The header ePrivacy is actually about, and the one place consent violations are visible from outside.
Set-Cookie
Authentication IANA permanent response reached by regulation
Set-Cookie writes state into the client. In an API context it is often incidental — a session for the developer portal, an analytics tag on the docs — which is precisely why it goes unexamined.
The ePrivacy Directive requires prior consent before storing non-essential information on a user’s device. Not consent eventually, not consent recorded in a preference centre: prior. Which makes this the rare compliance question with a clean external test. Request the page fresh, with no cookie jar, and look at what comes back before any consent interaction has occurred. If non-essential cookies are already being set, the answer is visible to anyone with curl.
The registry
Listed in the IANA HTTP Field Name Registry as a permanent entry. Defined in RFC-ietf-httpbis-rfc6265bis-22, Section 5.8.1: Cookies: HTTP State Management Mechanism.
In the catalog
Declared by 37 providers across 505 published specification files in the API Evangelist catalog, where it appears as a response header — sent by the server.
Reached by regulation
No law names this header. It is evidentiary — the deployed control for an obligation that regulation does impose. It is observable at the edge: an unauthenticated request is enough to see whether a provider sends it.
Using it
Set Secure, HttpOnly and an explicit SameSite on anything session-bearing. Keep non-essential cookies behind a real consent gate rather than a banner that sets them on load. And check your API host, not just your web properties — an analytics cookie on a developer portal is inside the same obligation as one on a landing page.
Reached by these regulations
Catalogued at regulations.apievangelist.com, with the basis of each connection recorded rather than implied.
Governed by these rules
Machine-enforceable governance rules from rules.apievangelist.com that apply to this header when it appears in an OpenAPI.
OpenAPI Components Headers Error error
Utilizing the headers object in the centralized OpenAPI components library helps make headers reusable across API requests and responses
Guidance: Rate Limits →OpenAPI Components Headers Info info
Utilizing the headers object in the centralized OpenAPI components library helps make headers reusable across API requests and responses
Guidance: Rate Limits →OpenAPI Headers Hyphenated Pascal Case error
HTTP headers should follow Hyphenated-Pascal-Case naming convention for consistency and readability, such as Content-Type, X-Request-Id, or Accept-Language.
Guidance: Naming →OpenAPI Security Schemes API Keys In Header Error error
Having components security schemes which possesses an api-key property that allows to configure how API keys are applied to operations have a in of header set.
Guidance: Security →OpenAPI Security Schemes API Keys Info info
Having components security schemes which possesses an api-key property that allows to configure how API keys are applied to operations.
Guidance: Security →