The HTTP Headers section of apis.io lists every header declared in published API contracts across the catalog. Its build scanned 159,590 specification files from 27,956 providers and observed 6,666 distinct header names. Of those, 308 get a page, because they are registered with IANA, reached by a regulation, or declared by at least 25 providers. The other 6,514 are real but are mostly one-off vendor fields. We used the section on ourselves to answer a simple question: when an API tells you where you stand against a rate limit, what does it call that header?
The rate-limiting category
The Rate Limiting and Quota category has nine headers and three generations of practice:
| Header | Providers | Spec files | Status |
|---|---|---|---|
| Retry-After | 329 | 13,027 | IANA, RFC 9110 |
| X-RateLimit-Limit | 130 | 10,633 | de facto, 4 spellings |
| RateLimit-Policy | 32 | 8,006 | de facto |
| RateLimit | 35 | 4,383 | de facto, 2 spellings |
Retry-After is the only one with a standard behind it, and it is the most widely declared. The legacy X-RateLimit-* triplet comes next, with Limit and Remaining each on 130 providers and Reset on 107. The unprefixed RateLimit and RateLimit-Policy fields from the IETF HTTPAPI working group are still drafts, which is why neither is IANA-registered. Each is declared by about a quarter as many providers as the X- form.
Who adopted the new form
The provider list on the RateLimit page has 35 entries. At least 19 of them are UK banks or the UK Open Banking standard itself: Lloyds Banking Group, Bank of Scotland, Santander UK, Coutts, First Direct, Chase UK, Kroo, Monument, Tandem, Shawbrook, Paragon and others. They did not each choose the IETF draft independently. They publish versions of the same standard-derived contract, so they inherited the header together.
The rest of the list is a mix of individual companies, including Honeycomb, MessageBird, Dow Jones, Triple Whale and Anchor Browser. Outside UK banking, the move to the standard header looks like individual choices, not a market trend.
What the section can and cannot tell you
The section’s note says it directly: counts are what a published contract declares, not what a deployment sends. Many APIs that return X-RateLimit-Remaining in production never mention it in their OpenAPI. These numbers measure documentation, which is what an agent reads before it makes its first call.
Using the section also showed us three problems of our own:
- The headline counts disagree. The category page counts Retry-After on 330 providers and RateLimit on 36, while the header pages say 329 and 35. The two pages are built at different points in the same run.
- The section description is out of date. It says headers were assembled from 119,030 specification files, while the summary data the page renders counts 159,590.
- Spec-file counts are heavily skewed.
RateLimit-Policyappears in 8,006 files from only 32 providers, because banks repeat it on every operation of every versioned contract. Compare headers by provider count, not file count.
Takeaway
If you are choosing a rate-limit header today, document Retry-After, which most providers already do. Then decide whether to ship the X- triplet that clients already parse, or the draft standard that only a single regulated market has adopted. Browse the category at apis.io/headers/categories/rate-limiting/.
Elsewhere: this story on Yawplet · a reader's take on Yarnhen. Yawplet and Yarnhen are agent-first sites where AI agents post.