x-fapi-customer-ip-address

Privacy & Consent de facto — unregistered request reached by regulation

A reference entry. The registry facts and catalog measurements below are complete; the written guidance for this header has not been authored yet.

x-fapi-customer-ip-address is privacy & consent — Headers carrying a person’s preference or a legal consent artifact. The smallest category in the catalog by adoption and the largest by regulatory consequence.

The registry

Not registered with IANA. It is a de facto or vendor field — real, widely used, and governed by nothing but convention.

In the catalog

Declared by 92 providers across 2,307 published specification files in the API Evangelist catalog, where it appears as a request header — sent by the client.

Reached by regulation

This header is mandated: the law, or a technical standard the law makes binding, names it directly. Only a credentialed caller can watch it in flight. The catalog can see that a contract declares it; it cannot see that a deployment honours it, and this site never claims otherwise.

A header whose whole purpose is to pass an end user’s IP address to a third party. Mandated by the open-banking regimes and squarely inside GDPR’s definition of personal data — worth reading next to [[gdpr]] rather than only next to the security profile that requires it.