag.
- If-RangeMakes a range request conditional: send the requested part if the resource is unchanged, otherwise send the whole new representation.
- If-Unmodified-SinceMakes a request conditional on the resource not having been modified after the given date.
- Last-Event-IDSent by an EventSource client when it reconnects to a Server-Sent Events stream, carrying the id of the last event it saw.
- Max-ForwardsA hop counter for TRACE and OPTIONS that limits how many proxies may forward the request, so you can probe a chain one hop at a time.
- OriginIndicates the origin (scheme, host, and port) that a cross-origin request comes from.
- PreferLets the client request optional, non-critical handling behaviors from the server.
- Proxy-AuthorizationCarries the credentials a client presents to a forward proxy that demanded authentication with a 407 response.
- RangeRequests only part of a resource by specifying one or more byte ranges.
- RefererThe misspelled request header naming the resource the target URI was obtained from. Optional, often trimmed, and never trustworthy.
- Sec-WebSocket-KeyA random base64 nonce in the WebSocket opening handshake, which the server hashes into Sec-WebSocket-Accept to prove it understood the request.
- TETells the server whether the client accepts trailer fields and, in HTTP/1.1, which transfer codings besides chunked it can take.
- traceparentW3C Trace Context header carrying the trace ID, the caller's span ID and the sampling flag, so one request can be followed across every service it touches.
- tracestateW3C Trace Context companion to traceparent that carries vendor-specific trace data as an ordered list of key=value entries.
- User-AgentIdentifies the client software making the request, as a list of product tokens in decreasing order of significance.
- X-Forwarded-ForDe facto request header listing the client and proxy IP addresses a request passed through. Trivially spoofed unless parsed from the right.Not standardized
- X-Forwarded-HostDe facto request header in which a proxy records the Host the client originally asked for. Spoofable, and a common source of host header attacks.Not standardized
- X-Forwarded-ProtoDe facto request header in which a proxy records whether the client connected over http or https. The standard form is Forwarded proto.Not standardized
- X-HTTP-Method-OverrideDe facto request header that tunnels another method, such as PUT or DELETE, through a POST. A workaround that can bypass method-based security.Not standardized
Response headers
52- Accept-PatchAdvertises which patch document media types a resource accepts in PATCH requests, and by its presence that PATCH is allowed at all.
- Accept-PostAdvertises which media types a resource accepts in POST requests, modeled on Accept-Patch and defined by the W3C Linked Data Platform.
- Accept-QuerySignals that a resource supports the QUERY method and lists the query formats it accepts, as a Structured Field list of media types.
- Accept-RangesAdvertises whether a server supports range requests for a resource.
- Access-Control-Allow-CredentialsIndicates whether the response can be exposed when the CORS request includes credentials.
- Access-Control-Allow-HeadersLists the request headers that are permitted during the actual CORS request.
- Access-Control-Allow-MethodsLists the HTTP methods permitted when accessing a resource in response to a CORS preflight.
- Access-Control-Allow-OriginSpecifies which origin(s) are permitted to read the response in a CORS request.
- Access-Control-Expose-HeadersLists the response headers that browsers are allowed to expose to client-side JavaScript.
- Access-Control-Max-AgeSpecifies how long the results of a CORS preflight request can be cached by the browser.
- AgeThe time in seconds since a cached response was generated at the origin server.
- AllowLists the HTTP methods supported by the target resource, on a 405 Method Not Allowed or a 2xx OPTIONS response.
- Alt-SvcAdvertises another protocol, host or port where the same origin can be reached, which is how clients discover HTTP/3.
- Authentication-InfoReturns scheme-specific information to the client after its credentials have been accepted, such as the next nonce in Digest authentication.
- Cache-Group-InvalidationSent on a response to an unsafe request, it asks caches to invalidate stored responses in the named cache groups.
- Cache-GroupsTags a cacheable response with one or more group names, so a cache can invalidate every stored response in a group together.
- Cache-StatusReports how each cache on the path handled a response: hit or forwarded, why, and how much freshness remains.
- CDN-Cache-ControlCache directives aimed only at CDN caches, letting an origin set edge caching separately from browsers and other caches.
- Content-DispositionIndicates whether the body should be displayed inline or treated as a downloadable attachment.
- Content-RangeIndicates which portion of a resource is delivered in a partial response.
- Content-Security-PolicyTells browsers which sources a document may load and who may frame it. For a JSON API, send the most restrictive policy there is.
- Cross-Origin-Resource-PolicyTells browsers which sites may load a response through no-cors requests such as img and script tags. Does not affect CORS fetches.
- DeprecationSignals that a resource is deprecated, carrying the date deprecation takes or took effect as a Structured Field Date.
- DPoP-NonceA server-issued nonce the client must put in its next DPoP proofs, limiting how long a proof can be used or pre-generated.
- ETagAn identifier for a specific version of a resource, used for cache validation.
- ExpiresThe absolute date and time after which a cached response is considered stale.
- Last-ModifiedThe date and time a resource was last changed, used for cache validation.
- LocationIndicates the URL to redirect the client to, or the URL of a newly created resource.
- Preference-AppliedTells the client which of the preferences it sent in Prefer the server actually honored.
- Proxy-AuthenticateCarries the authentication challenge a forward proxy sends with a 407 response before it will relay the request.
- Proxy-Authentication-InfoThe proxy counterpart of Authentication-Info: scheme-specific data a proxy returns after accepting Proxy-Authorization credentials.
- Proxy-StatusLets each proxy, gateway or CDN on the path say what it did with a response and, on a 502 or 504, exactly which error it hit.
- RateLimitReports the quota currently available to the client under each named rate limit policy, and how long that quota applies.Not standardized
- RateLimit-LimitLegacy field from early IETF drafts giving the request quota for the current window. Superseded by RateLimit and RateLimit-Policy.Not standardized
- RateLimit-PolicyAdvertises the quota policies a server applies to the client, each named and described by quota, window and unit.Not standardized
- RateLimit-RemainingLegacy field from early IETF drafts giving the quota left in the current window. Superseded by the r parameter of RateLimit.Not standardized
- RateLimit-ResetLegacy field from early IETF drafts giving the seconds until the quota resets. Superseded by the t parameter of RateLimit.Not standardized
- Referrer-PolicyControls how much of the current URL a browser puts in the Referer header of requests made from a page. Send no-referrer on API responses.
- Retry-AfterTells the client how long to wait before making a follow-up request.
- Sec-WebSocket-AcceptThe server's answer to Sec-WebSocket-Key: a base64 SHA-1 of the key plus a fixed GUID, confirming it accepts the WebSocket connection.
- ServerNames the software the origin server used to handle the request. Optional, and best kept short or left out of API responses.
- Server-TimingLets a server report named backend timings, such as database or cache time, which browsers expose in developer tools and to JavaScript.Not standardized
- Set-CookieInstructs the client to store a cookie and return it on subsequent requests.
- Strict-Transport-SecurityTells browsers to contact this host only over HTTPS for a set period, refusing plaintext connections and certificate errors.
- SunsetThe date after which a resource is expected to become unavailable.
- VaryLists the request headers a response depends on, controlling cache key selection.
- WWW-AuthenticateDefines the authentication method that should be used to gain access to the resource.
- X-Content-Type-OptionsTells browsers not to second-guess the declared Content-Type, blocking scripts and stylesheets served with the wrong media type.
- X-Frame-OptionsLegacy header that tells browsers whether a response may be shown in a frame. Superseded by CSP frame-ancestors, but still worth sending as DENY.
- X-RateLimit-LimitDe facto header giving the request quota for the current rate limit window. Never standardized; its meaning varies by API.Not standardized
- X-RateLimit-RemainingDe facto header giving the requests left in the current rate limit window. Never standardized; superseded by the r parameter of RateLimit.Not standardized
- X-RateLimit-ResetDe facto header saying when the rate limit window resets. Sent as seconds, milliseconds, a Unix timestamp or a date, depending on the API.Not standardized
Request and response
29- Accept-SignatureAsks the other side to sign its message with RFC 9421 HTTP Message Signatures, naming the label, covered components and parameters.
- Cache-ControlDirectives for caching mechanisms in both requests and responses.
- ConnectionLists control options for the current HTTP/1.1 connection and names the hop-by-hop fields that intermediaries must strip before forwarding.
- Content-DigestCarries a hash of the actual message content, so the recipient can check the bytes arrived intact.
- Content-EncodingIndicates the compression encoding that has been applied to the message body.
- Content-LanguageDescribes the natural language(s) of the intended audience for the message body.
- Content-LengthIndicates the size of the request or response body in bytes.
- Content-LocationIdentifies a URI for the specific representation enclosed in the message, distinct from the redirect or creation target given by Location.
- Content-TypeIndicates the media type of the request or response body payload.
- DateThe date and time at which the message was originated, sent as an IMF-fixdate in GMT.
- LinkProvides a means to serialize relationships between resources in HTTP headers, commonly used for pagination.
- Link-TemplateLike Link, but the target is a URI Template, so a client can build links itself, such as to any item by ID or any page of results.
- OData-VersionStates which OData protocol version, 4.0 or 4.01, a request or response payload was written in. Services must send it on every response.
- PrioritySignals how urgent a response is and whether it can be used incrementally, so HTTP/2 and HTTP/3 servers can schedule bandwidth.
- Repr-DigestCarries a hash of the full selected representation, independent of ranges and of how this message frames it.
- Sec-WebSocket-ExtensionsNegotiates WebSocket protocol extensions such as permessage-deflate: the client offers, the server accepts a subset.
- Sec-WebSocket-ProtocolNegotiates the application subprotocol for a WebSocket connection: the client lists what it speaks, the server picks one.
- Sec-WebSocket-VersionThe WebSocket protocol version in the opening handshake. Always 13; a server that disagrees replies with the versions it supports.
- SignatureCarries one or more RFC 9421 HTTP Message Signature values, each keyed by the label that matches its entry in Signature-Input.
- Signature-InputDeclares, per signature label, which message components an RFC 9421 HTTP Message Signature covers and with which parameters it was made.
- TrailerAnnounces in the header section which fields the sender expects to send as trailers, after the body.
- Transfer-EncodingLists the transfer codings, such as chunked, applied to an HTTP/1.1 message body so it can be framed on the connection.
- Unencoded-DigestCarries a hash of the full representation with no content coding applied, so a client that decoded gzip or br can verify what it got.Not standardized
- UpgradeInvites the server to switch an HTTP/1.1 connection to a different protocol, most often WebSocket.
- ViaRecords each proxy or gateway a message passed through, with the protocol version it was received over.
- Want-Content-DigestAsks the other side to send a Content-Digest, and says which hash algorithms it would prefer, from 1 to 10.
- Want-Repr-DigestAsks the other side to send a Repr-Digest of the full selected representation, with a weighted preference for hash algorithms.
- Want-Unencoded-DigestAsks the other side to send an Unencoded-Digest of the representation with no content coding, with a weighted algorithm preference.Not standardized
- X-Request-IDDe facto header carrying a unique ID for one request, echoed in the response and written to every log line so a failure can be traced.Not standardized
