HTTP Headers Directory
A comprehensive reference of HTTP headers commonly utilized in web APIs to manage authentication, pagination, rate limiting, and content negotiation.
Request Headers
Response Headers
Accept-Ranges
Advertises whether a server supports range requests for a resource.
Access-Control-Allow-Credentials
Indicates whether the response can be exposed when the CORS request includes credentials.
Access-Control-Allow-Headers
Lists the request headers that are permitted during the actual CORS request.
Access-Control-Allow-Methods
Lists the HTTP methods permitted when accessing a resource in response to a CORS preflight.
Access-Control-Allow-Origin
Specifies which origin(s) are permitted to read the response in a CORS request.
Access-Control-Expose-Headers
Lists the response headers that browsers are allowed to expose to client-side JavaScript.
Access-Control-Max-Age
Specifies how long the results of a CORS preflight request can be cached by the browser.
Age
The time in seconds since a cached response was generated at the origin server.
Allow
Lists the HTTP methods supported by the target resource, on a 405 Method Not Allowed or a 2xx OPTIONS response.
Content-Disposition
Indicates whether the body should be displayed inline or treated as a downloadable attachment.
Content-Range
Indicates which portion of a resource is delivered in a partial response.
Deprecation
Signals that an endpoint or resource is deprecated and may be removed in future.
ETag
An identifier for a specific version of a resource, used for cache validation.
Expires
The absolute date and time after which a cached response is considered stale.
Last-Modified
The date and time a resource was last changed, used for cache validation.
Location
Indicates the URL to redirect the client to, or the URL of a newly created resource.
RateLimit-Limit
Indicates the maximum number of requests the client is permitted to make in the current rate window.
RateLimit-Remaining
Indicates the remaining number of requests the client is allowed to make in the current rate window.
RateLimit-Reset
Indicates the number of seconds remaining until the current rate window resets.
Retry-After
Tells the client how long to wait before making a follow-up request.
Set-Cookie
Instructs the client to store a cookie and return it on subsequent requests.
Sunset
The date after which a resource is expected to become unavailable.
Vary
Lists the request headers a response depends on, controlling cache key selection.
WWW-Authenticate
Defines the authentication method that should be used to gain access to the resource.
Bidirectional Headers (Request & Response)
Cache-Control
Directives for caching mechanisms in both requests and responses.
Content-Encoding
Indicates the compression encoding that has been applied to the message body.
Content-Language
Describes the natural language(s) of the intended audience for the message body.
Content-Length
Indicates the size of the request or response body in bytes.
Content-Type
Indicates the media type of the request or response body payload.
Link
Provides a means to serialize relationships between resources in HTTP headers, commonly used for pagination.
