HTTP Headers: Content Negotiation

HTTP headers carry metadata about the request or response. Content-Type declares the media type of the body being sent; Accept declares which media types the client can process. When a server cannot satisfy the Accept header, it returns 406 Not Acceptable. This mechanism allows the same endpoint to serve JSON, XML, or CSV depending on the client's preference. Request headers also carry authentication credentials (Authorization), caching directives (If-None-Match, If-Modified-Since), and correlation identifiers (X-Request-ID) useful for distributed tracing. Servers should echo back X-Request-ID in responses to enable end-to-end log correlation.

Example

# ----- Common Request Headers -----
GET /articles/42 HTTP/1.1
Host: api.example.com
Accept: application/json, application/xml;q=0.9, */*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOiI3In0.abc
Content-Type: application/json
X-Request-ID: 7c4e2b1a-9f3d-4a8e-b0c5-123456789abc
X-API-Version: 2024-01-01

# ----- Common Response Headers -----
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 342
Cache-Control: max-age=3600, must-revalidate
ETag: "abc123def456"
Last-Modified: Wed, 01 May 2024 12:00:00 GMT
X-Request-ID: 7c4e2b1a-9f3d-4a8e-b0c5-123456789abc
X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 987
X-RateLimit-Reset: 1714560000
Vary: Accept, Accept-Encoding

# ----- CORS Headers (preflight response) -----
HTTP/1.1 204 No Content
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
Access-Control-Allow-Headers: Authorization, Content-Type, X-Request-ID
Access-Control-Max-Age: 86400
Access-Control-Allow-Credentials: true

HTML

Full Editor

Related Resources

REST API Reference

Complete tag & property list

REST API How-To Guides

Step-by-step practical guides

REST API Exercises

Practice what you've learned