HTTP Headers

A header is the most-used extension point in HTTP and the part of an API a contract most often fails to describe. This is the catalog: every field in the IANA registry, every header the API Evangelist network observes in a published contract, and the standards, regulations, guidance and governance rules that reach each one.

How this was measured

Every in: header parameter and every headers: mapping key was extracted from 119,030 published specification files across all 26,641 providers in the API Evangelist network, then folded case-insensitively per RFC 9110 §5.1. A header earns a page here if it is registered with IANA, reached by a regulation, or declared by at least 25 distinct providers. The other 4,933 names are real but are almost entirely one-off vendor fields; they are searchable on APIs.io rather than written up here.

Authentication (44)

Headers that carry who the caller is — credentials, tokens, keys, signatures of identity. The most declared category in the catalog and the most inconsistently spelled.

Authentication-Control Authentication-Info Authorization 1176 CTA-Common-Access-Token Cert-Not-After Cert-Not-Before Client-Cert Client-Cert-Chain Concealed-Auth-Export Cookie 7 Cookie2 DPoP § DPoP-Nonce Hobareg Include-Referred-Token-Binding-ID Lock-Token OSCORE Ocp-Apim-Subscription-Key 34 Optional-WWW-Authenticate Proxy-Authenticate Proxy-Authentication-Info Proxy-Authorization Sec-Token-Binding Security-Scheme Set-Cookie 37 § Set-Cookie2 WWW-Authenticate 24 X-AUTH-TOKEN 41 X-Amz-Algorithm 96 X-Amz-Content-Sha256 97 X-Amz-Credential 96 X-Amz-Date 98 X-Amz-Security-Token 97 X-Amz-Signature 96 X-Amz-SignedHeaders 96 api-key 92 api_key 40 apikey 83 key 44 token 38 x-api-key 667 x-client-id 46 x-fapi-auth-date 88 § x-fapi-customer-last-logged-time 3 §

Authorization & Scope (2)

Headers that carry what the caller is permitted to do, once identity is settled: scope, tenancy, delegated consent, acting-on-behalf-of.

x-cds-client-headers 61 § x-fapi-financial-id 5 §

Caching (16)

Headers that tell an intermediary what it may store and for how long. The oldest, best-specified corner of HTTP, and the one API providers most routinely ignore.

AMP-Cache-Transform Age 1 CDN-Cache-Control Cache-Control 109 § Cache-Group-Invalidation Cache-Groups Cache-Status Expires 20 Memento-Datetime Meter Pragma 17 Refresh Surrogate-Capability Surrogate-Control 1 Vary 12 Warning

Conditional Requests & Concurrency (13)

Headers that make a request conditional on the state of a resource — the difference between a safe update and a lost one.

ETag 125 § If If-Match 76 § If-Modified-Since 52 If-None-Match 76 If-Range If-Schedule-Tag-Match If-Unmodified-Since 10 Isolation Last-Modified 29 OData-Isolation Schedule-Tag Set-Txn

Content Negotiation (27)

Headers through which client and server agree on representation: media type, language, encoding, character set.

A-IM Accept 183 Accept-Additions Accept-CH Accept-Charset 2 Accept-Datetime 1 Accept-Encoding 29 Accept-Features Accept-Language 69 Accept-Patch Accept-Post Accept-Query Accept-Signature Alternates Available-Dictionary Delta-Base Derived-From Dictionary-ID Differential-ID EDIINT-Features GetProfile IM Negotiate SetProfile TCN Use-As-Dictionary Variant-Vary

Representation Metadata (33)

Headers describing the payload itself — its type, length, encoding, disposition, location.

Accept-Ranges 6 Allow 6 Cal-Managed-ID CalDAV-Timezones Content-Base Content-Disposition 96 Content-Encoding 39 Content-ID Content-Language 16 § Content-Length 62 Content-MD5 11 Content-Range 17 Content-Script-Type Content-Style-Type Content-Type 353 Date 35 Default-Style Label 3 Link 98 Link-Template Location 272 OData-EntityId 4 Ordering-Type Position 1 ProfileObject Range 36 SLUG 1 Schedule-Reply Server 10 URI X-Total-Count 40 X-WP-Total 55 X-WP-TotalPages 55

Connection & Transport (57)

Headers about the connection rather than the resource: hosts, upgrades, proxies, forwarding, keep-alive.

ALPN Alt-Svc 2 Alt-Used Apply-To-Redirect-Ref C-Ext C-Man C-Opt C-PEP C-PEP-Info CDN-Loop Capsule-Protocol Close Configuration-Context Connection 21 DASL DAV Depth Destination Early-Data Expect 1 Ext Forwarded HTTP2-Settings Host 6 Incremental Keep-Alive Man Max-Forwards Opt Overwrite PEP PEP-Info Priority 5 Protocol Protocol-Info Protocol-Query Protocol-Request Proxy-Features Proxy-Instruction Proxy-Status Redirect-Ref Sec-WebSocket-Accept 1 Sec-WebSocket-Extensions 1 Sec-WebSocket-Key 2 Sec-WebSocket-Protocol 7 Sec-WebSocket-Version 1 SoapAction 3 TE 1 TTL 1 Timeout Topic 1 Trailer Transfer-Encoding 16 Upgrade 7 Urgency 1 Via 1 X-Amz-Target 61

CORS (13)

The cross-origin negotiation. A small, closed set of headers that decide whether a browser is allowed to see a response it already received.

Access-Control Access-Control-Allow-Credentials 11 Access-Control-Allow-Headers 16 Access-Control-Allow-Methods 16 Access-Control-Allow-Origin 30 § Access-Control-Expose-Headers 4 Access-Control-Max-Age 1 Access-Control-Request-Headers Access-Control-Request-Method Method-Check Method-Check-Expires Origin 14 Timing-Allow-Origin

Security Policy (26)

Response headers instructing the client to constrain itself — transport security, framing, script sources, sniffing, referrer leakage.

Clear-Site-Data § Content-Security-Policy 4 § Content-Security-Policy-Report-Only Cross-Origin-Embedder-Policy Cross-Origin-Embedder-Policy-Report-Only Cross-Origin-Opener-Policy Cross-Origin-Opener-Policy-Report-Only Cross-Origin-Resource-Policy Expect-CT 3 NEL 2 Origin-Agent-Cluster PICS-Label Permissions-Policy § Public 1 Public-Key-Pins Public-Key-Pins-Report-Only Referrer-Policy 2 Reporting-Endpoints Sec-Fetch-Dest Sec-Fetch-Mode Sec-Fetch-Site Sec-Fetch-Storage-Access Sec-Fetch-User Strict-Transport-Security 33 § X-Content-Type-Options 33 X-Frame-Options 30

Privacy & Consent (7)

Headers carrying a person's preference or a legal consent artifact. The smallest category in the catalog by adoption and the largest by regulatory consequence.

Activate-Storage-Access Consent-ID 3 § P3P PSU-IP-Address 3 § Sec-GPC § psu-id 1 § x-fapi-customer-ip-address 92 §

Rate Limiting & Quota (9)

Headers that tell a caller where it stands against a limit. Documented limits give you the ceiling; these tell you your altitude.

RateLimit 33 RateLimit-Limit 27 RateLimit-Policy 27 RateLimit-Remaining 26 RateLimit-Reset 25 Retry-After 229 § X-RateLimit-Limit 95 X-RateLimit-Remaining 96 X-RateLimit-Reset 76

Tracing & Correlation (12)

Headers that let one call be followed across many systems — request ids, correlation ids, trace context.

CMCD-Object CMCD-Request CMCD-Session CMCD-Status CMSD-Dynamic CMSD-Static Server-Timing Traceparent 6 Tracestate 2 X-Request-Id 68 id 28 x-fapi-interaction-id 156 §

Idempotency & Reliability (7)

Headers that make a retry safe. Almost entirely a payments-industry invention that the rest of the API economy has not adopted.

Idempotency-Key 127 Repeatability-Client-ID Repeatability-First-Sent 1 Repeatability-Request-ID 1 Repeatability-Result 1 Safe x-idempotency-key 45 §

Versioning & Lifecycle (9)

Headers that carry version, deprecation and end-of-life. The category the catalog shows to be almost entirely unused, which is a finding rather than a gap in the data.

Content-Version Deprecation 3 § MIME-Version OData-MaxVersion 1 OData-Version 3 OSLC-Core-Version Sunset 6 § x-min-v 61 § x-v 122 §

Integrity & Signing (14)

Headers carrying a digest or a signature over the message, so a recipient can prove it arrived as it was sent.

Content-Digest 1 Detached-JWS Digest 8 § Replay-Nonce 2 Repr-Digest Signature 25 § Signature-Input 2 Tpp-Signature-Certificate 2 § Unencoded-Digest Want-Content-Digest Want-Digest Want-Repr-Digest Want-Unencoded-Digest x-jws-signature 32 §

Async & Long-Running (5)

Headers for work that does not finish inside the request: preference for async handling, polling locations, progress, retry timing.

Content-Location 11 § Last-Event-ID 7 Prefer 29 § Preference-Applied 3 Status-URI 1

Agent & Bot Identity (8)

Headers by which an automated caller identifies itself, and by which a server decides what to serve it. The newest category, and the one with the least settled vocabulary.

From 4 Ping-From Ping-To Referer 9 Referer-Root Sec-Purpose User-Agent 71 x-customer-user-agent 30

Discovery

Learnings

Guidance

Toolbox

Alignment

API Evangelist LLC