HTTP Headers

Every HTTP header declared across the APIs.io network, assembled from the IANA HTTP Field Name Registry and from every in: header parameter and headers: mapping key in 159590 published specification files across all 27956 providers.

308 headers catalogued
6666 distinct names observed
74 used by 25+ providers
33 reached by regulation
97 spelled more than one way
A header earns a page when it is registered with IANA, reached by a regulation, or declared by at least 25 distinct providers. The other 6514 observed names are real but are almost entirely one-off vendor fields. Counts are what a published contract declares, not what a deployment sends. Written guidance for each header lives on headers.apievangelist.com.

Authentication 44

Headers that carry who the caller is — credentials, tokens, keys, signatures of identity. The most declared category in the catalog and the most inconsistently spelled.

Authorization 1382 x-api-key 798 X-Amz-Date 98 X-Amz-Content-Sha256 98 X-Amz-Security-Token 97 X-Amz-Algorithm 96 X-Amz-SignedHeaders 96 X-Amz-Signature 96 X-Amz-Credential 96 apikey 94 api-key 93 x-fapi-auth-date 90 x-client-id 53 key 52 Set-Cookie 51 api_key 46 token 46 X-Auth-Token 44 WWW-Authenticate 43 Ocp-Apim-Subscription-Key 38 Cookie 15 x-fapi-customer-last-logged-time 4 Set-Cookie2 1 DPoP 1 Security-Scheme Include-Referred-Token-Binding-ID Hobareg DPoP-Nonce CTA-Common-Access-Token Cookie2 Concealed-Auth-Export Client-Cert Client-Cert-Chain Cert-Not-Before Cert-Not-After Authentication-Info Authentication-Control Sec-Token-Binding Proxy-Authentication-Info Proxy-Authenticate OSCORE Optional-WWW-Authenticate Lock-Token Proxy-Authorization

Authorization & Scope 2

Headers that carry what the caller is permitted to do, once identity is settled: scope, tenancy, delegated consent, acting-on-behalf-of.

x-cds-client-headers 61 x-fapi-financial-id 6

Caching 16

Headers that tell an intermediary what it may store and for how long. The oldest, best-specified corner of HTTP, and the one API providers most routinely ignore.

Cache-Control 144 Expires 26 Pragma 19 Vary 13 Warning 2 Surrogate-Control 1 Age 1 Meter Refresh CDN-Cache-Control Cache-Status Cache-Groups Cache-Group-Invalidation Surrogate-Capability AMP-Cache-Transform Memento-Datetime

Conditional Requests & Concurrency 13

Headers that make a request conditional on the state of a resource — the difference between a safe update and a lost one.

ETag 147 If-Match 106 If-None-Match 102 If-Modified-Since 60 Last-Modified 43 If-Unmodified-Since 12 Isolation If-Schedule-Tag-Match If-Range OData-Isolation Schedule-Tag Set-Txn If

Content Negotiation 27

Headers through which client and server agree on representation: media type, language, encoding, character set.

Accept 253 Accept-Language 90 Accept-Encoding 39 Accept-Charset 3 Accept-Datetime 1 IM GetProfile EDIINT-Features Differential-ID Dictionary-ID Derived-From Delta-Base Available-Dictionary Alternates Accept-Signature Accept-Query Accept-Post Accept-Patch Accept-Features A-IM Use-As-Dictionary TCN SetProfile Negotiate Accept-CH Accept-Additions Variant-Vary

Representation Metadata 33

Headers describing the payload itself — its type, length, encoding, disposition, location.

Content-Type 433 Location 346 Link 168 Content-Disposition 131 X-WP-Total 121 X-WP-TotalPages 121 Content-Length 83 Content-Encoding 51 Date 50 Range 49 X-Total-Count 46 Content-Range 26 Content-Language 23 Allow 14 Server 13 Content-MD5 12 Accept-Ranges 12 OData-EntityId 5 Label 3 SLUG 2 Position 1 URI ProfileObject Content-ID Schedule-Reply Content-Base CalDAV-Timezones Cal-Managed-ID Default-Style Content-Style-Type Content-Script-Type Ordering-Type Link-Template

Connection & Transport 57

Headers about the connection rather than the resource: hosts, upgrades, proxies, forwarding, keep-alive.

X-Amz-Target 58 Connection 24 Transfer-Encoding 21 Host 8 Sec-WebSocket-Protocol 7 Upgrade 6 Priority 5 SoapAction 3 Alt-Svc 3 Sec-WebSocket-Key 2 Topic 2 Expect 2 Sec-WebSocket-Accept 1 Keep-Alive 1 Urgency 1 TTL 1 Via 1 Sec-WebSocket-Extensions 1 TE 1 Sec-WebSocket-Version 1 Early-Data Destination Depth DAV ALPN Configuration-Context Close CDN-Loop Capsule-Protocol C-PEP C-PEP-Info C-Opt C-Man C-Ext Apply-To-Redirect-Ref Alt-Used Trailer Timeout Redirect-Ref Proxy-Status Proxy-Instruction Proxy-Features Protocol Protocol-Request Protocol-Query Protocol-Info PEP PEP-Info Overwrite Opt Max-Forwards Man Incremental HTTP2-Settings Forwarded Ext DASL

CORS 13

The cross-origin negotiation. A small, closed set of headers that decide whether a browser is allowed to see a response it already received.

Access-Control-Allow-Origin 41 Access-Control-Allow-Methods 22 Access-Control-Allow-Headers 20 Origin 16 Access-Control-Allow-Credentials 15 Access-Control-Expose-Headers 6 Access-Control-Max-Age 2 Access-Control-Request-Method 1 Access-Control-Request-Headers 1 Timing-Allow-Origin 1 Method-Check-Expires Method-Check Access-Control

Security Policy 26

Response headers instructing the client to constrain itself — transport security, framing, script sources, sniffing, referrer leakage.

Strict-Transport-Security 35 X-Content-Type-Options 35 X-Frame-Options 33 Content-Security-Policy 4 NEL 3 Expect-CT 3 Referrer-Policy 2 Public 1 PICS-Label Permissions-Policy Origin-Agent-Cluster Cross-Origin-Resource-Policy Cross-Origin-Opener-Policy Cross-Origin-Opener-Policy-Report-Only Cross-Origin-Embedder-Policy Cross-Origin-Embedder-Policy-Report-Only Sec-Fetch-User Sec-Fetch-Storage-Access Sec-Fetch-Site Sec-Fetch-Mode Sec-Fetch-Dest Reporting-Endpoints Public-Key-Pins Public-Key-Pins-Report-Only Content-Security-Policy-Report-Only Clear-Site-Data

Privacy & Consent 7

Headers carrying a person's preference or a legal consent artifact. The smallest category in the catalog by adoption and the largest by regulatory consequence.

x-fapi-customer-ip-address 94 PSU-IP-Address 9 Consent-ID 6 PSU-ID 3 Sec-GPC P3P Activate-Storage-Access

Rate Limiting & Quota 9

Headers that tell a caller where it stands against a limit. Documented limits give you the ceiling; these tell you your altitude.

Retry-After 330 X-RateLimit-Remaining 130 X-RateLimit-Limit 130 X-RateLimit-Reset 107 RateLimit 36 RateLimit-Policy 33 RateLimit-Limit 32 RateLimit-Remaining 30 RateLimit-Reset 29

Tracing & Correlation 12

Headers that let one call be followed across many systems — request ids, correlation ids, trace context.

X-Request-Id 106 x-fapi-interaction-id 99 id 39 Traceparent 7 Tracestate 2 Server-Timing CMCD-Object CMSD-Static CMSD-Dynamic CMCD-Status CMCD-Session CMCD-Request

Idempotency & Reliability 7

Headers that make a retry safe. Almost entirely a payments-industry invention that the rest of the API economy has not adopted.

Idempotency-Key 169 x-idempotency-key 52 Repeatability-Result 1 Repeatability-Request-ID 1 Repeatability-First-Sent 1 Safe Repeatability-Client-ID

Versioning & Lifecycle 9

Headers that carry version, deprecation and end-of-life. The category the catalog shows to be almost entirely unused, which is a finding rather than a gap in the data.

x-v 61 x-min-v 61 Sunset 10 Deprecation 7 OData-Version 3 OData-MaxVersion 1 MIME-Version OSLC-Core-Version Content-Version

Integrity & Signing 14

Headers carrying a digest or a signature over the message, so a recipient can prove it arrived as it was sent.

x-jws-signature 35 Signature 33 Digest 13 Tpp-Signature-Certificate 3 Content-Digest 3 Signature-Input 2 Replay-Nonce 2 Want-Repr-Digest Repr-Digest Want-Content-Digest Detached-JWS Want-Unencoded-Digest Want-Digest Unencoded-Digest

Async & Long-Running 5

Headers for work that does not finish inside the request: preference for async handling, polling locations, progress, retry timing.

Prefer 37 Content-Location 19 Last-Event-ID 9 Preference-Applied 4 Status-URI 1

Agent & Bot Identity 8

Headers by which an automated caller identifies itself, and by which a server decides what to serve it. The newest category, and the one with the least settled vocabulary.

User-Agent 82 x-customer-user-agent 33 Referer 11 From 5 Referer-Root Ping-To Ping-From Sec-Purpose