No law names this header. Several require encryption in transit, and this is what that instruction looks like on the wire.
Strict-Transport-Security
Security Policy IANA permanent response reached by regulation
HSTS tells a browser to refuse to talk to this host over plaintext HTTP for a stated period, no matter what a link, a redirect, or an attacker says. It closes the gap between “we support HTTPS” and “we cannot be downgraded”.
It is the clearest example in this catalog of an evidentiary header. The HIPAA Security Rule requires transmission security. The FTC’s 2021 amendments to the GLBA Safeguards Rule require encryption in transit explicitly. NIS2, OSFI B-13, APRA CPS 234 and the NHS DSPT all say versions of the same thing. None of them says “send this header.” All of them are, in practice, partly answered by whether you do.
Thirty-three providers declare it in a published contract — which is close to meaningless as a measure, because HSTS is set at the edge and almost nobody documents edge headers in an OpenAPI. This is the header that best demonstrates why contract-derived scoring and edge-probe scoring have to stay separate measurements.
The registry
Listed in the IANA HTTP Field Name Registry as a permanent entry. Defined in RFC 6797: HTTP Strict Transport Security (HSTS).
In the catalog
Declared by 33 providers across 2,568 published specification files in the API Evangelist catalog, where it appears as a response header — sent by the server.
Reached by regulation
No law names this header. It is evidentiary — the deployed control for an obligation that regulation does impose. It is observable at the edge: an unauthenticated request is enough to see whether a provider sends it.
No statute says “send HSTS.” Several say “encrypt data in transit,” and this is what that instruction looks like once it reaches the wire.
Using it
max-age=31536000; includeSubDomains, and add preload only once you are certain every subdomain can serve HTTPS forever — preload list removal is slow and painful. Set it at the edge, on the API host as well as the marketing site; an API that answers over plaintext is not protected by the HSTS policy on www.
Reached by these regulations
Catalogued at regulations.apievangelist.com, with the basis of each connection recorded rather than implied.
Governed by these rules
Machine-enforceable governance rules from rules.apievangelist.com that apply to this header when it appears in an OpenAPI.
OpenAPI Components Headers Error error
Utilizing the headers object in the centralized OpenAPI components library helps make headers reusable across API requests and responses
Guidance: Rate Limits →OpenAPI Components Headers Info info
Utilizing the headers object in the centralized OpenAPI components library helps make headers reusable across API requests and responses
Guidance: Rate Limits →OpenAPI Headers Hyphenated Pascal Case error
HTTP headers should follow Hyphenated-Pascal-Case naming convention for consistency and readability, such as Content-Type, X-Request-Id, or Accept-Language.
Guidance: Naming →