A practical reference backed by the IANA HTTP registries, RFCs, MDN, WHATWG, and OWASP. Search registered status codes, methods, fields, and security guidance in one place.
64 status codes · 40 methods · 259 HTTP fields · 422 guides & patterns
IANA registry data refreshed 2026-09-19T21:09:24Z from iana.org (21 registry sources)
Showing 785 of 785 references. Search and filters are shareable by URL.
Lists the representation media types a client can read.
Use Accept for response content negotiation. A server can return 406 when none of its representations match, but many APIs choose a documented default.
Reference (http)
Accept: application/json, text/plain;q=0.8
Lists content codings a client can decode.
Use Accept-Encoding to negotiate gzip, br, or another supported coding. Send Vary: Accept-Encoding when the response changes by coding.
Reference (http)
Accept-Encoding: br, gzip
Gives the client's language preferences for the response.
Use it as a preference, not an absolute identity signal. Let users override language selection and send Vary: Accept-Language for cacheable variants.
Reference (http)
Accept-Language: en-US, de;q=0.8
Advertises patch document media types accepted by a resource.
Use Accept-Patch in OPTIONS or other responses so clients can discover whether JSON Patch, JSON Merge Patch, or another patch format is supported.
Reference (http)
Accept-Patch: application/json-patch+json, application/merge-patch+json
Advertises media types accepted by a resource for POST requests.
Use Accept-Post for resource capability discovery, especially in linked-data APIs.
Reference (http)
Accept-Post: application/ld+json
Advertises query syntax accepted by a resource for the QUERY method.
Use Accept-Query with the registered QUERY method so clients can discover supported query document formats.
Reference (http)
Accept-Query: application/json
Indicates whether a server supports range requests and which unit it accepts.
Use Accept-Ranges: bytes for resumable downloads and media seeking. Omission does not necessarily prove that ranges are unsupported.
Reference (http)
Accept-Ranges: bytes
Controls how long a browser may cache a successful CORS preflight result.
Use a bounded max age that matches how quickly the CORS policy changes. Browser-specific maximums can cap the value.
Reference (http)
Access-Control-Max-Age: 600
Reports the estimated time a response has been stored in a cache.
Use Age with Date and cache freshness calculations. It is generated by caches, not normally by an origin application.
Reference (http)
Age: 120
Lists methods supported by a resource.
Send Allow with 405 Method Not Allowed and use it for OPTIONS capability responses where appropriate.
Reference (http)
Allow: GET, HEAD, OPTIONS
Advertises an alternative service for reaching an origin.
Use Alt-Svc to let clients discover HTTP/2 or HTTP/3 endpoints without changing the origin URL. The client must validate the alternative service.
Reference (http)
Alt-Svc: h3=":443"; ma=86400
Alt-Svc advertises an alternative service where a resource can be reached.
Use Alt-Svc to advertise HTTP/2, HTTP/3, or another compatible endpoint. The client can switch after validating the alternative service.
Reference (http)
Alt-Svc: h3=":443"; ma=86400 Alt-Used: example.com
Indicates the alternative service used to reach an origin.
Use Alt-Used with Alt-Svc diagnostics; it does not redirect the origin or replace certificate and authority validation.
Reference (http)
Alt-Used: example.com
API validation should distinguish malformed syntax, unsupported media types, invalid fields, and conflicts with current resource state.
Use 400 for malformed request syntax, 415 for an unsupported representation format, 422 for semantically invalid content, and 409 for state conflicts. Return stable Problem Details with field-level extensions rather than leaking parser internals.
Reference (http)
HTTP/1.1 422 Unprocessable Content
Content-Type: application/problem+json
{"type":"https://api.example.com/problems/validation","status":422,"invalidParams":[{"name":"email","reason":"invalid format"}]}The asterisk is a special request-target form and registry wildcard, not a method or a literal header name.
OPTIONS * HTTP/1.1 targets the server as a whole, the fixed HTTP/2 connection preface is "PRI * HTTP/2.0", and * is a registered HTTP field-name wildcard used in values such as "Vary: *".
Reference (http)
OPTIONS * HTTP/1.1 Host: example.com PRI * HTTP/2.0
Carries credentials or an access token for a protected request.
Use a documented authentication scheme such as Bearer and keep credentials out of URLs, logs, and referrer data.
Reference (http)
Authorization: Bearer <access-token>
HTTP Basic authentication sends a user identifier and password encoded in each request credential.
Use Basic only over TLS and preferably behind a stronger session or gateway design. The base64 value is encoding, not encryption; enforce rate limits, credential rotation, and safe challenge handling.
Reference (http)
Authorization: Basic <base64(username:password)> WWW-Authenticate: Basic realm="api", charset="UTF-8"
Bulk endpoints apply one request to multiple resources and must define partial success, ordering, limits, and retry behavior.
Choose 200 or 207 when individual results are available, 202 when processing is queued, and an explicit item-level result shape for partial failures. Bound item count and body size, preserve idempotency, and make retries safe.
Reference (http)
POST /api/bulk/users HTTP/1.1
Idempotency-Key: bulk-01
Content-Type: application/json
{"items":[{"id":"u1","op":"disable"}]}HTTP caches decide whether a stored response is fresh, stale, or reusable after validation.
Use Cache-Control for freshness, ETag or Last-Modified for validation, and no-store for data that must not be stored. no-cache means revalidate, not do not store.
Reference (http)
Cache-Control: max-age=60, stale-while-revalidate=30 ETag: "v7"
A cache can serve a response to the wrong request when its key omits an input that changed the response.
Keep cache keys aligned with response variation, use Vary where required, normalize host and forwarded headers at trusted boundaries, and never cache personalized content as shared content by accident.
Reference (http)
Vary: Origin, Accept-Encoding Cache-Control: private
Controls caching behavior in browsers and shared caches.
Use explicit directives such as max-age, no-cache, no-store, private, and public according to the sensitivity and freshness requirements of each response. Each directive has its own entry in this library.
Reference (http)
Cache-Control: public, max-age=3600 Cache-Control: no-store
The private and public directives control whether a response may be stored in a private cache or shared cache.
Use private for user-specific responses and public only when shared reuse is safe. Neither directive encrypts a response or overrides a cache key that varies incorrectly.
Reference (http)
Cache-Control: private, max-age=60 Cache-Control: public, max-age=300
Tells caches the response body will never change while fresh.
immutable suits fingerprinted assets (/app.a1b2c3.js) and skips conditional revalidation on reload. Never use it on URLs whose content can change.
Reference (http)
Cache-Control: public, max-age=31536000, immutable
Sets how long a response is considered fresh, in seconds.
max-age=0 forces revalidation everywhere. Pair it with immutable for fingerprinted static assets that never change.
Reference (http)
Cache-Control: max-age=31536000, immutable
Forbids serving stale responses without successful revalidation once they expire.
Without it, caches may serve stale content in some cases (such as disconnected operation). It only applies after the response becomes stale.
Reference (http)
Cache-Control: max-age=3600, must-revalidate
Allows caching only when the cache understands the response status code.
must-understand (RFC 9111) lets caches store unusual statuses only if they implement their semantics, paired with no-store as the fallback for caches that do not.
Reference (http)
Cache-Control: must-understand, no-store
Allows storage but requires revalidation before reuse.
no-cache does not prevent storage. It forces a conditional request (ETag or Last-Modified) so the cache never serves out-of-date content without checking.
Reference (http)
Cache-Control: no-cache
Forbids caches from storing the response.
Use no-store for personalized or sensitive responses. It does not guarantee secrecy: users can still save responses, and some intermediaries handle it poorly.
Reference (http)
Cache-Control: no-store
The shared-cache equivalent of must-revalidate.
proxy-revalidate binds CDNs and proxies to revalidate stale responses; browsers are free to reuse expired content per their own policy.
Reference (http)
Cache-Control: max-age=600, proxy-revalidate
Overrides max-age for shared caches such as CDNs and proxies.
s-maxage lets a CDN cache for a long time while browsers revalidate sooner. Browsers ignore s-maxage entirely.
Reference (http)
Cache-Control: max-age=60, s-maxage=86400
Lets caches serve stale content when the origin returns an error.
Stale-if-error improves resilience during origin outages for the given number of seconds after expiry, but it also masks short outages from monitoring.
Reference (http)
Cache-Control: max-age=300, stale-if-error=86400
Lets caches serve a stale response while revalidating it asynchronously.
The window is a grace period in seconds after expiry. It trades freshness for latency; do not combine it with content that must be authoritative.
Reference (http)
Cache-Control: max-age=60, stale-while-revalidate=30
Describes how a cache handled a response.
Use Cache-Status for observability across cache layers, while avoiding sensitive internal topology or user data in its values.
Reference (http)
Cache-Status: CDN; hit; ttl=300
Cache-Status parameters explain how a cache handled a request, including hit status, freshness, stored age, and key selection.
Expose Cache-Status only when its diagnostic detail is safe for the audience. Strip internal hostnames, cache keys, and topology data at trust boundaries.
Reference (http)
Cache-Status: CDN; hit; ttl=300; age=42; fwd=stale
Provides cache directives targeted at content delivery networks.
Use CDN-Cache-Control to separate CDN policy from browser Cache-Control, and document precedence when multiple cache layers interpret both.
Reference (http)
CDN-Cache-Control: public, max-age=600
Instructs a browser to clear selected cached, storage, or execution data for an origin.
Use Clear-Site-Data during logout or incident response when the browser must discard cookies, storage, or cache data.
Reference (http)
Clear-Site-Data: "cache", "cookies", "storage"
Content-Type values that tell clients how to interpret common web resources.
Return an accurate Content-Type for every resource; do not rely on browsers to infer it.
Common values (http)
text/html; charset=utf-8 text/css text/javascript application/json application/pdf image/svg+xml image/webp
Establishes a tunnel to the server identified by the request target.
Use CONNECT for proxy tunneling, such as establishing a TLS tunnel through an HTTP proxy. It is neither safe nor idempotent.
Reference (http)
CONNECT origin.example.com:443 HTTP/1.1 Host: proxy.example.com
HTTP connection management controls how clients, servers, and proxies reuse transport connections.
HTTP/1.1 normally reuses connections. HTTP/2 multiplexes streams over one connection, while HTTP/3 maps HTTP over QUIC. Connection is hop-by-hop and must not be forwarded as an end-to-end field.
Reference (http)
Connection: keep-alive Keep-Alive: timeout=5, max=100
Content negotiation selects the representation that best matches a request and the server's available variants.
Use Accept, Accept-Encoding, and Accept-Language to negotiate media type, content coding, and language. Send Vary when the selected response changes with a request field.
Reference (http)
Accept: application/json Accept-Encoding: br, gzip Accept-Language: en-US, de;q=0.8
Provides a digest of the content bytes framed in an HTTP message.
Use Content-Digest when the recipient needs to verify transmitted content. Its covered bytes depend on content encoding and content range.
Reference (http)
Content-Digest: sha-256=:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZc3g=:
Suggests whether a response should be displayed inline or downloaded as an attachment.
Use attachment with a safe, explicit filename for downloads and validate untrusted filenames before placing them in a header.
Reference (http)
Content-Disposition: attachment; filename="report.pdf"
Describes content codings applied to a representation.
Content-Encoding is different from Transfer-Encoding: it describes representation compression such as br or gzip.
Reference (http)
Content-Encoding: br Vary: Accept-Encoding
Identifies the language intended for a representation's audience.
Use Content-Language with localized representations and include it in Vary when it affects cache selection.
Reference (http)
Content-Language: en-US
States the size of message content in bytes when known.
Use it for fixed-length content and let the protocol framing rules handle streamed content. Never accept conflicting length signals.
Reference (http)
Content-Length: 27
Identifies a URI for the representation in a response or request.
Use Content-Location to identify the representation's URI; it is not the same as Location, which directs a client to another target.
Reference (http)
Content-Location: /representations/user-42.json
Describes where partial content belongs in the complete representation.
Use Content-Range with 206 responses and 416 errors. The complete size can be unknown for an unsatisfied upload or stream.
Reference (http)
Content-Range: bytes 0-999/5000
Controls which sources the browser may load for scripts, styles, images, frames, and other content.
CSP reduces the impact of cross-site scripting by restricting where executable content can come from.
Starter policy (http)
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; object-src 'none'; frame-ancestors 'none'; base-uri 'self'
Describes the media type of a request or response body.
Set Content-Type accurately, including a charset where needed. Servers should validate request types instead of parsing whatever bytes arrive.
Reference (http)
Content-Type: application/json; charset=utf-8
Sends stored cookies that match the request URL and cookie policies.
Browsers build Cookie from stored cookies; application clients must follow the cookie rules and should not put sensitive state in arbitrary values.
Reference (http)
Cookie: session=abc123; theme=dark
Set-Cookie creates or updates a cookie; Cookie sends matching stored cookies back to the server.
Use Max-Age or Expires for lifetime, Domain and Path for scope, and a matching name, path, and domain when deleting a cookie. Cookies are sent with later matching requests.
Reference (http)
Set-Cookie: session=abc123; Max-Age=3600; Path=/ Cookie: session=abc123
__Host- and __Secure- cookie prefixes let browsers enforce important cookie-setting invariants.
Use __Host- for a host-only Secure cookie with Path=/ and no Domain. Use __Secure- when Secure is required but a narrower Path or explicit Domain is necessary.
Reference (http)
Set-Cookie: __Host-session=abc; Secure; HttpOnly; SameSite=Lax; Path=/
Cookie name prefixes let supporting browsers enforce extra constraints on how a cookie is set.
__Secure- requires Secure and an HTTPS setting context. __Host- also requires Path=/ and no Domain. Newer __Http- and __Host-Http- prefixes add HttpOnly requirements where supported.
Reference (http)
Set-Cookie: __Host-session=abc123; Secure; HttpOnly; Path=/
Domain, Path, Expires, and Max-Age control where and how long a browser sends a cookie.
Prefer host-only cookies without Domain when possible. Use Path to narrow delivery, Max-Age or Expires for deliberate lifetime control, and delete a cookie with the same name, Domain, and Path used to set it.
Reference (http)
Set-Cookie: session=abc; Secure; HttpOnly; SameSite=Lax; Path=/; Max-Age=3600
Headers that control cross-origin window relationships, embedding, and resource loading.
Use Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, and Cross-Origin-Resource-Policy together only when the application has tested its cross-origin dependencies.
Reference (http)
Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-origin
The Access-Control fields describe which cross-origin browser requests and response fields are permitted.
Use Allow-Origin, Allow-Methods, Allow-Headers, Allow-Credentials, Expose-Headers, and Max-Age as one coherent policy rather than adding headers until an error disappears.
Reference (http)
Access-Control-Allow-Origin: https://app.example.com Access-Control-Allow-Methods: GET, POST Access-Control-Allow-Headers: Content-Type
CORS controls whether browser JavaScript may read a cross-origin response and whether credentials are included.
Use Access-Control-Allow-Credentials for credentialed requests, never combine it with a wildcard origin, and list non-safelisted response fields in Access-Control-Expose-Headers.
Reference (http)
Access-Control-Allow-Origin: https://app.example.com Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: ETag
A browser sends an OPTIONS preflight before a cross-origin request that needs permission.
Respond to Access-Control-Request-Method and Access-Control-Request-Headers with the allowed origin, methods, and headers. Cache the result with Access-Control-Max-Age when appropriate.
Reference (http)
OPTIONS /api/data HTTP/1.1 Origin: https://app.example.com Access-Control-Request-Method: PUT Access-Control-Request-Headers: Authorization, Content-Type
A browser-enforced mechanism that lets a server declare which other origins may read its responses.
Configure CORS on the server that owns the resource; adding a header to the frontend cannot bypass the browser policy.
Response headers (http)
Access-Control-Allow-Origin: https://app.example.com Access-Control-Allow-Methods: GET, POST Access-Control-Allow-Headers: Content-Type, Authorization Vary: Origin
An attack where a victim browser is induced to send an authenticated state-changing request.
Use SameSite cookies, CSRF tokens, and Origin or Referer validation as appropriate for cookie-authenticated applications.
Reference (http)
Origin: https://app.example.com X-CSRF-Token: <token>
XSS occurs when attacker-controlled data becomes executable markup or script in another user’s browser.
Prefer framework auto-escaping, context-aware output encoding, safe DOM APIs such as textContent, and strict CSP. Treat innerHTML, template interpolation in raw HTML, URL sinks, and script construction as explicit security boundaries.
Reference (http)
<div>{escapeHtml(userProvidedText)}</div>
node.textContent = userProvidedText;CSP-Report-Only lets a site observe policy violations without blocking the affected resource.
Use report-only mode to discover dependencies before enforcement. Treat reports as untrusted input and move to an enforcing policy after reviewing real traffic.
Reference (http)
Content-Security-Policy-Report-Only: default-src 'self'; report-to csp-endpoint
CSRF tokens bind a state-changing request to an application interaction that an attacker’s site cannot reproduce.
Use a synchronizer token for server-side sessions or a carefully implemented signed double-submit cookie for stateless flows. Validate the token server-side, require it on state-changing methods, and combine it with SameSite and Origin checks.
Reference (http)
POST /profile HTTP/1.1 Origin: https://app.example.com X-CSRF-Token: random-server-checked-value
Records when a response message was originated.
Origin servers should send Date on most responses. Intermediaries use it with age and freshness calculations.
Reference (http)
Date: Tue, 15 Nov 1994 08:12:31 GMT
Requests that the target resource be deleted.
Use DELETE when the target resource defines deletion semantics. DELETE is idempotent, but repeating it can still return a different status such as 404.
Reference (http)
DELETE /api/users/42 HTTP/1.1 Host: api.example.com
DPoP binds an OAuth access token to a sender-held private key and signs each HTTP request with a proof JWT.
Validate the proof signature, nonce when required, method, URI, issued-at time, unique identifier, and token key binding. DPoP limits replay of a stolen token but does not remove the need for TLS or secure key storage.
Reference (http)
DPoP: eyJ... Authorization: DPoP eyJ-access-token...
Signals that a resource or API feature is deprecated.
Use Deprecation with documentation, migration guidance, and a planned removal policy. It is a signal, not automatic enforcement.
Reference (http)
Deprecation: @1735689600
Digest authentication proves knowledge of a password through a challenge-response exchange instead of sending the password directly.
Digest reduces password exposure on the wire but is not a modern replacement for TLS, has complex nonce and algorithm rules, and should be selected only when interoperability requires it.
Reference (http)
WWW-Authenticate: Digest realm="api", nonce="...", algorithm=SHA-256, qop="auth" Authorization: Digest username="alice", realm="api", nonce="...", uri="/me", response="..."
Signals that a request was sent in TLS 1.3 early data.
Use Early-Data with replay-safe handling and return 425 Too Early when a request must not be processed before replay risk is acceptable.
Reference (http)
Early-Data: 1
A validator that lets clients revalidate or protect updates to a representation.
Use ETag with If-None-Match for efficient reads and If-Match to prevent lost updates during writes.
Reference (http)
ETag: "user-42-v7" If-Match: "user-42-v7"
States an expectation the server must fulfill before processing a request.
Use Expect: 100-continue to avoid sending a large body before the server accepts the request headers. Do not invent unsupported expectations.
Reference (http)
Expect: 100-continue
Gives an absolute date after which a response is considered stale.
Use Cache-Control max-age for modern freshness policy; Expires remains useful for compatibility and must be a valid HTTP date.
Reference (http)
Expires: Wed, 21 Oct 2015 07:28:00 GMT
Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest, and Sec-Fetch-User describe how a browser initiated a request.
Use Fetch Metadata as a defense-in-depth request policy, especially to reject cross-site state-changing requests. Provide a deliberate fallback for clients that do not send the fields.
Reference (http)
Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty
Fetch Metadata fields describe the browser context that initiated a request.
Use Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-User, and Sec-Fetch-Dest as defense-in-depth signals for navigation, same-origin, same-site, and cross-site requests.
Reference (http)
Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty
Forwarded carries client-facing protocol, host, and address information across configured intermediaries.
Trust Forwarded only when a known proxy has stripped and rebuilt the field. Normalize and authenticate the proxy chain before using it for redirects, access control, auditing, or URL generation.
Reference (http)
Forwarded: for=203.0.113.7;proto=https;host=example.com
Requests a representation of the target resource.
Use GET to retrieve data without requesting a state change. GET is safe, idempotent, and commonly cacheable.
Reference (http)
GET /api/users/42 HTTP/1.1 Host: api.example.com
Returns the headers a GET would return without a response body.
Use HEAD for metadata checks, availability checks, and cache or download decisions without transferring the representation.
Reference (http)
HEAD /assets/app.js HTTP/1.1 Host: example.com
Identifies the authority targeted by an HTTP/1.1 request.
Use Host for virtual hosting and validate it against accepted hostnames. HTTP/2 and HTTP/3 carry the authority as a pseudo-field.
Reference (http)
Host: api.example.com
The server received the initial request headers and the client may continue sending the request body.
Use 100 Continue for an Expect: 100-continue handshake before a potentially large request body.
Response (http)
HTTP/1.1 100 Continue
The server agrees to change the protocol used by the connection.
Use 101 for protocol upgrades such as a WebSocket handshake.
Response (http)
HTTP/1.1 101 Switching Protocols
An obsolete WebDAV interim response that was once used while a request was being processed.
Do not use 102 for new applications: MDN records it as deprecated and RFC 4918 removed it from the current WebDAV specification.
Response (http)
HTTP/1.1 102 Processing
The server sends preliminary headers before the final response.
Use 103 to send Link preload or preconnect hints while the final response is being prepared.
Response (http)
HTTP/1.1 103 Early Hints
The server supports the temporary resumable-upload protocol extension.
Use 104 only when implementing the registered resumable upload extension; it is temporary and currently expires on 2026-11-13.
Response (http)
HTTP/1.1 104 Upload Resumption Supported
The request succeeded and the response contains the requested result.
Use 200 when a request completed successfully and the response has a useful representation to return.
Response (http)
HTTP/1.1 200 OK
Content-Type: application/json
{"ok":true}The request succeeded and created a new resource.
Return 201 when a POST or other operation creates a new resource.
Response (http)
HTTP/1.1 201 Created
Location: /api/users/42
Content-Type: application/json
{"id":42}The request was accepted for processing, but processing has not completed.
Use 202 for asynchronous jobs and provide a way to check their status.
Response (http)
HTTP/1.1 202 Accepted
The response metadata or representation came from a transforming intermediary.
Use 203 when a proxy has modified a successful response from its origin.
Response (http)
HTTP/1.1 203 Non-Authoritative Information
The request succeeded, but there is no response body to return.
Use 204 for successful operations where the client does not need a representation in the response.
Response (http)
HTTP/1.1 204 No Content Cache-Control: no-store
The request succeeded and the client should reset the document or input view.
Use 205 when a form or editor should return to its initial state without a response body.
Response (http)
HTTP/1.1 205 Reset Content
The server is returning the requested byte range rather than the complete representation.
Use 206 to support resumable downloads and media seeking with Range requests.
Response (http)
HTTP/1.1 206 Partial Content
The response contains independent status values for multiple related resources.
Use 207 for WebDAV-style batch operations where one status cannot describe every item.
Response (http)
HTTP/1.1 207 Multi-Status
Members of a WebDAV binding have already been reported in an earlier response.
Use 208 to avoid repeating members in a multistatus response.
Response (http)
HTTP/1.1 208 Already Reported
The server fulfilled a GET request using one or more instance manipulations.
Use 226 for delta encoding when the client and server negotiate an instance-manipulation format.
Response (http)
HTTP/1.1 226 IM Used
The request has more than one possible representation or redirect target.
Use 300 when the client must choose between several representations or locations.
Response (http)
HTTP/1.1 300 Multiple Choices
The target resource has a new permanent URL.
Use 301 for a permanent redirect and update links, caches, and canonical URLs to the new location.
Response (http)
HTTP/1.1 301 Moved Permanently
The target resource is temporarily available at another URL.
Use 302 for a temporary redirect when the original URL should remain the public address.
Response (http)
HTTP/1.1 302 Found
The response can be found at another URL and should be retrieved with GET.
Use 303 after a POST when redirecting the browser to a result or status page.
Response (http)
HTTP/1.1 303 See Other
The request condition indicates that the client can reuse its stored representation without receiving a response body.
Use 304 for a conditional GET or HEAD with ETag or Last-Modified validation when the client can reuse its stored body.
Response (http)
HTTP/1.1 304 Not Modified
The requested resource must be accessed through the proxy specified by the response.
Avoid 305 in modern applications; it is deprecated because of security concerns.
Response (http)
HTTP/1.1 305 Use Proxy
This status code is reserved and is not used in current HTTP semantics.
Do not generate 306; it is retained in the registry for historical compatibility.
Response (http)
HTTP/1.1 306 (Unused)
The target is temporarily available elsewhere and the HTTP method and body must be preserved.
Use 307 when a temporary redirect must not turn POST into GET.
Response (http)
HTTP/1.1 307 Temporary Redirect
The target has a permanent new URL and the HTTP method and body must be preserved.
Use 308 for permanent method-preserving redirects, especially for APIs.
Response (http)
HTTP/1.1 308 Permanent Redirect
The server cannot process the request because its syntax or input is invalid.
Use 400 for malformed JSON, invalid query syntax, or an otherwise structurally invalid request.
Response (http)
HTTP/1.1 400 Bad Request
The request lacks valid authentication credentials.
Use 401 when the client must authenticate or refresh invalid credentials; include an appropriate WWW-Authenticate challenge.
Response (http)
HTTP/1.1 401 Unauthorized
The request cannot proceed because payment or quota requirements are not satisfied; the status is reserved for future use by HTTP semantics.
Use 402 only when your API documents a product-specific billing or quota contract; HTTP does not define one universal payment workflow.
Response (http)
HTTP/1.1 402 Payment Required
The server understood the request but refuses to fulfill it; valid authentication credentials do not necessarily change the outcome.
Use 403 when the server will not authorize the requested action, whether because of permissions, policy, or another deliberate access decision.
Response (http)
HTTP/1.1 403 Forbidden
The server cannot find the requested resource or is unwilling to disclose that it exists.
Return 404 when the requested URL or resource does not exist.
JSON error (json)
{
"error": "not_found",
"message": "The requested resource was not found"
}The target resource exists but does not support the request method.
Use 405 and include an Allow header listing the methods supported by the resource.
Response (http)
HTTP/1.1 405 Method Not Allowed
The server cannot produce a representation matching the request Accept headers.
Use 406 when content negotiation has no representation acceptable to the client.
Response (http)
HTTP/1.1 406 Not Acceptable
The client must authenticate with the proxy before the request can proceed.
Use 407 for proxy authentication challenges, not for authentication with the origin server.
Response (http)
HTTP/1.1 407 Proxy Authentication Required
The server did not receive a complete request within the time it was prepared to wait.
Use 408 when an idle or incomplete client connection times out; clients may retry when safe.
Response (http)
HTTP/1.1 408 Request Timeout
The request conflicts with the current state of the target resource.
Use 409 for edit conflicts, duplicate unique values, or state transitions that cannot currently be applied.
Response (http)
HTTP/1.1 409 Conflict
The target resource was intentionally removed and is not expected to return.
Use 410 when a resource has been permanently deleted and clients should stop retrying its old URL.
Response (http)
HTTP/1.1 410 Gone
The server requires a Content-Length header on the request.
Use 411 when the server cannot accept a request without a declared body length.
Response (http)
HTTP/1.1 411 Length Required
One or more request conditions evaluated to false.
Use 412 when If-Match, If-Unmodified-Since, or another conditional request fails.
Response (http)
HTTP/1.1 412 Precondition Failed
The request body is larger than the server is willing or able to process.
Use 413 for oversized uploads and tell clients the applicable limit when possible.
Response (http)
HTTP/1.1 413 Content Too Large
The request target is longer than the server is willing to interpret.
Use 414 when query parameters or path segments exceed safe request-target limits.
Response (http)
HTTP/1.1 414 URI Too Long
The request body format is not supported by the target resource.
Use 415 when Content-Type is missing, invalid, or not accepted by the endpoint.
Response (http)
HTTP/1.1 415 Unsupported Media Type
The requested byte range cannot be served.
Use 416 when a Range falls outside the selected representation and include the valid size with Content-Range when useful.
Response (http)
HTTP/1.1 416 Range Not Satisfiable
The server cannot meet the requirements in the Expect request header.
Use 417 when an Expect extension or 100-continue expectation cannot be fulfilled.
Response (http)
HTTP/1.1 417 Expectation Failed
The historic "I'm a teapot" response is reserved and is not used in current HTTP semantics.
Do not generate 418 for application errors; the current HTTP registry marks it unused, despite its historic teapot origin.
Response (http)
HTTP/1.1 418 (Unused)
The request was sent to a server that cannot produce a response for the target authority.
Use 421 for connection reuse or HTTP/2 routing situations where the request authority is wrong.
Response (http)
HTTP/1.1 421 Misdirected Request
The request is syntactically valid but contains semantic or validation errors.
Use 422 for field validation and domain rules when the JSON shape itself is valid.
Response (http)
HTTP/1.1 422 Unprocessable Content
The target resource is locked and cannot currently be modified.
Use 423 for WebDAV resources or application resources with an explicit lock state.
Response (http)
HTTP/1.1 423 Locked
The requested action failed because a dependent action failed.
Use 424 for a batch or WebDAV operation blocked by an earlier failed dependency.
Response (http)
HTTP/1.1 424 Failed Dependency
The server is unwilling to risk processing a request that might be replayed.
Use 425 with replay-sensitive early data when the request is not safe to process yet.
Response (http)
HTTP/1.1 425 Too Early
The client must switch to another protocol to use the resource.
Use 426 when a protocol upgrade is required and identify it with an Upgrade header.
Response (http)
HTTP/1.1 426 Upgrade Required
The server requires the request to be conditional.
Use 428 to prevent lost updates by requiring a validator such as If-Match.
Response (http)
HTTP/1.1 428 Precondition Required
The client has exceeded a rate limit in a given period.
Use 429 for throttling and include Retry-After plus RateLimit-* quota metadata when clients can retry later.
Response (http)
HTTP/1.1 429 Too Many Requests
The request headers are too large for the server to process.
Use 431 when cookies or custom headers exceed configured limits.
Response (http)
HTTP/1.1 431 Request Header Fields Too Large
The resource is unavailable because of a legal demand or restriction.
Use 451 when access is blocked for legal reasons and provide an explanation when permitted.
Response (http)
HTTP/1.1 451 Unavailable For Legal Reasons
The server encountered an unexpected condition that prevented it from fulfilling the request.
Use 500 for unexpected server failures and avoid exposing stack traces or sensitive internals.
Response (http)
HTTP/1.1 500 Internal Server Error
The server does not support the functionality required to fulfill the request.
Use 501 when the server genuinely does not implement the method or capability requested.
Response (http)
HTTP/1.1 501 Not Implemented
A gateway or proxy received an invalid response from an upstream server.
Use 502 when your service depends on an upstream that responded incorrectly or unexpectedly.
Response (http)
HTTP/1.1 502 Bad Gateway
The server is temporarily unable to handle the request.
Use 503 during overload, maintenance, or dependency outages and provide Retry-After when appropriate.
Response (http)
HTTP/1.1 503 Service Unavailable
A gateway or proxy did not receive a timely response from an upstream server.
Use 504 when an upstream dependency times out before your gateway can complete the request.
Response (http)
HTTP/1.1 504 Gateway Timeout
The server does not support the HTTP version used in the request.
Use 505 when protocol-version negotiation cannot satisfy the client request.
Response (http)
HTTP/1.1 505 HTTP Version Not Supported
The selected representation is configured to negotiate again and creates a loop.
Use 506 to report a server-side transparent content negotiation configuration error.
Response (http)
HTTP/1.1 506 Variant Also Negotiates
The server cannot store the representation needed to complete the request.
Use 507 when a WebDAV or storage-backed operation runs out of available space.
Response (http)
HTTP/1.1 507 Insufficient Storage
The server detected an infinite loop while processing the request.
Use 508 for cyclic WebDAV dependencies or equivalent server-side traversal loops.
Response (http)
HTTP/1.1 508 Loop Detected
The former extension mechanism response is obsolete and should not be used for new protocols.
Do not use 510 in new applications; it is retained as an obsoleted registry entry.
Response (http)
HTTP/1.1 510 Not Extended (Obsoleted)
The client must authenticate to gain network access through an intercepting network intermediary.
Use 511 for captive portals or network access control, not ordinary origin-server application login.
Response (http)
HTTP/1.1 511 Network Authentication Required
The registered ACL request method from the IANA HTTP Method Registry.
ACL is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
ACL /resource HTTP/1.1 Host: example.com
Pagination limits response size and gives clients a stable way to traverse a changing collection.
Prefer opaque cursor pagination for frequently changing data. Return a clear next link or cursor, define ordering and consistency, and enforce limits server-side.
Reference (http)
GET /api/events?limit=50&after=opaque-cursor HTTP/1.1 Link: </api/events?limit=50&after=next>; rel="next"
API versioning lets incompatible contract changes coexist while clients migrate deliberately.
Prefer additive evolution where possible. When a breaking version is necessary, document the selection mechanism, keep representations and error semantics consistent, emit Deprecation and Sunset signals, and publish a migration path before removal.
Reference (http)
GET /api/v2/users HTTP/1.1 Deprecation: @1798761600 Sunset: Wed, 31 Dec 2026 23:59:59 GMT
HTTP authentication uses a challenge from the server and credentials from the client.
A protected origin returns 401 with WWW-Authenticate. The client retries with Authorization. A proxy uses 407, Proxy-Authenticate, and Proxy-Authorization instead.
Reference (http)
HTTP/1.1 401 Unauthorized WWW-Authenticate: Bearer realm="api" Authorization: Bearer <token>
The registered BASELINE-CONTROL request method from the IANA HTTP Method Registry.
BASELINE-CONTROL is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
BASELINE-CONTROL /resource HTTP/1.1 Host: example.com
The registered BIND request method from the IANA HTTP Method Registry.
BIND is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
BIND /resource HTTP/1.1 Host: example.com
The registered CHECKIN request method from the IANA HTTP Method Registry.
CHECKIN is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
CHECKIN /resource HTTP/1.1 Host: example.com
The registered CHECKOUT request method from the IANA HTTP Method Registry.
CHECKOUT is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
CHECKOUT /resource HTTP/1.1 Host: example.com
Client Hints let a server request selected information about a browser, device, network, or user preference.
Use Accept-CH to opt into hints, vary responses carefully, and request only information the application needs. Client hints can expose device and preference data.
Reference (http)
Accept-CH: Sec-CH-UA-Mobile, Sec-CH-Prefers-Color-Scheme Vary: Sec-CH-UA-Mobile
Content codings reduce the bytes sent over the network while keeping the selected representation identifiable.
Negotiate compression with Accept-Encoding and describe the applied coding with Content-Encoding. Compress text and structured data, but avoid compressing data that is already compressed.
Reference (http)
Accept-Encoding: br, gzip Content-Encoding: br Vary: Accept-Encoding
Digest fields let senders and recipients verify bytes or representations in an HTTP exchange.
Use Content-Digest for the message content and Repr-Digest for the selected representation. Account for content encoding and range responses when choosing which digest applies.
Reference (http)
Content-Digest: sha-256=:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZc3g=:
The registered COPY request method from the IANA HTTP Method Registry.
COPY is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
COPY /resource HTTP/1.1 Host: example.com
HTTP digest and signature mechanisms detect alteration only when sender and recipient cover the same bytes and validate the algorithm and context.
Prefer SHA-256 or stronger approved algorithms, define whether content or the selected representation is covered, and pair integrity with authentication, freshness, and authorization checks.
Reference (http)
Content-Digest: sha-256=:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZc3g=: Repr-Digest: sha-256=:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZc3g=:
The registered LABEL request method from the IANA HTTP Method Registry.
LABEL is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
LABEL /resource HTTP/1.1 Host: example.com
The registered LINK request method from the IANA HTTP Method Registry.
LINK is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
LINK /resource HTTP/1.1 Host: example.com
The registered LOCK request method from the IANA HTTP Method Registry.
LOCK is not safe and not idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
LOCK /resource HTTP/1.1 Host: example.com
The registered MERGE request method from the IANA HTTP Method Registry.
MERGE is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
MERGE /resource HTTP/1.1 Host: example.com
HTTP Message Signatures authenticate selected HTTP components using a signature input definition and a cryptographic signature.
Validate the key, covered components, derived component values, created/expires bounds, nonce policy, and request context. Signatures do not automatically protect headers that were left out.
Reference (http)
Signature-Input: sig1=("@method" "@target-uri" "content-digest");created=1720000000;keyid="api-key"
Signature: sig1=:base64-signature:HTTP Message Signatures let a sender sign selected message components for integrity and authentication.
Use Signature-Input and Signature with a defined key and component list. Decide which intermediaries may change signed fields before forwarding a request.
Reference (http)
Signature-Input: sig1=("@method" "@target-uri" "content-digest");created=1720000000;keyid="api-key"The structure of HTTP requests and responses, including start lines, fields, and content.
Requests contain a method, target, and fields. Responses contain a status code and fields. HTTP/2 and HTTP/3 carry the same semantics in binary frames rather than HTTP/1.1 text syntax.
Reference (http)
POST /api/users HTTP/1.1
Host: api.example.com
Content-Type: application/json
Content-Length: 15
{"name":"Ada"}The registered MKACTIVITY request method from the IANA HTTP Method Registry.
MKACTIVITY is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
MKACTIVITY /resource HTTP/1.1 Host: example.com
The registered MKCALENDAR request method from the IANA HTTP Method Registry.
MKCALENDAR is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
MKCALENDAR /resource HTTP/1.1 Host: example.com
The registered MKCOL request method from the IANA HTTP Method Registry.
MKCOL is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
MKCOL /resource HTTP/1.1 Host: example.com
The registered MKREDIRECTREF request method from the IANA HTTP Method Registry.
MKREDIRECTREF is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
MKREDIRECTREF /resource HTTP/1.1 Host: example.com
The registered MKWORKSPACE request method from the IANA HTTP Method Registry.
MKWORKSPACE is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
MKWORKSPACE /resource HTTP/1.1 Host: example.com
The registered MOVE request method from the IANA HTTP Method Registry.
MOVE is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
MOVE /resource HTTP/1.1 Host: example.com
The registered ORDERPATCH request method from the IANA HTTP Method Registry.
ORDERPATCH is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
ORDERPATCH /resource HTTP/1.1 Host: example.com
HTTP is a stateless request and response protocol used to transfer representations between clients, servers, and intermediaries.
An HTTP exchange has a request, a response, and metadata in fields. Browsers usually fetch a document and then make more requests for its scripts, styles, images, and data.
Reference (http)
GET / HTTP/1.1 Host: example.com HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8
The registered PRI request method from the IANA HTTP Method Registry.
PRI is safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
PRI * HTTP/2.0
The Priority field gives a server a hint about the urgency and incremental delivery preference for a request.
Use Priority as a scheduling hint, not a correctness or authorization control. HTTP/2 and HTTP/3 can also reprioritize streams with protocol frames.
Reference (http)
Priority: u=1, i
The registered PROPFIND request method from the IANA HTTP Method Registry.
PROPFIND is safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
PROPFIND /resource HTTP/1.1 Host: example.com
The registered PROPPATCH request method from the IANA HTTP Method Registry.
PROPPATCH is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
PROPPATCH /resource HTTP/1.1 Host: example.com
The Upgrade and Connection fields negotiate a different protocol on an established HTTP/1.1 connection.
Use Upgrade for protocols that define an HTTP/1.1 handshake, such as WebSocket. HTTP/2 and HTTP/3 use their own negotiation mechanisms instead.
Reference (http)
Connection: Upgrade Upgrade: websocket
The registered REBIND request method from the IANA HTTP Method Registry.
REBIND is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
REBIND /resource HTTP/1.1 Host: example.com
Redirect responses tell a client to use another target or retrieve another representation.
Use 301 or 308 for permanent moves, 302 or 307 for temporary moves, and 303 for a POST-redirect-GET result. Preserve the method with 307 and 308.
Reference (http)
HTTP/1.1 303 See Other Location: /jobs/42
The registered REPORT request method from the IANA HTTP Method Registry.
REPORT is safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
REPORT /resource HTTP/1.1 Host: example.com
The standard methods used to express an HTTP request intent.
GET, HEAD, OPTIONS, and TRACE are safe; PUT, DELETE, and the safe methods are idempotent. POST, PATCH, and CONNECT are not idempotent by default; the newer QUERY method is a safe, idempotent extension.
Reference (http)
GET /resource HTTP/1.1 Host: example.com
Request smuggling exploits disagreement between intermediaries about where an HTTP message ends.
Normalize and reject ambiguous framing, follow the HTTP version’s parsing rules, remove hop-by-hop fields at proxy boundaries, and keep front-end and back-end parsers aligned.
Reference (http)
Content-Length: 4 Transfer-Encoding: chunked
The registered SEARCH request method from the IANA HTTP Method Registry.
SEARCH is safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
SEARCH /resource HTTP/1.1 Host: example.com
The registered UNBIND request method from the IANA HTTP Method Registry.
UNBIND is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
UNBIND /resource HTTP/1.1 Host: example.com
The registered UNCHECKOUT request method from the IANA HTTP Method Registry.
UNCHECKOUT is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
UNCHECKOUT /resource HTTP/1.1 Host: example.com
The registered UNLINK request method from the IANA HTTP Method Registry.
UNLINK is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
UNLINK /resource HTTP/1.1 Host: example.com
The registered UNLOCK request method from the IANA HTTP Method Registry.
UNLOCK is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
UNLOCK /resource HTTP/1.1 Host: example.com
The registered UPDATE request method from the IANA HTTP Method Registry.
UPDATE is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
UPDATE /resource HTTP/1.1 Host: example.com
The registered UPDATEREDIRECTREF request method from the IANA HTTP Method Registry.
UPDATEREDIRECTREF is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
UPDATEREDIRECTREF /resource HTTP/1.1 Host: example.com
Clients and servers negotiate HTTP versions before or while establishing a connection.
TLS ALPN commonly selects h2 or h3. HTTP/1.1 uses an Upgrade mechanism in narrower cases. The selected version does not change the meaning of status codes or fields.
Reference (http)
ClientHello ALPN: h2, http/1.1 Alt-Svc: h3=":443"; ma=86400
The registered VERSION-CONTROL request method from the IANA HTTP Method Registry.
VERSION-CONTROL is not safe and idempotent according to the IANA registry. Use it only when the target protocol defines its semantics and the intermediary chain supports it.
Request (http)
VERSION-CONTROL /resource HTTP/1.1 Host: example.com
The major HTTP versions share semantics but use different wire protocols and transport behavior.
HTTP/1.1 is text-based and connection-oriented. HTTP/2 uses binary frames and multiplexed streams over TCP. HTTP/3 uses QUIC over UDP and avoids TCP head-of-line blocking between streams.
Reference (http)
ALPN: h2 ALPN: h3
HTTP/2 error codes identify connection and stream failures in a binary protocol that can continue serving independent streams.
Map protocol errors to the correct connection or stream scope, close only what is necessary, and avoid exposing raw peer diagnostics as application errors. A gateway should translate errors deliberately when crossing HTTP versions.
Reference (http)
RST_STREAM: CANCEL GOAWAY: ENHANCE_YOUR_CALM
HTTP/2 represents request and response control data with pseudo-fields such as :method, :scheme, :authority, and :path.
Pseudo-fields must appear before ordinary fields and are not ordinary HTTP/1.1 headers. Never forward HTTP/2 pseudo-fields as user-controlled application fields without validating the mapping.
Reference (http)
:method: GET :scheme: https :authority: example.com :path: /resource
HTTP/2 SETTINGS parameters and frame rules negotiate connection behavior over the binary protocol.
Use a compliant HTTP/2 stack to validate SETTINGS bounds, frame sizes, stream state, and connection preface handling. These values are not ordinary HTTP/1.1 headers and must not be copied across protocol boundaries blindly.
Reference (http)
PRI * HTTP/2.0
SM
HTTP/3 maps HTTP semantics onto QUIC streams rather than TCP.
HTTP/3 provides independent stream loss recovery and uses QUIC/TLS negotiation. Applications should preserve HTTP semantics while handling connection migration, 0-RTT replay risk, and version fallback.
Reference (http)
Alt-Svc: h3=":443"; ma=86400 HTTP/3 ALPN: h3
HTTP/3 maps HTTP semantics onto QUIC streams and uses its own frame, settings, and error registries.
Negotiate HTTP/3 with TLS and ALPN, enforce stream and connection limits, and treat 0-RTT requests as replayable unless the operation is safe. Do not assume HTTP/2 frame behavior applies unchanged to HTTP/3.
Reference (http)
Alt-Svc: h3=":443" QUIC ALPN: h3
HTTP/3 error codes describe stream, connection, and request failures over QUIC.
Preserve the distinction between H3_REQUEST_CANCELLED, H3_REQUEST_REJECTED, and connection errors. Retry only when the operation and server contract make retry safe, and translate to an HTTP response only when the request reached application processing.
Reference (http)
HTTP/3: H3_REQUEST_CANCELLED QUIC: CONNECTION_REFUSED
Prevents client-side JavaScript from reading a cookie through document.cookie.
Use `HttpOnly` for cookies that do not need to be read by browser JavaScript, especially session cookies.
Session cookie (http)
Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Lax; Path=/
HTTPS is HTTP carried over TLS, which provides confidentiality, integrity, and server authentication for the connection.
Use valid certificates, modern TLS, secure redirects, and HSTS. TLS protects the connection, not secrets placed in URLs, logs, or response bodies.
Reference (http)
https://example.com Strict-Transport-Security: max-age=31536000; includeSubDomains
An idempotency key lets a client safely retry a non-idempotent operation when the network outcome is unknown.
Accept an Idempotency-Key only when the server stores the request result or equivalent outcome, scopes keys to an operation and tenant, and rejects reuse with different parameters.
Reference (http)
POST /payments HTTP/1.1 Idempotency-Key: 01J7EXAMPLE Content-Type: application/json
Idempotency-Key lets an API recognize retries of the same non-idempotent operation.
Accept a unique key for operations such as payment or order creation, store the first result, and return the same result for a safe retry according to the API contract.
Reference (http)
POST /payments HTTP/1.1 Idempotency-Key: 7f3c2d2e-1a4e-4c8c-a65c-2b2f9b7d1e18
Makes a request conditional on the selected representation matching an entity tag.
Use If-Match with a strong ETag to protect writes from lost updates. A failed condition normally produces 412 Precondition Failed.
Reference (http)
If-Match: "document-v7"
Asks a server to send a representation only if it changed after a given date.
Use it with Last-Modified for cache validation. If-None-Match takes precedence when both validators are present.
Reference (http)
If-Modified-Since: Wed, 21 Oct 2015 07:28:00 GMT
Makes a request conditional on the current entity tag not matching.
Use it for cache revalidation or create-if-absent operations. A matching GET or HEAD normally produces 304; a matching unsafe request produces 412.
Reference (http)
If-None-Match: "user-42-v7"
Makes a range request conditional on a validator matching.
Use If-Range to resume a download only when the selected representation is still the same; otherwise send the complete representation.
Reference (http)
Range: bytes=1000-1999 If-Range: "video-v4"
Makes a request conditional on a representation not changing after a given date.
Use it as a coarse optimistic-concurrency guard when an ETag is not available. A failed condition normally produces 412.
Reference (http)
If-Unmodified-Since: Wed, 21 Oct 2015 07:28:00 GMT
Requires integrity metadata for selected browser subresource destinations.
Use Integrity-Policy as defense in depth with Subresource Integrity. It has limited browser availability and can block no-cors resources without integrity metadata.
Reference (http)
Integrity-Policy: blocked-destinations=(script style)
Reports integrity-policy violations without enforcing the block.
Use report-only mode to inventory missing integrity metadata before enforcement, together with Reporting-Endpoints where supported.
Reference (http)
Integrity-Policy-Report-Only: blocked-destinations=(script)
Gives the time a selected representation was last changed.
Use Last-Modified with If-Modified-Since or If-Unmodified-Since when an ETag is unavailable or as a secondary validator.
Reference (http)
Last-Modified: Wed, 21 Oct 2015 07:28:00 GMT
Deprecated and obsolete registry values remain useful for compatibility diagnosis but should not silently become new defaults.
Classify legacy values at the boundary, document their replacement, and remove them from new responses after measuring client compatibility. Preserve wire compatibility only as long as the risk and support contract justify it.
Reference (http)
Pragma: no-cache Cache-Control: no-cache Public-Key-Pins: pin-sha256="..."
Carries typed links between a resource and related targets such as preload hints.
Use Link for resource hints (rel=preload, rel=preconnect), 103 Early Hints, and 451 legal blockades (rel="blocked-by"). Link-Template is the templated sibling field.
Reference (http)
Link: </app.css>; rel=preload; as=style, </api/schema>; rel=describedby
Identifies a target URI for a redirect or a newly created resource.
Use Location with 3xx responses and often with 201 Created. It is a target hint, not permission to follow an untrusted URL.
Reference (http)
HTTP/1.1 201 Created Location: /api/users/42
MASQUE uses HTTP/3 extended CONNECT to proxy UDP datagrams through an authorized intermediary.
Treat a MASQUE tunnel as a privileged network capability: authenticate the client, restrict destinations and ports, cap bandwidth and lifetime, and prevent access to loopback, metadata, and private networks.
Reference (http)
CONNECT target.example:443 HTTP/3 Capsule-Protocol: ?1 Datagram-Flow-Id: 0
Limits the number of proxy hops a TRACE or OPTIONS request may traverse.
Use Max-Forwards for controlled diagnostics through an intermediary chain. It is not a general request hop limit for other methods.
Reference (http)
Max-Forwards: 0
Message framing tells a recipient where request or response content ends.
Content-Length describes the content size when known. HTTP/1.1 can also use chunked transfer coding. Never trust conflicting framing fields, and do not forward ambiguous messages.
Reference (http)
Content-Length: 27 Transfer-Encoding: chunked
Multipart media types package multiple parts, commonly form fields and uploaded files, in one HTTP message.
Parse boundaries with a standards-compliant streaming parser, enforce per-file and total limits, validate content independently of filenames, and store uploads outside executable paths.
Reference (http)
Content-Type: multipart/form-data; boundary=example-boundary --example-boundary Content-Disposition: form-data; name="file"; filename="photo.jpg"
Controls how URL query parameters affect cache matching.
Use No-Vary-Search only when the ignored or normalized parameters cannot change the response. Incorrect use can serve the wrong representation.
Reference (http)
No-Vary-Search: params, except=("q")OAuth delegates authorization while OIDC adds an identity layer; bearer tokens grant access to whoever possesses them.
Validate token issuer, audience, signature, expiry, scope, and transport. Use authorization code with PKCE for browser-based clients, keep access tokens out of URLs and logs, and distinguish an identity assertion from an API access token.
Reference (http)
Authorization: Bearer eyJ... WWW-Authenticate: Bearer realm="api", error="insufficient_scope"
Describes communication options for a target resource or server.
Use OPTIONS for capability discovery and CORS preflight handling.
Reference (http)
OPTIONS /api HTTP/1.1 Origin: https://app.example.com
Identifies the origin that initiated a browser request.
Use Origin in CORS and CSRF checks. It can be the value null for some sandboxed or opaque-origin contexts.
Reference (http)
Origin: https://app.example.com
Requests origin-keyed isolation for a document’s agent cluster.
Use Origin-Agent-Cluster: ?1 when origin-level isolation is appropriate, after checking compatibility with document sharing and storage behavior.
Reference (http)
Origin-Agent-Cluster: ?1
An origin is the combination of scheme, host, and port used by browser security checks.
Two URLs have the same origin only when all three components match. The Same-Origin Policy blocks many cross-origin reads unless a browser feature such as CORS grants access.
Reference (http)
https://app.example.com:443 https://api.example.com:443 # different origin
The Partitioned cookie attribute isolates a third-party cookie by the top-level site that embedded it.
Use Partitioned only for a cross-site embedded service that needs state in separate site contexts. Partitioned cookies must also use Secure.
Reference (http)
Set-Cookie: widget_session=abc; Secure; HttpOnly; SameSite=None; Partitioned
Partitioned cookies keep third-party state separated by the top-level site that embeds it.
Use Partitioned only for a genuine cross-site embedded use case and pair it with Secure. Partitioning reduces cross-site tracking and changes how integrations find their state.
Reference (http)
Set-Cookie: widget_session=abc; Secure; HttpOnly; SameSite=None; Partitioned
Applies partial modifications to a resource.
Use PATCH for partial updates and document whether the patch format is JSON Merge Patch, JSON Patch, or another media type.
Reference (http)
PATCH /api/users/42 HTTP/1.1 Content-Type: application/merge-patch+json
Permissions Policy controls which origins may use selected browser capabilities in a document or iframe.
Declare only the capabilities the application needs, understand inherited iframe policy, and test browser behavior. Permissions Policy is a browser control, not a server authorization boundary.
Reference (http)
Permissions-Policy: camera=(), microphone=(), geolocation=(self)
Controls which browser features and APIs may be used by a document and its frames.
Disable sensitive or unnecessary features by default and delegate only the origins that need them.
Reference (http)
Permissions-Policy: camera=(), microphone=(), geolocation=()
Submits a representation for processing or asks a resource to perform an operation.
Use POST for create actions and non-idempotent commands when the target resource defines that behavior.
Reference (http)
POST /api/orders HTTP/1.1 Content-Type: application/json
A legacy HTTP/1.0 compatibility field, mainly used with the no-cache directive.
Prefer Cache-Control for modern cache policy. Keep Pragma only when a legacy client requires it and understand that it is deprecated in the IANA registry.
Reference (http)
Pragma: no-cache
Expresses an optional client preference about request processing or the response.
Use preferences such as return=minimal or respond-async only when the server documents their behavior; preferences do not change the method semantics.
Reference (http)
Prefer: return=minimal, respond-async
Reports which Prefer request preference the server applied.
Use Preference-Applied to make an optional behavior explicit when the response would otherwise be ambiguous.
Reference (http)
Preference-Applied: return=minimal
Hints at the urgency and incremental delivery preference of a request.
Priority is a scheduling hint. It can improve resource delivery but must not be used for correctness or access control.
Reference (http)
Priority: u=1, i
PrivateToken authentication lets a client prove authorization without revealing the client identity to the origin verifying the token.
Use PrivateToken only with a compatible Privacy Pass deployment and document issuer, redemption, key, and abuse controls. It provides privacy properties, not general-purpose user authentication or authorization by itself.
Reference (http)
Authorization: PrivateToken token
Problem Details provides a standard JSON shape for explaining HTTP API errors.
Use application/problem+json with a stable type URI, title, status, detail, and instance as appropriate. Keep detail safe for clients and put field-level validation data in documented extensions.
Reference (http)
HTTP/1.1 422 Unprocessable Content
Content-Type: application/problem+json
{"type":"https://api.example.com/problems/invalid-input","title":"Invalid input","status":422,"detail":"The request could not be processed."}Problem type identifiers give API clients stable semantics for errors beyond the HTTP status code.
Use durable HTTPS type identifiers, document required members and extensions, keep status and title consistent, and treat a type URI as an identifier rather than a requirement to fetch a webpage. Version semantics deliberately when a breaking change is unavoidable.
Reference (http)
Content-Type: application/problem+json
{"type":"https://api.example.com/problems/quota","title":"Quota exceeded","status":429,"detail":"Try again later"}Intermediaries can forward requests, terminate connections, cache content, or translate protocols.
Use Forwarded or a trusted X-Forwarded-* convention to preserve client-facing context. Only trust values inserted by a known proxy, and strip untrusted incoming values.
Reference (http)
Forwarded: for=203.0.113.7;proto=https;host=example.com Via: 1.1 proxy.example.net
Challenges a client to authenticate with a proxy.
A 407 response uses Proxy-Authenticate, while Proxy-Authorization carries the client's credentials on a later request.
Reference (http)
Proxy-Authenticate: Basic realm="corp-proxy"
Carries credentials for a proxy.
Keep proxy credentials scoped to the proxy hop and prevent them from being forwarded to an origin server.
Reference (http)
Proxy-Authorization: Basic <credentials>
Reports an error or processing detail from an intermediary.
Use Proxy-Status for structured gateway diagnostics while removing sensitive topology before exposing it to untrusted clients.
Reference (http)
Proxy-Status: envoy; error=connection_timeout
Proxy-Status reports how a proxy or gateway handled a request and why an intermediary produced an error.
Use structured Proxy-Status diagnostics for operators while removing sensitive node names, addresses, cache keys, and credentials before exposing them to clients.
Reference (http)
Proxy-Status: envoy; error=connection_timeout; next-hop="upstream"
A legacy certificate-pinning response field retained in the registry.
Do not deploy HPKP or Public-Key-Pins in new applications; misconfiguration can lock users out and the mechanism is obsolete in modern browser practice.
Reference (http)
Public-Key-Pins: pin-sha256="..."; max-age=5184000
Creates or replaces the state of a resource at a known target URI.
Use PUT when the client supplies the complete replacement representation and repeated requests should have the same intended effect.
Reference (http)
PUT /api/users/42 HTTP/1.1 Content-Type: application/json
Submits a safe query to a target resource using request content.
Use QUERY only when both client and server implement the registered QUERY extension; it is not universally supported by browsers or HTTP tooling.
Reference (http)
QUERY /api/search HTTP/1.1
Content-Type: application/json
{"q":"http"}Requests one or more byte ranges from a representation.
Use Range with a valid unit such as bytes. Servers may ignore the field and return the full representation if range handling is not supported.
Reference (http)
Range: bytes=0-999
Range requests let a client retrieve part of a representation.
Use Range with Accept-Ranges and Content-Range for resumable downloads, media seeking, and large-file reads. Return 206 for a satisfiable range and 416 for an invalid one.
Reference (http)
Range: bytes=1000-1999 HTTP/1.1 206 Partial Content Content-Range: bytes 1000-1999/5000
The RateLimit-* fields convey quota and reset information for rate-limited APIs.
RateLimit-Limit, RateLimit-Remaining, and RateLimit-Reset are widely implemented by gateways despite remaining an unregistered IETF draft. Retry-After stays the standardized retry signal; RateLimit-Reset semantics (seconds versus timestamp) changed between draft revisions, so pin the revision your gateway emits.
Reference (http)
RateLimit-Limit: 100 RateLimit-Remaining: 73 RateLimit-Reset: 27
Carries the previous page address that led to a request.
Referer is intentionally misspelled in the protocol. Control how much it reveals with Referrer-Policy and do not put secrets in URLs.
Reference (http)
Referer: https://www.example.com/account
Controls how much referrer URL information browsers send with outgoing requests.
`strict-origin-when-cross-origin` is a sensible modern default: keep the full path same-origin, but send only the origin cross-origin.
Recommended default (http)
Referrer-Policy: strict-origin-when-cross-origin
Reporting fields tell browsers where to send structured policy and network failure reports.
Use Reporting-Endpoints with policies such as CSP and NEL when you have an endpoint that can authenticate, rate-limit, and safely process reports.
Reference (http)
Reporting-Endpoints: csp="https://reports.example.com/csp"
NEL: {"report_to":"default","max_age":86400}Defines named endpoints for browser Reporting API reports.
Use Reporting-Endpoints with CSP, integrity, or network reporting only after the endpoint is authenticated, rate-limited, and safe for untrusted reports.
Reference (http)
Reporting-Endpoints: default="https://reports.example.com/reports"
Provides a digest of the selected representation before content encoding or range transfer.
Use Repr-Digest when integrity should describe the representation independently of the transmitted coding or range.
Reference (http)
Repr-Digest: sha-256=:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZc3g=:
Clients need explicit retry rules for network failures, timeouts, and transient HTTP responses.
Retry only when the operation is safe, idempotent, or protected by an idempotency mechanism. Use bounded exponential backoff with jitter, honor Retry-After, and use separate connection, request, and overall deadlines.
Reference (http)
HTTP 503 Service Unavailable Retry-After: 30
Tells a client how long to wait or when to retry a request.
Use Retry-After with 429 and 503 when a retry may succeed later. Clients should still apply caps, jitter, and an overall retry policy.
Reference (http)
Retry-After: 120
Controls whether browsers send a cookie with cross-site requests.
Use `SameSite=Lax` as a practical default for many session cookies; use `Strict` or `None` based on the actual cross-site flow.
Typical session cookie (http)
Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Lax; Path=/
SCRAM uses a salted challenge-response exchange to authenticate a password without sending the password itself.
Use SCRAM only with a complete implementation of the selected hash and channel-binding mode. Store salted verifier data, enforce nonce freshness, and still protect the exchange with TLS.
Reference (http)
Authorization: SCRAM-SHA-256 data
Restricts a cookie to HTTPS requests, except for special localhost behavior in browsers.
Set `Secure` on session and authentication cookies so they are not sent over plaintext HTTP.
Session cookie (http)
Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Lax; Path=/
Webhooks deliver HTTP callbacks from one service to another and must be treated as untrusted, replayable input.
Sign a canonical payload with a timestamp and event identifier, verify signatures before parsing sensitive fields, reject stale replays, respond quickly, and process delivery asynchronously with deduplication.
Reference (http)
POST /hooks/orders HTTP/1.1 X-Webhook-Timestamp: 1720000000 X-Webhook-Signature: v1=BASE64_SIGNATURE
Identifies software used by the origin server that generated a response.
Use a minimal or generic Server value, or omit it when possible, to reduce passive technology disclosure. It is not a complete fingerprinting defense.
Reference (http)
Server: webserver
Response fields and error pages can reveal implementation details useful to attackers.
Remove X-Powered-By, minimize Server, avoid stack traces in bodies, and treat disclosure reduction as defense in depth rather than a substitute for patching and hardening.
Reference (http)
Server: webserver X-Powered-By: framework
Server-Sent Events streams text/event-stream updates from a server to a browser client.
Use text/event-stream with no buffering, periodic heartbeats, event IDs for resumption, and a bounded reconnect policy. Authenticate the stream like any other endpoint.
Reference (http)
HTTP/1.1 200 OK
Content-Type: text/event-stream
Cache-Control: no-cache
data: {"state":"ready"}
Server-Sent Events provides a one-way event stream from a server to a browser over HTTP.
Return text/event-stream, keep the connection open, send event records separated by blank lines, and use event IDs when clients should resume with Last-Event-ID.
Reference (http)
Content-Type: text/event-stream
Cache-Control: no-cache
data: {"ready":true}
SSRF occurs when an attacker controls a server-side request target and uses the server as a network vantage point.
Use an allowlist of schemes, hosts, ports, and resolved addresses; block loopback, link-local, metadata, private, and internal ranges; re-check DNS after resolution; disable or constrain redirects; and isolate outbound requests at the network layer.
Reference (http)
POST /fetch HTTP/1.1
Content-Type: application/json
{"url":"https://allowed.example/resource"}Communicates server-side performance metrics to browser developer tools and Resource Timing.
Use Server-Timing for actionable performance diagnostics and avoid embedding secrets or high-cardinality user identifiers.
Reference (http)
Server-Timing: db;dur=53, app;dur=47.2
Session fixation occurs when an attacker makes a victim use a session identifier the attacker already knows.
Regenerate the session identifier after login or privilege changes, set appropriate cookie scope, and invalidate old sessions when the account state changes.
Reference (http)
Set-Cookie: __Host-session=<new-id>; Secure; HttpOnly; SameSite=Lax; Path=/
Instructs a browser to store or update a cookie.
Set-Cookie is a response field with attributes such as Secure, HttpOnly, SameSite, Domain, Path, Max-Age, and Expires. Send separate fields for separate cookies.
Reference (http)
Set-Cookie: __Host-session=abc; Secure; HttpOnly; SameSite=Lax; Path=/
Carries one or more HTTP Message Signatures.
Use Signature with Signature-Input, a defined key-distribution mechanism, freshness controls, and replay protection.
Reference (http)
Signature: sig1=:BASE64_SIGNATURE:
Defines the components and parameters covered by HTTP Message Signatures.
Use Signature-Input to make the signed request target, fields, creation time, expiry, and key identifier explicit.
Reference (http)
Signature-Input: sig1=("@method" "@target-uri" "content-digest");created=1720000000;keyid="api-key"Tells browsers to use HTTPS for a host and optionally its subdomains.
Use HSTS to prevent browsers from silently falling back to insecure HTTP after a site has been verified to work over HTTPS.
Header (http)
Strict-Transport-Security: max-age=31536000; includeSubDomains
SRI lets a browser verify that a fetched script or stylesheet matches an expected cryptographic hash.
Use integrity attributes with crossorigin where required, pin exact content, and update hashes deliberately. SRI complements CSP; it does not sanitize HTML or secure arbitrary API responses.
Reference (http)
<script src="/app.js" integrity="sha384-BASE64_HASH" crossorigin="anonymous"></script>
Communicates the date when a resource or endpoint will be removed.
Sunset answers when a resource disappears; the Deprecation field signals that a feature is deprecated. Send both when deprecating an API with a planned removal date.
Reference (http)
Sunset: Wed, 31 Dec 2026 23:59:59 GMT
Lists the transfer codings a client accepts and whether it accepts trailer fields.
TE is hop-by-hop and applies to transfer codings such as trailers, not content codings like gzip. A proxy must not forward it blindly.
Reference (http)
TE: trailers
Allows selected origins to read detailed cross-origin Resource Timing data.
Use a narrow origin allowlist when exposing timing information; timing data can reveal resource behavior and endpoints.
Reference (http)
Timing-Allow-Origin: https://app.example.com
Performs a message loop-back test along the path to the target.
Use TRACE only for controlled diagnostics; disable it when not required because reflected request data can enable cross-site tracing risks.
Reference (http)
TRACE / HTTP/1.1 Host: example.com Max-Forwards: 0
Announces fields that will appear in the trailer part of a chunked message.
Use Trailer with chunked transfer coding to send metadata after the body, such as a checksum. Content-Length, Host, and other framing or control fields are forbidden in trailers.
Reference (http)
Trailer: Content-Digest Transfer-Encoding: chunked
Describes the transfer coding applied to the message body, usually chunked.
Transfer-Encoding is hop-by-hop framing: proxies must remove their own coding before forwarding. It is forbidden in HTTP/2 and HTTP/3, and its conflict with Content-Length is the classic request-smuggling vector.
Reference (http)
Transfer-Encoding: chunked
This request header tells a server that a browser prefers an encrypted response and can handle the CSP upgrade-insecure-requests directive.
Use it as a signal alongside HTTPS deployment and CSP. It does not replace redirects or HSTS and does not upgrade requests made by every client.
Reference (http)
Upgrade-Insecure-Requests: 1
Identifies the client software and usually its operating system.
Use it for diagnostics and narrowly scoped compatibility work. Prefer feature detection over browser sniffing, and expect reduced or customized strings.
Reference (http)
User-Agent: ExampleClient/1.0
VAPID authenticates an application server to a Web Push service using a signed JWT and an application public key.
Use a short-lived VAPID JWT with the correct audience and subject contact, and keep the signing key private. VAPID identifies the sender; it does not authorize arbitrary push subscriptions.
Reference (http)
Authorization: vapid t=eyJ..., k=BASE64URL_PUBLIC_KEY
Declares which request fields influenced the selected response representation.
Use Vary when content or CORS responses differ based on request headers so caches do not serve one variant to another request.
Reference (http)
Vary: Accept-Encoding, Origin
Requests a Content-Digest for a message content stream.
Use Want-Content-Digest when a client wants a sender to provide a digest and the protocol defines how to respond.
Reference (http)
Want-Content-Digest: sha-256
Requests a Repr-Digest for the selected representation.
Use Want-Repr-Digest when representation-level integrity is useful across content codings and ranges.
Reference (http)
Want-Repr-Digest: sha-256
The Warning response field historically reported cache and representation conditions using numeric warning codes.
Prefer current Cache-Control, Age, and response semantics for new designs. If a legacy client requires Warning, preserve its quoted text carefully and do not treat intermediary diagnostics as an authoritative application decision.
Reference (http)
Warning: 110 - "Response is stale" Age: 3600
WebSocket upgrades an HTTP connection into a bidirectional message channel.
Validate the Origin and authentication context during the handshake, authorize each connection, bound message size and rate, and close idle or unauthorized connections deliberately.
Reference (http)
GET /socket HTTP/1.1 Upgrade: websocket Connection: Upgrade Sec-WebSocket-Version: 13 Sec-WebSocket-Key: BASE64_NONCE
WebSocket starts with an HTTP handshake and then upgrades the connection to a bidirectional protocol.
Validate the Origin and negotiate the requested subprotocol and extensions. A successful handshake returns 101 Switching Protocols.
Reference (http)
GET /chat HTTP/1.1 Upgrade: websocket Connection: Upgrade Sec-WebSocket-Version: 13 Sec-WebSocket-Key: <nonce>
Challenges a client to authenticate with an origin server.
A 401 response should normally include at least one WWW-Authenticate challenge describing an available scheme.
Reference (http)
WWW-Authenticate: Bearer realm="api", error="invalid_token"
Challenge fields tell a client which authentication scheme and protection space apply.
WWW-Authenticate challenges an origin request after 401. Proxy-Authenticate challenges proxy access after 407. The scheme and parameters depend on the authentication method.
Reference (http)
WWW-Authenticate: Basic realm="staging" Proxy-Authenticate: Basic realm="proxy"
Prevents browsers from guessing a different MIME type than the one declared by the server.
Set this header to `nosniff` so browsers respect declared content types and do not interpret resources as executable content unexpectedly.
Header (http)
X-Content-Type-Options: nosniff
Controls whether a browser may render a response in a frame, iframe, embed, or object.
Prefer CSP frame-ancestors for modern applications, but use X-Frame-Options: DENY or SAMEORIGIN when legacy browser support requires it.
Reference (http)
X-Frame-Options: DENY
A legacy browser filter header for reflected cross-site scripting.
Do not rely on X-XSS-Protection; modern applications should use a correctly configured CSP and generally send X-XSS-Protection: 0 or omit the header.
Reference (http)
X-XSS-Protection: 0
* is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use * only according to its defining specification. Defining reference: RFC 9110, Section 12.5.5: HTTP Semantics.
A-IM is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use A-IM only according to its defining specification. Defining reference: RFC 3229: Delta encoding in HTTP.
Accept-Additions is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Accept-Additions only according to its defining specification. Defining reference: RFC 2324: Hyper Text Coffee Pot Control Protocol (HTCPCP/1.0).
Accept-CH is a registered field in the IANA HTTP Field Name Registry. Structured Field type: List.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Accept-CH only according to its defining specification. Defining reference: RFC 8942, Section 3.1: HTTP Client Hints.
Accept-Charset is a deprecated field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value deprecated; review compatibility before deploying it. Use Accept-Charset only according to its defining specification. Defining reference: RFC 9110, Section 12.5.2: HTTP Semantics.
Accept-Datetime is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Accept-Datetime only according to its defining specification. Defining reference: RFC 7089: HTTP Framework for Time-Based Access to Resource States -- Memento.
Accept-Features is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Accept-Features only according to its defining specification. Defining reference: RFC 2295: Transparent Content Negotiation in HTTP.
Accept-Signature is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Accept-Signature only according to its defining specification. Defining reference: RFC 9421, Section 5.1: HTTP Message Signatures.
Access-Control is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Access-Control only according to its defining specification. Defining reference: Access Control for Cross-site Requests.
Access-Control-Allow-Credentials is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Access-Control-Allow-Credentials only according to its defining specification. Defining reference: Fetch.
Access-Control-Allow-Headers is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Access-Control-Allow-Headers only according to its defining specification. Defining reference: Fetch.
Access-Control-Allow-Methods is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Access-Control-Allow-Methods only according to its defining specification. Defining reference: Fetch.
Access-Control-Allow-Origin is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Access-Control-Allow-Origin only according to its defining specification. Defining reference: Fetch.
Access-Control-Expose-Headers is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Access-Control-Expose-Headers only according to its defining specification. Defining reference: Fetch.
Access-Control-Request-Headers is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Access-Control-Request-Headers only according to its defining specification. Defining reference: Fetch.
Access-Control-Request-Method is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Access-Control-Request-Method only according to its defining specification. Defining reference: Fetch.
Activate-Storage-Access is a provisional field in the IANA HTTP Field Name Registry. Structured Field type: Item.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value provisional; review compatibility before deploying it. Use Activate-Storage-Access only according to its defining specification. Defining reference: https://privacycg.github.io/storage-access-headers.
ALPN is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use ALPN only according to its defining specification. Defining reference: RFC 7639, Section 2: The ALPN HTTP Header Field.
Alternates is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Alternates only according to its defining specification. Defining reference: RFC 2295: Transparent Content Negotiation in HTTP.
AMP-Cache-Transform is a provisional field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value provisional; review compatibility before deploying it. Use AMP-Cache-Transform only according to its defining specification. Defining reference: AMP-Cache-Transform HTTP request header.
Apply-To-Redirect-Ref is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Apply-To-Redirect-Ref only according to its defining specification. Defining reference: RFC 4437: Web Distributed Authoring and Versioning (WebDAV) Redirect Reference Resources.
Authentication-Control is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Authentication-Control only according to its defining specification. Defining reference: RFC 8053, Section 4: HTTP Authentication Extensions for Interactive Clients.
Authentication-Info is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Authentication-Info only according to its defining specification. Defining reference: RFC 9110, Section 11.6.3: HTTP Semantics.
Available-Dictionary is a registered field in the IANA HTTP Field Name Registry. Structured Field type: Item.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Available-Dictionary only according to its defining specification. Defining reference: RFC 9842, Section 2.2: Compression Dictionary Transport.
C-Ext is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use C-Ext only according to its defining specification. Defining reference: RFC 2774: An HTTP Extension Framework.
C-Man is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use C-Man only according to its defining specification. Defining reference: RFC 2774: An HTTP Extension Framework.
C-Opt is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use C-Opt only according to its defining specification. Defining reference: RFC 2774: An HTTP Extension Framework.
C-PEP is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use C-PEP only according to its defining specification. Defining reference: PEP - an Extension Mechanism for HTTP.
C-PEP-Info is a deprecated field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value deprecated; review compatibility before deploying it. Use C-PEP-Info only according to its defining specification. Defining reference: PEP - an Extension Mechanism for HTTP.
Cache-Group-Invalidation is a registered field in the IANA HTTP Field Name Registry. Structured Field type: List.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Cache-Group-Invalidation only according to its defining specification. Defining reference: RFC9875: HTTP Cache Groups.
Cache-Groups is a registered field in the IANA HTTP Field Name Registry. Structured Field type: List.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Cache-Groups only according to its defining specification. Defining reference: RFC9875: HTTP Cache Groups.
Cal-Managed-ID is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Cal-Managed-ID only according to its defining specification. Defining reference: RFC 8607, Section 5.1: Calendaring Extensions to WebDAV (CalDAV): Managed Attachments.
CalDAV-Timezones is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use CalDAV-Timezones only according to its defining specification. Defining reference: RFC 7809, Section 7.1: Calendaring Extensions to WebDAV (CalDAV): Time Zones by Reference.
Capsule-Protocol is a registered field in the IANA HTTP Field Name Registry. Structured Field type: Item.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Capsule-Protocol only according to its defining specification. Defining reference: RFC 9297: HTTP Datagrams and the Capsule Protocol.
CDN-Loop is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use CDN-Loop only according to its defining specification. Defining reference: RFC 8586: Loop Detection in Content Delivery Networks (CDNs).
Cert-Not-After is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Cert-Not-After only according to its defining specification. Defining reference: RFC 8739, Section 3.3: Support for Short-Term, Automatically Renewed (STAR) Certificates in the Automated Certificate Management Environment (ACME).
Cert-Not-Before is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Cert-Not-Before only according to its defining specification. Defining reference: RFC 8739, Section 3.3: Support for Short-Term, Automatically Renewed (STAR) Certificates in the Automated Certificate Management Environment (ACME).
Client-Cert is a registered field in the IANA HTTP Field Name Registry. Structured Field type: Item.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Client-Cert only according to its defining specification. Defining reference: RFC 9440, Section 2: Client-Cert HTTP Header Field.
Client-Cert-Chain is a registered field in the IANA HTTP Field Name Registry. Structured Field type: List.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Client-Cert-Chain only according to its defining specification. Defining reference: RFC 9440, Section 2: Client-Cert HTTP Header Field.
Close is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Close only according to its defining specification. Defining reference: RFC 9112, Section 9.6: HTTP/1.1.
CMCD-Object is a provisional field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value provisional; review compatibility before deploying it. Use CMCD-Object only according to its defining specification. Defining reference: CTA.
CMCD-Request is a provisional field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value provisional; review compatibility before deploying it. Use CMCD-Request only according to its defining specification. Defining reference: CTA.
CMCD-Session is a provisional field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value provisional; review compatibility before deploying it. Use CMCD-Session only according to its defining specification. Defining reference: CTA.
CMCD-Status is a provisional field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value provisional; review compatibility before deploying it. Use CMCD-Status only according to its defining specification. Defining reference: CTA.
CMSD-Dynamic is a provisional field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value provisional; review compatibility before deploying it. Use CMSD-Dynamic only according to its defining specification. Defining reference: CTA.
CMSD-Static is a provisional field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value provisional; review compatibility before deploying it. Use CMSD-Static only according to its defining specification. Defining reference: CTA.
Concealed-Auth-Export is a registered field in the IANA HTTP Field Name Registry. Structured Field type: Item.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Concealed-Auth-Export only according to its defining specification. Defining reference: RFC 9729: The Concealed HTTP Authentication Scheme.
Configuration-Context is a provisional field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value provisional; review compatibility before deploying it. Use Configuration-Context only according to its defining specification. Defining reference: OSLC Configuration Management Version 1.0. Part 3: Configuration Specification.
Connect-UDP-Bind is a registered field in the IANA HTTP Field Name Registry. Structured Field type: Item.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Connect-UDP-Bind only according to its defining specification. Defining reference: RFC-ietf-masque-connect-udp-listen-16: Proxying Bound UDP in HTTP.
Connection is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Connection only according to its defining specification. Defining reference: RFC 9110, Section 7.6.1: HTTP Semantics.
Content-Base is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Content-Base only according to its defining specification. Defining reference: RFC 2068: Hypertext Transfer Protocol -- HTTP/1.1.
Content-ID is a deprecated field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value deprecated; review compatibility before deploying it. Use Content-ID only according to its defining specification. Defining reference: The HTTP Distribution and Replication Protocol.
Content-MD5 is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Content-MD5 only according to its defining specification. Defining reference: RFC 2616, Section 14.15: Hypertext Transfer Protocol -- HTTP/1.1.
Content-Script-Type is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Content-Script-Type only according to its defining specification. Defining reference: HTML 4.01 Specification.
Content-Style-Type is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Content-Style-Type only according to its defining specification. Defining reference: HTML 4.01 Specification.
Content-Version is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Content-Version only according to its defining specification. Defining reference: RFC 2068: Hypertext Transfer Protocol -- HTTP/1.1.
Cookie2 is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Cookie2 only according to its defining specification. Defining reference: RFC 2965: HTTP State Management Mechanism.
Cross-Origin-Embedder-Policy is a registered field in the IANA HTTP Field Name Registry. Structured Field type: Item.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Cross-Origin-Embedder-Policy only according to its defining specification. Defining reference: HTML.
Cross-Origin-Embedder-Policy-Report-Only is a registered field in the IANA HTTP Field Name Registry. Structured Field type: Item.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Cross-Origin-Embedder-Policy-Report-Only only according to its defining specification. Defining reference: HTML.
Cross-Origin-Opener-Policy is a registered field in the IANA HTTP Field Name Registry. Structured Field type: Item.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Cross-Origin-Opener-Policy only according to its defining specification. Defining reference: HTML.
Cross-Origin-Opener-Policy-Report-Only is a registered field in the IANA HTTP Field Name Registry. Structured Field type: Item.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Cross-Origin-Opener-Policy-Report-Only only according to its defining specification. Defining reference: HTML.
Cross-Origin-Resource-Policy is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Cross-Origin-Resource-Policy only according to its defining specification. Defining reference: Fetch.
CTA-Common-Access-Token is a provisional field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value provisional; review compatibility before deploying it. Use CTA-Common-Access-Token only according to its defining specification. Defining reference: CTA.
DASL is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use DASL only according to its defining specification. Defining reference: RFC 5323: Web Distributed Authoring and Versioning (WebDAV) SEARCH.
DAV is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use DAV only according to its defining specification. Defining reference: RFC 4918: HTTP Extensions for Web Distributed Authoring and Versioning (WebDAV).
Default-Style is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Default-Style only according to its defining specification. Defining reference: HTML 4.01 Specification.
Delta-Base is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Delta-Base only according to its defining specification. Defining reference: RFC 3229: Delta encoding in HTTP.
Depth is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Depth only according to its defining specification. Defining reference: RFC 4918: HTTP Extensions for Web Distributed Authoring and Versioning (WebDAV).
Derived-From is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Derived-From only according to its defining specification. Defining reference: RFC 2068: Hypertext Transfer Protocol -- HTTP/1.1.
Destination is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Destination only according to its defining specification. Defining reference: RFC 4918: HTTP Extensions for Web Distributed Authoring and Versioning (WebDAV).
Detached-JWS is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Detached-JWS only according to its defining specification. Defining reference: RFC 9635: Grant Negotiation and Authorization Protocol (GNAP).
Dictionary-ID is a registered field in the IANA HTTP Field Name Registry. Structured Field type: Item.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Dictionary-ID only according to its defining specification. Defining reference: RFC 9842, Section 2.3: Compression Dictionary Transport.
Differential-ID is a deprecated field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value deprecated; review compatibility before deploying it. Use Differential-ID only according to its defining specification. Defining reference: The HTTP Distribution and Replication Protocol.
Digest is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Digest only according to its defining specification. Defining reference: RFC 3230: Instance Digests in HTTP.
DPoP is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use DPoP only according to its defining specification. Defining reference: RFC 9449: OAuth 2.0 Demonstrating Proof of Possession (DPoP).
DPoP-Nonce is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use DPoP-Nonce only according to its defining specification. Defining reference: RFC 9449: OAuth 2.0 Demonstrating Proof of Possession (DPoP).
EDIINT-Features is a provisional field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value provisional; review compatibility before deploying it. Use EDIINT-Features only according to its defining specification. Defining reference: RFC 6017: Electronic Data Interchange - Internet Integration (EDIINT) Features Header Field.
Expect-CT is a deprecated field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value deprecated; review compatibility before deploying it. Use Expect-CT only according to its defining specification. Defining reference: RFC 9163: Expect-CT Extension for HTTP.
Ext is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Ext only according to its defining specification. Defining reference: RFC 2774: An HTTP Extension Framework.
Forwarded is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Forwarded only according to its defining specification. Defining reference: RFC 7239: Forwarded HTTP Extension.
From is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use From only according to its defining specification. Defining reference: RFC 9110, Section 10.1.2: HTTP Semantics.
GetProfile is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use GetProfile only according to its defining specification. Defining reference: Implementation of OPS Over HTTP.
Hobareg is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Hobareg only according to its defining specification. Defining reference: RFC 7486, Section 6.1.1: HTTP Origin-Bound Authentication (HOBA).
HTTP2-Settings is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use HTTP2-Settings only according to its defining specification. Defining reference: RFC 7540, Section 3.2.1: Hypertext Transfer Protocol Version 2 (HTTP/2).
If is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use If only according to its defining specification. Defining reference: RFC 4918: HTTP Extensions for Web Distributed Authoring and Versioning (WebDAV).
If-Schedule-Tag-Match is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use If-Schedule-Tag-Match only according to its defining specification. Defining reference: RFC 6338: Scheduling Extensions to CalDAV.
IM is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use IM only according to its defining specification. Defining reference: RFC 3229: Delta encoding in HTTP.
Include-Referred-Token-Binding-ID is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Include-Referred-Token-Binding-ID only according to its defining specification. Defining reference: RFC 8473: Token Binding over HTTP.
Incremental is a registered field in the IANA HTTP Field Name Registry. Structured Field type: Item.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Incremental only according to its defining specification. Defining reference: RFC 10036: Incremental Forwarding of HTTP Messages.
Isolation is a provisional field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value provisional; review compatibility before deploying it. Use Isolation only according to its defining specification. Defining reference: OData Version 4.01 Part 1: Protocol.
Keep-Alive is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Keep-Alive only according to its defining specification. Defining reference: RFC 2068: Hypertext Transfer Protocol -- HTTP/1.1.
Label is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Label only according to its defining specification. Defining reference: RFC 3253: Versioning Extensions to WebDAV: (Web Distributed Authoring and Versioning).
Last-Event-ID is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Last-Event-ID only according to its defining specification. Defining reference: HTML.
Link-Template is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Link-Template only according to its defining specification. Defining reference: RFC 9652: The Link-Template HTTP Header Field.
Lock-Token is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Lock-Token only according to its defining specification. Defining reference: RFC 4918: HTTP Extensions for Web Distributed Authoring and Versioning (WebDAV).
Man is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Man only according to its defining specification. Defining reference: RFC 2774: An HTTP Extension Framework.
Memento-Datetime is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Memento-Datetime only according to its defining specification. Defining reference: RFC 7089: HTTP Framework for Time-Based Access to Resource States -- Memento.
Meter is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Meter only according to its defining specification. Defining reference: RFC 2227: Simple Hit-Metering and Usage-Limiting for HTTP.
Method-Check is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Method-Check only according to its defining specification. Defining reference: Access Control for Cross-site Requests.
Method-Check-Expires is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Method-Check-Expires only according to its defining specification. Defining reference: Access Control for Cross-site Requests.
MIME-Version is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use MIME-Version only according to its defining specification. Defining reference: RFC 9112, Appendix B.1: HTTP/1.1.
Negotiate is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Negotiate only according to its defining specification. Defining reference: RFC 2295: Transparent Content Negotiation in HTTP.
NEL is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use NEL only according to its defining specification. Defining reference: Network Error Logging.
OData-EntityId is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use OData-EntityId only according to its defining specification. Defining reference: OData Version 4.01 Part 1: Protocol.
OData-Isolation is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use OData-Isolation only according to its defining specification. Defining reference: OData Version 4.01 Part 1: Protocol.
OData-MaxVersion is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use OData-MaxVersion only according to its defining specification. Defining reference: OData Version 4.01 Part 1: Protocol.
OData-Version is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use OData-Version only according to its defining specification. Defining reference: OData Version 4.01 Part 1: Protocol.
Opt is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Opt only according to its defining specification. Defining reference: RFC 2774: An HTTP Extension Framework.
Optional-WWW-Authenticate is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Optional-WWW-Authenticate only according to its defining specification. Defining reference: RFC 8053, Section 3: HTTP Authentication Extensions for Interactive Clients.
Ordering-Type is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Ordering-Type only according to its defining specification. Defining reference: RFC 3648: Web Distributed Authoring and Versioning (WebDAV) Ordered Collections Protocol.
OSCORE is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use OSCORE only according to its defining specification. Defining reference: RFC 8613, Section 11.1: Object Security for Constrained RESTful Environments (OSCORE).
OSLC-Core-Version is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use OSLC-Core-Version only according to its defining specification. Defining reference: OASIS Project Specification 01.
Overwrite is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Overwrite only according to its defining specification. Defining reference: RFC 4918: HTTP Extensions for Web Distributed Authoring and Versioning (WebDAV).
P3P is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use P3P only according to its defining specification. Defining reference: The Platform for Privacy Preferences 1.0 (P3P1.0) Specification.
PEP is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use PEP only according to its defining specification. Defining reference: PEP - an Extension Mechanism for HTTP.
PEP-Info is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use PEP-Info only according to its defining specification. Defining reference: PEP - an Extension Mechanism for HTTP.
PICS-Label is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use PICS-Label only according to its defining specification. Defining reference: PICS Label Distribution Label Syntax and Communication Protocols.
Ping-From is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Ping-From only according to its defining specification. Defining reference: HTML.
Ping-To is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Ping-To only according to its defining specification. Defining reference: HTML.
Position is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Position only according to its defining specification. Defining reference: RFC 3648: Web Distributed Authoring and Versioning (WebDAV) Ordered Collections Protocol.
ProfileObject is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use ProfileObject only according to its defining specification. Defining reference: Implementation of OPS Over HTTP.
Protocol is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Protocol only according to its defining specification. Defining reference: PICS Label Distribution Label Syntax and Communication Protocols.
Protocol-Info is a deprecated field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value deprecated; review compatibility before deploying it. Use Protocol-Info only according to its defining specification. Defining reference: White Paper: Joint Electronic Payment Initiative.
Protocol-Query is a deprecated field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value deprecated; review compatibility before deploying it. Use Protocol-Query only according to its defining specification. Defining reference: White Paper: Joint Electronic Payment Initiative.
Protocol-Request is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Protocol-Request only according to its defining specification. Defining reference: PICS Label Distribution Label Syntax and Communication Protocols.
Proxy-Authentication-Info is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Proxy-Authentication-Info only according to its defining specification. Defining reference: RFC 9110, Section 11.7.3: HTTP Semantics.
Proxy-Features is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Proxy-Features only according to its defining specification. Defining reference: Notification for Proxy Caches.
Proxy-Instruction is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Proxy-Instruction only according to its defining specification. Defining reference: Notification for Proxy Caches.
Proxy-Public-Address is a registered field in the IANA HTTP Field Name Registry. Structured Field type: List.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Proxy-Public-Address only according to its defining specification. Defining reference: RFC-ietf-masque-connect-udp-listen-16: Proxying Bound UDP in HTTP.
Public is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Public only according to its defining specification. Defining reference: RFC 2068: Hypertext Transfer Protocol -- HTTP/1.1.
Public-Key-Pins-Report-Only is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Public-Key-Pins-Report-Only only according to its defining specification. Defining reference: RFC 7469: Public Key Pinning Extension for HTTP.
Redirect-Ref is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Redirect-Ref only according to its defining specification. Defining reference: RFC 4437: Web Distributed Authoring and Versioning (WebDAV) Redirect Reference Resources.
Referer-Root is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Referer-Root only according to its defining specification. Defining reference: Access Control for Cross-site Requests.
Refresh is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Refresh only according to its defining specification. Defining reference: HTML.
Repeatability-Client-ID is a provisional field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value provisional; review compatibility before deploying it. Use Repeatability-Client-ID only according to its defining specification. Defining reference: Repeatable Requests Version 1.0.
Repeatability-First-Sent is a provisional field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value provisional; review compatibility before deploying it. Use Repeatability-First-Sent only according to its defining specification. Defining reference: Repeatable Requests Version 1.0.
Repeatability-Request-ID is a provisional field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value provisional; review compatibility before deploying it. Use Repeatability-Request-ID only according to its defining specification. Defining reference: Repeatable Requests Version 1.0.
Repeatability-Result is a provisional field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value provisional; review compatibility before deploying it. Use Repeatability-Result only according to its defining specification. Defining reference: Repeatable Requests Version 1.0.
Replay-Nonce is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Replay-Nonce only according to its defining specification. Defining reference: RFC 8555, Section 6.5.1: Automatic Certificate Management Environment (ACME).
Safe is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Safe only according to its defining specification. Defining reference: RFC 2310: The Safe Response Header Field.
Schedule-Reply is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Schedule-Reply only according to its defining specification. Defining reference: RFC 6638: Scheduling Extensions to CalDAV.
Schedule-Tag is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Schedule-Tag only according to its defining specification. Defining reference: RFC 6338: Scheduling Extensions to CalDAV.
Sec-Fetch-Dest is a registered field in the IANA HTTP Field Name Registry. Structured Field type: Item.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Sec-Fetch-Dest only according to its defining specification. Defining reference: https://www.w3.org/TR/fetch-metadata/#sec-fetch-dest-header.
Sec-Fetch-Mode is a registered field in the IANA HTTP Field Name Registry. Structured Field type: Item.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Sec-Fetch-Mode only according to its defining specification. Defining reference: https://www.w3.org/TR/fetch-metadata/#sec-fetch-mode-header.
Sec-Fetch-Site is a registered field in the IANA HTTP Field Name Registry. Structured Field type: Item.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Sec-Fetch-Site only according to its defining specification. Defining reference: https://www.w3.org/TR/fetch-metadata/#sec-fetch-site-header.
Sec-Fetch-Storage-Access is a provisional field in the IANA HTTP Field Name Registry. Structured Field type: Token.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value provisional; review compatibility before deploying it. Use Sec-Fetch-Storage-Access only according to its defining specification. Defining reference: https://privacycg.github.io/storage-access-headers.
Sec-Fetch-User is a registered field in the IANA HTTP Field Name Registry. Structured Field type: Item.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Sec-Fetch-User only according to its defining specification. Defining reference: https://www.w3.org/TR/fetch-metadata/#sec-fetch-user-header.
Sec-GPC is a provisional field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value provisional; review compatibility before deploying it. Use Sec-GPC only according to its defining specification. Defining reference: Global Privacy Control (GPC).
Sec-Purpose is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Sec-Purpose only according to its defining specification. Defining reference: Fetch.
Sec-Token-Binding is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Sec-Token-Binding only according to its defining specification. Defining reference: RFC 8473: Token Binding over HTTP.
Sec-WebSocket-Accept is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Sec-WebSocket-Accept only according to its defining specification. Defining reference: RFC 6455: The WebSocket Protocol.
Sec-WebSocket-Extensions is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Sec-WebSocket-Extensions only according to its defining specification. Defining reference: RFC 6455: The WebSocket Protocol.
Sec-WebSocket-Key is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Sec-WebSocket-Key only according to its defining specification. Defining reference: RFC 6455: The WebSocket Protocol.
Sec-WebSocket-Protocol is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Sec-WebSocket-Protocol only according to its defining specification. Defining reference: RFC 6455: The WebSocket Protocol.
Sec-WebSocket-Version is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Sec-WebSocket-Version only according to its defining specification. Defining reference: RFC 6455: The WebSocket Protocol.
Security-Scheme is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Security-Scheme only according to its defining specification. Defining reference: RFC 2660: The Secure HyperText Transfer Protocol.
Set-Cookie2 is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Set-Cookie2 only according to its defining specification. Defining reference: RFC 2965: HTTP State Management Mechanism.
Set-Txn is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Set-Txn only according to its defining specification. Defining reference: RFC9967, Section 3: SCIM Profile for Security Event Tokens.
SetProfile is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use SetProfile only according to its defining specification. Defining reference: Implementation of OPS Over HTTP.
SLUG is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use SLUG only according to its defining specification. Defining reference: RFC 5023: The Atom Publishing Protocol.
SoapAction is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use SoapAction only according to its defining specification. Defining reference: Simple Object Access Protocol (SOAP) 1.1.
Status-URI is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Status-URI only according to its defining specification. Defining reference: RFC 2518: HTTP Extensions for Distributed Authoring -- WEBDAV.
Surrogate-Capability is a provisional field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value provisional; review compatibility before deploying it. Use Surrogate-Capability only according to its defining specification. Defining reference: Edge Architecture Specification.
Surrogate-Control is a provisional field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value provisional; review compatibility before deploying it. Use Surrogate-Control only according to its defining specification. Defining reference: Edge Architecture Specification.
TCN is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use TCN only according to its defining specification. Defining reference: RFC 2295: Transparent Content Negotiation in HTTP.
Timeout is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Timeout only according to its defining specification. Defining reference: RFC 4918: HTTP Extensions for Web Distributed Authoring and Versioning (WebDAV).
Topic is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Topic only according to its defining specification. Defining reference: RFC 8030, Section 5.4: Generic Event Delivery Using HTTP Push.
Traceparent is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Traceparent only according to its defining specification. Defining reference: Trace Context.
Tracestate is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Tracestate only according to its defining specification. Defining reference: Trace Context.
TTL is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use TTL only according to its defining specification. Defining reference: RFC 8030, Section 5.2: Generic Event Delivery Using HTTP Push.
Unencoded-Digest is a registered field in the IANA HTTP Field Name Registry. Structured Field type: Dictionary.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Unencoded-Digest only according to its defining specification. Defining reference: RFC-ietf-httpbis-unencoded-digest-05, Section 3: HTTP Unencoded Digest.
Upgrade is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Upgrade only according to its defining specification. Defining reference: RFC 9110, Section 7.8: HTTP Semantics.
Urgency is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Urgency only according to its defining specification. Defining reference: RFC 8030, Section 5.3: Generic Event Delivery Using HTTP Push.
URI is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use URI only according to its defining specification. Defining reference: RFC 2068: Hypertext Transfer Protocol -- HTTP/1.1.
Use-As-Dictionary is a registered field in the IANA HTTP Field Name Registry. Structured Field type: Dictionary.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Use-As-Dictionary only according to its defining specification. Defining reference: RFC 9842, Section 2.1: Compression Dictionary Transport.
Variant-Vary is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Variant-Vary only according to its defining specification. Defining reference: RFC 2295: Transparent Content Negotiation in HTTP.
Via is a registered field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Via only according to its defining specification. Defining reference: RFC 9110, Section 7.6.3: HTTP Semantics.
Want-Digest is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Want-Digest only according to its defining specification. Defining reference: RFC 3230: Instance Digests in HTTP.
Want-Unencoded-Digest is a registered field in the IANA HTTP Field Name Registry. Structured Field type: Dictionary.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. Use Want-Unencoded-Digest only according to its defining specification. Defining reference: RFC-ietf-httpbis-unencoded-digest-05, Section 4: HTTP Unencoded Digest.
Warning is a obsoleted field in the IANA HTTP Field Name Registry.
HTTP fields are message metadata; their meaning depends on direction, combination rules, and the HTTP version carrying them. The registry marks this value obsoleted; review compatibility before deploying it. Use Warning only according to its defining specification. Defining reference: RFC 9111, Section 5.5: HTTP Caching.
The HTTP authority, or target host
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. The registry marks this value active; review compatibility before deploying it. @authority is active in HTTP Signature Derived Component Names. Defining reference: RFC 9421, Section 2.2.3.
Identifier (http)
@authority
The HTTP request method
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. The registry marks this value active; review compatibility before deploying it. @method is active in HTTP Signature Derived Component Names. Defining reference: RFC 9421, Section 2.2.1.
Identifier (http)
@method
The full path of the request URI
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. The registry marks this value active; review compatibility before deploying it. @path is active in HTTP Signature Derived Component Names. Defining reference: RFC 9421, Section 2.2.6.
Identifier (http)
@path
The full query of the request URI
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. The registry marks this value active; review compatibility before deploying it. @query is active in HTTP Signature Derived Component Names. Defining reference: RFC 9421, Section 2.2.7.
Identifier (http)
@query
A single named query parameter
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. The registry marks this value active; review compatibility before deploying it. @query-param is active in HTTP Signature Derived Component Names. Defining reference: RFC 9421, Section 2.2.8.
Identifier (http)
@query-param
The request target of the request
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. The registry marks this value active; review compatibility before deploying it. @request-target is active in HTTP Signature Derived Component Names. Defining reference: RFC 9421, Section 2.2.5.
Identifier (http)
@request-target
The URI scheme of the request URI
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. The registry marks this value active; review compatibility before deploying it. @scheme is active in HTTP Signature Derived Component Names. Defining reference: RFC 9421, Section 2.2.4.
Identifier (http)
@scheme
Reserved for signature parameters line in signature base
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. The registry marks this value active; review compatibility before deploying it. @signature-params is active in HTTP Signature Derived Component Names. Defining reference: RFC 9421, Section 2.3.
Identifier (http)
@signature-params
The status code of the response
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. The registry marks this value active; review compatibility before deploying it. @status is active in HTTP Signature Derived Component Names. Defining reference: RFC 9421, Section 2.2.9.
Identifier (http)
@status
The full target URI of the request
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. The registry marks this value active; review compatibility before deploying it. @target-uri is active in HTTP Signature Derived Component Names. Defining reference: RFC 9421, Section 2.2.2.
Identifier (http)
@target-uri
DATA
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x00 is registered in HTTP/2 Frame Type. Defining reference: RFC9113, Section 6.1.
Identifier (http)
0x00
Reserved
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x00 is registered in HTTP/2 Settings. Defining reference: rfc9113.
Identifier (http)
0x00
Graceful shutdown
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x00 is registered in HTTP/2 Error Code. Defining reference: RFC9113, Section 7.
Identifier (http)
0x00
Registered value from the IANA HTTP registry.
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x00 is permanent in HTTP/3 Frame Types. Defining reference: RFC9114, Section 7.2.1.
Identifier (http)
0x00
N/A
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x00 is registered in HTTP/3 Settings. Defining reference: rfc9114.
Identifier (http)
0x00
Both
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x00 is permanent in HTTP/3 Stream Types. Defining reference: RFC9114, Section 6.2.1.
Identifier (http)
0x00
DATAGRAM
MASQUE values support proxying datagrams or traffic through HTTP/3 and extended CONNECT. 0x00 is permanent in HTTP Capsule Types. Defining reference: rfc9297.
Identifier (http)
0x00
HEADERS
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x01 is registered in HTTP/2 Frame Type. Defining reference: RFC9113, Section 6.2.
Identifier (http)
0x01
HEADER_TABLE_SIZE
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x01 is registered in HTTP/2 Settings. Defining reference: RFC9113, Section 6.5.2.
Identifier (http)
0x01
Protocol error detected
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x01 is registered in HTTP/2 Error Code. Defining reference: RFC9113, Section 7.
Identifier (http)
0x01
Registered value from the IANA HTTP registry.
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x01 is permanent in HTTP/3 Frame Types. Defining reference: RFC9114, Section 7.2.2.
Identifier (http)
0x01
0
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x01 is permanent in HTTP/3 Settings. Defining reference: RFC9204, Section 5.
Identifier (http)
0x01
Server
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x01 is permanent in HTTP/3 Stream Types. Defining reference: RFC9114, Section 4.4.
Identifier (http)
0x01
ADDRESS_ASSIGN
MASQUE values support proxying datagrams or traffic through HTTP/3 and extended CONNECT. 0x01 is permanent in HTTP Capsule Types. Defining reference: rfc9484.
Identifier (http)
0x01
No error
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x0100 is permanent in HTTP/3 Error Codes. Defining reference: RFC9114, Section 8.1.
Identifier (http)
0x0100
General protocol error
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x0101 is permanent in HTTP/3 Error Codes. Defining reference: RFC9114, Section 8.1.
Identifier (http)
0x0101
Internal error
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x0102 is permanent in HTTP/3 Error Codes. Defining reference: RFC9114, Section 8.1.
Identifier (http)
0x0102
Stream creation error
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x0103 is permanent in HTTP/3 Error Codes. Defining reference: RFC9114, Section 8.1.
Identifier (http)
0x0103
Critical stream was closed
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x0104 is permanent in HTTP/3 Error Codes. Defining reference: RFC9114, Section 8.1.
Identifier (http)
0x0104
Frame not permitted in the current state
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x0105 is permanent in HTTP/3 Error Codes. Defining reference: RFC9114, Section 8.1.
Identifier (http)
0x0105
Frame violated layout or size rules
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x0106 is permanent in HTTP/3 Error Codes. Defining reference: RFC9114, Section 8.1.
Identifier (http)
0x0106
Peer generating excessive load
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x0107 is permanent in HTTP/3 Error Codes. Defining reference: RFC9114, Section 8.1.
Identifier (http)
0x0107
An identifier was used incorrectly
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x0108 is permanent in HTTP/3 Error Codes. Defining reference: RFC9114, Section 8.1.
Identifier (http)
0x0108
SETTINGS frame contained invalid values
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x0109 is permanent in HTTP/3 Error Codes. Defining reference: RFC9114, Section 8.1.
Identifier (http)
0x0109
No SETTINGS frame received
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x010a is permanent in HTTP/3 Error Codes. Defining reference: RFC9114, Section 8.1.
Identifier (http)
0x010a
Request not processed
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x010b is permanent in HTTP/3 Error Codes. Defining reference: RFC9114, Section 8.1.
Identifier (http)
0x010b
Data no longer needed
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x010c is permanent in HTTP/3 Error Codes. Defining reference: RFC9114, Section 8.1.
Identifier (http)
0x010c
Stream terminated early
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x010d is permanent in HTTP/3 Error Codes. Defining reference: RFC9114, Section 8.1.
Identifier (http)
0x010d
Malformed message
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x010e is permanent in HTTP/3 Error Codes. Defining reference: RFC9114, Section 8.1.
Identifier (http)
0x010e
TCP reset or error on CONNECT request
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x010f is permanent in HTTP/3 Error Codes. Defining reference: RFC9114, Section 8.1.
Identifier (http)
0x010f
Retry over HTTP/1.1
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x0110 is permanent in HTTP/3 Error Codes. Defining reference: RFC9114, Section 8.1.
Identifier (http)
0x0110
PRIORITY
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x02 is registered in HTTP/2 Frame Type. Defining reference: RFC9113, Section 6.3.
Identifier (http)
0x02
ENABLE_PUSH
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x02 is registered in HTTP/2 Settings. Defining reference: RFC9113, Section 6.5.2.
Identifier (http)
0x02
Implementation fault
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x02 is registered in HTTP/2 Error Code. Defining reference: RFC9113, Section 7.
Identifier (http)
0x02
Registered value from the IANA HTTP registry.
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x02 is registered in HTTP/3 Frame Types. Defining reference: rfc9114.
Identifier (http)
0x02
N/A
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x02 is registered in HTTP/3 Settings. Defining reference: rfc9114.
Identifier (http)
0x02
Both
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x02 is permanent in HTTP/3 Stream Types. Defining reference: RFC9204, Section 4.2.
Identifier (http)
0x02
ADDRESS_REQUEST
MASQUE values support proxying datagrams or traffic through HTTP/3 and extended CONNECT. 0x02 is permanent in HTTP Capsule Types. Defining reference: rfc9484.
Identifier (http)
0x02
Decoding of a field section failed
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x0200 is permanent in HTTP/3 Error Codes. Defining reference: RFC9204, Section 6.
Identifier (http)
0x0200
Error on the encoder stream
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x0201 is permanent in HTTP/3 Error Codes. Defining reference: RFC9204, Section 6.
Identifier (http)
0x0201
Error on the decoder stream
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x0202 is permanent in HTTP/3 Error Codes. Defining reference: RFC9204, Section 6.
Identifier (http)
0x0202
RST_STREAM
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x03 is registered in HTTP/2 Frame Type. Defining reference: RFC9113, Section 6.4.
Identifier (http)
0x03
MAX_CONCURRENT_STREAMS
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x03 is registered in HTTP/2 Settings. Defining reference: RFC9113, Section 6.5.2.
Identifier (http)
0x03
Flow-control limits exceeded
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x03 is registered in HTTP/2 Error Code. Defining reference: RFC9113, Section 7.
Identifier (http)
0x03
Registered value from the IANA HTTP registry.
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x03 is permanent in HTTP/3 Frame Types. Defining reference: RFC9114, Section 7.2.3.
Identifier (http)
0x03
N/A
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x03 is registered in HTTP/3 Settings. Defining reference: rfc9114.
Identifier (http)
0x03
Both
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x03 is permanent in HTTP/3 Stream Types. Defining reference: RFC9204, Section 4.2.
Identifier (http)
0x03
ROUTE_ADVERTISEMENT
MASQUE values support proxying datagrams or traffic through HTTP/3 and extended CONNECT. 0x03 is permanent in HTTP Capsule Types. Defining reference: rfc9484.
Identifier (http)
0x03
SETTINGS
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x04 is registered in HTTP/2 Frame Type. Defining reference: RFC9113, Section 6.5.
Identifier (http)
0x04
INITIAL_WINDOW_SIZE
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x04 is registered in HTTP/2 Settings. Defining reference: RFC9113, Section 6.5.2.
Identifier (http)
0x04
Settings not acknowledged
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x04 is registered in HTTP/2 Error Code. Defining reference: RFC9113, Section 7.
Identifier (http)
0x04
Registered value from the IANA HTTP registry.
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x04 is permanent in HTTP/3 Frame Types. Defining reference: RFC9114, Section 7.2.4.
Identifier (http)
0x04
N/A
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x04 is registered in HTTP/3 Settings. Defining reference: rfc9114.
Identifier (http)
0x04
PUSH_PROMISE
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x05 is registered in HTTP/2 Frame Type. Defining reference: RFC9113, Section 6.6.
Identifier (http)
0x05
MAX_FRAME_SIZE
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x05 is registered in HTTP/2 Settings. Defining reference: RFC9113, Section 6.5.2.
Identifier (http)
0x05
Frame received for closed stream
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x05 is registered in HTTP/2 Error Code. Defining reference: RFC9113, Section 7.
Identifier (http)
0x05
Registered value from the IANA HTTP registry.
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x05 is permanent in HTTP/3 Frame Types. Defining reference: RFC9114, Section 7.2.5.
Identifier (http)
0x05
N/A
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x05 is registered in HTTP/3 Settings. Defining reference: rfc9114.
Identifier (http)
0x05
PING
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x06 is registered in HTTP/2 Frame Type. Defining reference: RFC9113, Section 6.7.
Identifier (http)
0x06
MAX_HEADER_LIST_SIZE
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x06 is registered in HTTP/2 Settings. Defining reference: RFC9113, Section 6.5.2.
Identifier (http)
0x06
Frame size incorrect
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x06 is registered in HTTP/2 Error Code. Defining reference: RFC9113, Section 7.
Identifier (http)
0x06
Registered value from the IANA HTTP registry.
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x06 is registered in HTTP/3 Frame Types. Defining reference: rfc9114.
Identifier (http)
0x06
Unlimited
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x06 is permanent in HTTP/3 Settings. Defining reference: RFC9114, Section 7.2.4.1.
Identifier (http)
0x06
GOAWAY
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x07 is registered in HTTP/2 Frame Type. Defining reference: RFC9113, Section 6.8.
Identifier (http)
0x07
Unassigned
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x07 is registered in HTTP/2 Settings.
Identifier (http)
0x07
Stream not processed
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x07 is registered in HTTP/2 Error Code. Defining reference: RFC9113, Section 7.
Identifier (http)
0x07
Registered value from the IANA HTTP registry.
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x07 is permanent in HTTP/3 Frame Types. Defining reference: RFC9114, Section 7.2.6.
Identifier (http)
0x07
0
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x07 is permanent in HTTP/3 Settings. Defining reference: RFC9204, Section 5.
Identifier (http)
0x07
WINDOW_UPDATE
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x08 is registered in HTTP/2 Frame Type. Defining reference: RFC9113, Section 6.9.
Identifier (http)
0x08
SETTINGS_ENABLE_CONNECT_PROTOCOL
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x08 is registered in HTTP/2 Settings. Defining reference: rfc8441.
Identifier (http)
0x08
Stream cancelled
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x08 is registered in HTTP/2 Error Code. Defining reference: RFC9113, Section 7.
Identifier (http)
0x08
0
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x08 is permanent in HTTP/3 Settings. Defining reference: rfc9220.
Identifier (http)
0x08
DATA
MASQUE values support proxying datagrams or traffic through HTTP/3 and extended CONNECT. The registry marks this value provisional; review compatibility before deploying it. 0x08 is provisional in HTTP Capsule Types. Defining reference: draft-ietf-httpbis-connect-tcp-12.
Identifier (http)
0x08
Registered value from the IANA HTTP registry.
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x08-0x09 is registered in HTTP/3 Frame Types. Defining reference: rfc9114.
Identifier (http)
0x08-0x09
CONTINUATION
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x09 is registered in HTTP/2 Frame Type. Defining reference: RFC9113, Section 6.10.
Identifier (http)
0x09
SETTINGS_NO_RFC7540_PRIORITIES
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x09 is registered in HTTP/2 Settings. Defining reference: rfc9218.
Identifier (http)
0x09
Compression state not updated
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x09 is registered in HTTP/2 Error Code. Defining reference: RFC9113, Section 7.
Identifier (http)
0x09
FINAL_DATA
MASQUE values support proxying datagrams or traffic through HTTP/3 and extended CONNECT. The registry marks this value provisional; review compatibility before deploying it. 0x09 is provisional in HTTP Capsule Types. Defining reference: draft-ietf-httpbis-connect-tcp-12.
Identifier (http)
0x09
ALTSVC
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x0a is registered in HTTP/2 Frame Type. Defining reference: RFC7838, Section 4.
Identifier (http)
0x0a
TCP connection error for CONNECT method
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x0a is registered in HTTP/2 Error Code. Defining reference: RFC9113, Section 7.
Identifier (http)
0x0a
Registered value from the IANA HTTP registry.
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x0a-0x0b is registered in HTTP/3 Frame Types.
Identifier (http)
0x0a-0x0b
Unassigned
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x0a-0x0f is registered in HTTP/2 Settings.
Identifier (http)
0x0a-0x0f
Unassigned
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x0b is registered in HTTP/2 Frame Type.
Identifier (http)
0x0b
Processing capacity exceeded
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x0b is registered in HTTP/2 Error Code. Defining reference: RFC9113, Section 7.
Identifier (http)
0x0b
ORIGIN
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x0c is registered in HTTP/2 Frame Type. Defining reference: rfc8336.
Identifier (http)
0x0c
Negotiated TLS parameters not acceptable
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x0c is registered in HTTP/2 Error Code. Defining reference: RFC9113, Section 7.
Identifier (http)
0x0c
Registered value from the IANA HTTP registry.
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x0c is permanent in HTTP/3 Frame Types. Defining reference: RFC9412, Section 2.
Identifier (http)
0x0c
Use HTTP/1.1 for the request
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x0d is registered in HTTP/2 Error Code. Defining reference: RFC9113, Section 7.
Identifier (http)
0x0d
Registered value from the IANA HTTP registry.
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x0d is permanent in HTTP/3 Frame Types. Defining reference: RFC9114, Section 7.2.7.
Identifier (http)
0x0d
Unassigned
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x0d-0x0f is registered in HTTP/2 Frame Type.
Identifier (http)
0x0d-0x0f
Registered value from the IANA HTTP registry.
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x0e-0x4c is registered in HTTP/3 Frame Types.
Identifier (http)
0x0e-0x4c
Registered value from the IANA HTTP registry.
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x0e-0xffffffff is registered in HTTP/2 Error Code.
Identifier (http)
0x0e-0xffffffff
PRIORITY_UPDATE
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x10 is registered in HTTP/2 Frame Type. Defining reference: rfc9218.
Identifier (http)
0x10
TLS_RENEG_PERMITTED
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x10 is registered in HTTP/2 Settings. Defining reference: MS-HTTP2E.
Identifier (http)
0x10
COMPRESSION_ASSIGN
MASQUE values support proxying datagrams or traffic through HTTP/3 and extended CONNECT. 0x11 is permanent in HTTP Capsule Types. Defining reference: RFC-ietf-masque-connect-udp-listen-16.
Identifier (http)
0x11
Unassigned
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x11-0x4d43 is registered in HTTP/2 Settings.
Identifier (http)
0x11-0x4d43
Unassigned
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x11-0xff is registered in HTTP/2 Frame Type.
Identifier (http)
0x11-0xff
COMPRESSION_ACK
MASQUE values support proxying datagrams or traffic through HTTP/3 and extended CONNECT. 0x12 is permanent in HTTP Capsule Types. Defining reference: RFC-ietf-masque-connect-udp-listen-16.
Identifier (http)
0x12
COMPRESSION_CLOSE
MASQUE values support proxying datagrams or traffic through HTTP/3 and extended CONNECT. 0x13 is permanent in HTTP Capsule Types. Defining reference: RFC-ietf-masque-connect-udp-listen-16.
Identifier (http)
0x13
FULL_NONCE_COUNTER
MASQUE values support proxying datagrams or traffic through HTTP/3 and extended CONNECT. 0x243f is permanent in HTTP Capsule Types. Defining reference: https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=3390.
Identifier (http)
0x243f
0
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x33 is permanent in HTTP/3 Settings. Defining reference: rfc9297.
Identifier (http)
0x33
Datagram or Capsule Protocol parse error
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0x33 is permanent in HTTP/3 Error Codes. Defining reference: rfc9297.
Identifier (http)
0x33
Registered value from the IANA HTTP registry.
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. The registry marks this value provisional; review compatibility before deploying it. 0x4d is provisional in HTTP/3 Frame Types. Defining reference: draft-beky-httpbis-metadata-02.
Identifier (http)
0x4d
SETTINGS_ENABLE_METADATA
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x4d44 is registered in HTTP/2 Settings. Defining reference: draft-beky-httpbis-metadata-02.
Identifier (http)
0x4d44
0
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. The registry marks this value provisional; review compatibility before deploying it. 0x4d44 is provisional in HTTP/3 Settings. Defining reference: draft-beky-httpbis-metadata-02.
Identifier (http)
0x4d44
Unassigned
HTTP/2 registry values apply to binary framing, stream state, connection setup, or protocol negotiation. 0x4d45-0xffff is registered in HTTP/2 Settings.
Identifier (http)
0x4d45-0xffff
Registered value from the IANA HTTP registry.
HTTP/3 registry values apply to QUIC-backed streams, frames, settings, or protocol negotiation. 0xf0700-0xf0701 is permanent in HTTP/3 Frame Types. Defining reference: rfc9218.
Identifier (http)
0xf0700-0xf0701
Response is Stale
Warning values report cache or response conditions affecting representation interpretation. 110 is registered in HTTP Warn Codes. Defining reference: RFC7234, Section 5.5.1.
Identifier (http)
110
Revalidation Failed
Warning values report cache or response conditions affecting representation interpretation. 111 is registered in HTTP Warn Codes. Defining reference: RFC7234, Section 5.5.2.
Identifier (http)
111
Disconnected Operation
Warning values report cache or response conditions affecting representation interpretation. 112 is registered in HTTP Warn Codes. Defining reference: RFC7234, Section 5.5.3.
Identifier (http)
112
Heuristic Expiration
Warning values report cache or response conditions affecting representation interpretation. 113 is registered in HTTP Warn Codes. Defining reference: RFC7234, Section 5.5.4.
Identifier (http)
113
Miscellaneous Warning
Warning values report cache or response conditions affecting representation interpretation. 199 is registered in HTTP Warn Codes. Defining reference: RFC7234, Section 5.5.5.
Identifier (http)
199
Transformation Applied
Warning values report cache or response conditions affecting representation interpretation. 214 is registered in HTTP Warn Codes. Defining reference: RFC7234, Section 5.5.6.
Identifier (http)
214
Miscellaneous Persistent Warning
Warning values report cache or response conditions affecting representation interpretation. 299 is registered in HTTP Warn Codes. Defining reference: RFC7234, Section 5.5.7.
Identifier (http)
299
Requests that each collection within the response contain no more than the number of items specified as the positive integer value of this preference.
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. A positive integer that represents the maximum number of items each collection in a response SHOULD contain. is registered in HTTP Preferences. Defining reference: OData Version 4.01 Part 1: Protocol.
Identifier (http)
A positive integer that represents the maximum number of items each
collection in a response SHOULD contain.The ADLER32 algorithm.
Integrity registry values define algorithms or message metadata used to detect alteration of HTTP content or representations. The registry marks this value deprecated; review compatibility before deploying it. adler is deprecated in Hash Algorithms for HTTP Digest Fields. Defining reference: rfc1950.
Identifier (http)
adler
The ADLER32 algorithm is a checksum specified in RFC1950 "ZLIB Compressed Data Format". The 32-bit output is encoded in hexadecimal (using between 1 and 8 ASCII characters from 0-9, A-F, and a-f; leading 0's are allowed). For example, ADLER32=03da0195 and ADLER32=3DA0195 are both valid checksums for the 4-byte message "Wiki".
Integrity registry values define algorithms or message metadata used to detect alteration of HTTP content or representations. ADLER32 is registered in HTTP Digest Algorithm Values. Defining reference: rfc1950.
Identifier (http)
ADLER32
AES-GCM encryption with a 128-bit content encryption key
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. aes128gcm is registered in HTTP Content Coding Registry. Defining reference: rfc8188.
Identifier (http)
aes128gcm
Explicitly declared signature algorithm
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. alg is registered in HTTP Signature Metadata Parameters. Defining reference: RFC 9421, Section 2.3.
Identifier (http)
alg
Registered value from the IANA HTTP registry.
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. auth-style is registered in HTTP Authentication Control Parameters. Defining reference: RFC8053, Section 4.2.
Identifier (http)
auth-style
Registered value from the IANA HTTP registry.
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. Basic is registered in HTTP Authentication Schemes. Defining reference: rfc7617.
Identifier (http)
Basic
Registered value from the IANA HTTP registry.
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. Bearer is registered in HTTP Authentication Schemes. Defining reference: rfc6750.
Identifier (http)
Bearer
Brotli Compressed Data Format
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. br is registered in HTTP Content Coding Registry. Defining reference: rfc7932.
Identifier (http)
br
Byte Sequence wrapping indicator
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. bs is registered in HTTP Signature Component Parameters. Defining reference: RFC 9421, Section 2.1.3.
Identifier (http)
bs
IP-address of incoming interface of a proxy
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. by is registered in HTTP Forwarded Parameters. Defining reference: rfc7239.
Identifier (http)
by
a range of octets
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. bytes is registered in HTTP Range Unit Registry. Defining reference: rfc9110.
Identifier (http)
bytes
Transfer in a series of chunks
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. chunked is registered in HTTP Transfer Coding Registry. Defining reference: rfc9112.
Identifier (http)
chunked
Indicates whether this request was collapsed together with one or more other forward requests (see, Section 4); If true, the response was successfully reused; if not, a new request had to be made.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. collapsed is registered in HTTP Cache-Status. Defining reference: rfc9211.
Identifier (http)
collapsed
Specifies the set of annotations the client requests to be included, where applicable, or excluded in the response.
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. Comma-separated list of terms to include or, when prefixed with a minus sign (-), exclude from the response. … is registered in HTTP Preferences. Defining reference: OData Version 4.01 Part 1: Protocol.
Identifier (http)
Comma-separated list of terms to include or, when prefixed with a minus
sign (-), exclude from the response. …UNIX "compress" data format [Welch, T., "A Technique for High Performance Data Compression", IEEE Computer 17(6), June 1984.]
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. compress is registered in HTTP Content Coding Registry. Defining reference: rfc9110.
Identifier (http)
compress
UNIX "compress" data format [Welch, T., "A Technique for High Performance Data Compression", IEEE Computer 17(6), June 1984.]
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. compress is registered in HTTP Transfer Coding Registry. Defining reference: rfc9112.
Identifier (http)
compress
Registered value from the IANA HTTP registry.
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. Concealed is registered in HTTP Authentication Schemes. Defining reference: rfc9729.
Identifier (http)
Concealed
Proxying of IP Payloads
Upgrade values negotiate an alternate protocol or capability at a defined HTTP boundary. connect-ip is registered in HTTP Upgrade Tokens. Defining reference: rfc9484.
Identifier (http)
connect-ip
Proxying of UDP Payloads
Upgrade values negotiate an alternate protocol or capability at a defined HTTP boundary. connect-udp is registered in HTTP Upgrade Tokens. Defining reference: rfc9298.
Identifier (http)
connect-udp
The intermediary is configured to limit the number of connections it has to the next hop, and that limit has been exceeded.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. connection_limit_reached is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
connection_limit_reached
The intermediary was expecting data on a connection (e.g., part of a response) but did not receive any new data in a configured time limit.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. connection_read_timeout is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
connection_read_timeout
The intermediary's connection to the next hop was refused.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. connection_refused is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
connection_refused
The intermediary's connection to the next hop was closed before a complete response was received.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. connection_terminated is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
connection_terminated
The intermediary's attempt to open a connection to the next hop timed out.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. connection_timeout is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
connection_timeout
The intermediary was attempting to write data to a connection but was not able to (e.g., because its buffers were full).
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. connection_write_timeout is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
connection_write_timeout
The CRC32c algorithm.
Integrity registry values define algorithms or message metadata used to detect alteration of HTTP content or representations. The registry marks this value deprecated; review compatibility before deploying it. crc32c is deprecated in Hash Algorithms for HTTP Digest Fields. Defining reference: RFC9260, Appendix A.
Identifier (http)
crc32c
The CRC32c algorithm is a 32-bit cyclic redundancy check. It achieves a better hamming distance (for better error-detection performance) than many other 32-bit CRC functions. Other places it is used include iSCSI and SCTP. The 32-bit output is encoded in hexadecimal (using between 1 and 8 ASCII characters from 0-9, A-F, and a-f; leading 0's are allowed). For example, CRC32c=0a72a4df and crc32c=A72A4DF are both valid checksums for the 3-byte message "dog".
Integrity registry values define algorithms or message metadata used to detect alteration of HTTP content or representations. CRC32c is registered in HTTP Digest Algorithm Values. Defining reference: RFC9260, Appendix A.
Identifier (http)
CRC32c
Timestamp of signature creation
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. created is registered in HTTP Signature Metadata Parameters. Defining reference: RFC 9421, Section 2.3.
Identifier (http)
created
Registered value from the IANA HTTP registry.
Problem-type values identify machine-readable API error semantics and migration guidance. Date Not Acceptable is registered in HTTP Problem Types. Defining reference: RFC9458, Section 6.5.2.
Identifier (http)
Date Not Acceptable
"Dictionary-Compressed Brotli" data format.
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. dcb is registered in HTTP Content Coding Registry. Defining reference: rfc9842.
Identifier (http)
dcb
"Dictionary-Compressed Zstandard" data format.
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. dcz is registered in HTTP Content Coding Registry. Defining reference: rfc9842.
Identifier (http)
dcz
"deflate" compressed data () inside the "zlib" data format ()
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. deflate is registered in HTTP Content Coding Registry. Defining reference: rfc9110.
Identifier (http)
deflate
"deflate" compressed data () inside the "zlib" data format ()
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. deflate is registered in HTTP Transfer Coding Registry. Defining reference: rfc9112.
Identifier (http)
deflate
The "depth-noroot" preference indicates that the client wishes for the server to exclude the target (root) resource from processing by the HTTP method and only apply the HTTP method to the target resource's subordinate resources. This preference is only intended to be used with HTTP methods whose definitions explicitly provide support for the Depthheader field. Furthermore, this preference only applies when the Depth header field has a value of "1" or "infinity" (either implicitly or explicitly).
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. depth-noroot is registered in HTTP Preferences. Defining reference: rfc8144.
Identifier (http)
depth-noroot
The intermediary is configured to prohibit connections to the next-hop IP address.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. destination_ip_prohibited is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
destination_ip_prohibited
The intermediary cannot find a route to the next-hop IP address.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. destination_ip_unroutable is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
destination_ip_unroutable
The intermediary cannot determine the appropriate next hop to use for this request; for example, it may not be configured. Note that this error is specific to gateways, which typically require specific configuration to identify the "backend" server; forward proxies use in-band information to identify the origin server.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. destination_not_found is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
destination_not_found
The intermediary considers the next hop to be unavailable; e.g., recent attempts to communicate with it may have failed, or a health check may indicate that it is down.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. destination_unavailable is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
destination_unavailable
Allows implementations to convey additional information not captured in other parameters, such as implementation-specific states or other caching-related metrics.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. detail is registered in HTTP Cache-Status. Defining reference: rfc9211.
Identifier (http)
detail
The details parameter's value is a String containing additional information not captured anywhere else. This can include implementation-specific or deployment-specific information.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. details is registered in HTTP Proxy-Status Parameters. Defining reference: rfc9209.
Identifier (http)
details
Registered value from the IANA HTTP registry.
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. Digest is registered in HTTP Authentication Schemes. Defining reference: rfc7616.
Identifier (http)
Digest
The intermediary encountered a DNS error when trying to find an IP address for the next-hop hostname.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. dns_error is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
dns_error
The intermediary encountered a timeout when trying to find an IP address for the next-hop hostname.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. dns_timeout is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
dns_timeout
Registered value from the IANA HTTP registry.
Cookie values control browser state, scope, lifetime, transport, and cross-site behavior. Domain is registered in Cookie Attributes. Defining reference: RFC-ietf-httpbis-rfc6265bis-22, Section 4.1.2.3.
Identifier (http)
Domain
Registered value from the IANA HTTP registry.
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. DPoP is registered in HTTP Authentication Schemes. Defining reference: RFC9449, Section 7.1.
Identifier (http)
DPoP
ECDSA using curve P-256 DSS and SHA-256
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. The registry marks this value active; review compatibility before deploying it. ecdsa-p256-sha256 is active in HTTP Signature Algorithms. Defining reference: RFC 9421, Section 3.3.4.
Identifier (http)
ecdsa-p256-sha256
ECDSA using curve P-384 DSS and SHA-384
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. The registry marks this value active; review compatibility before deploying it. ecdsa-p384-sha384 is active in HTTP Signature Algorithms. Defining reference: RFC 9421, Section 3.3.5.
Identifier (http)
ecdsa-p384-sha384
EdDSA using curve edwards25519
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. The registry marks this value active; review compatibility before deploying it. ed25519 is active in HTTP Signature Algorithms. Defining reference: RFC 9421, Section 3.3.6.
Identifier (http)
ed25519
The error parameter's value is a Token that is a proxy error type. When present, it indicates that the intermediary encountered an issue when obtaining this response.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. error is registered in HTTP Proxy-Status Parameters. Defining reference: rfc9209.
Identifier (http)
error
W3C Efficient XML Interchange
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. exi is registered in HTTP Content Coding Registry. Defining reference: W3C Recommendation: Efficient XML Interchange (EXI) Format.
Identifier (http)
exi
Timestamp of proposed signature expiration
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. expires is registered in HTTP Signature Metadata Parameters. Defining reference: RFC 9421, Section 2.3.
Identifier (http)
expires
Registered value from the IANA HTTP registry.
Cookie values control browser state, scope, lifetime, transport, and cross-site behavior. Expires is registered in Cookie Attributes. Defining reference: RFC-ietf-httpbis-rfc6265bis-22, Section 4.1.2.1.
Identifier (http)
Expires
IP-address of client making a request through a proxy
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. for is registered in HTTP Forwarded Parameters. Defining reference: rfc7239.
Identifier (http)
for
When present, indicates that the request went forward towards the origin; its value indicates why.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. fwd is registered in HTTP Cache-Status. Defining reference: rfc9211.
Identifier (http)
fwd
Indicates which status code (see, Section 15) the next-hop server returned in response to the forwarded request.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. fwd-status is registered in HTTP Cache-Status. Defining reference: rfc9211.
Identifier (http)
fwd-status
Registered value from the IANA HTTP registry.
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. GNAP is registered in HTTP Authentication Schemes. Defining reference: RFC9635, Section 7.2.
Identifier (http)
GNAP
GZIP file format
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. gzip is registered in HTTP Content Coding Registry. Defining reference: rfc9110.
Identifier (http)
gzip
GZIP file format
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. gzip is registered in HTTP Transfer Coding Registry. Defining reference: rfc9112.
Identifier (http)
gzip
Hypertext Transfer Protocol version 2 (HTTP/2) (OBSOLETE)
Upgrade values negotiate an alternate protocol or capability at a defined HTTP boundary. The registry marks this value obsoleted; review compatibility before deploying it. h2c is obsoleted in HTTP Upgrade Tokens. Defining reference: RFC9113, Section 3.1.
Identifier (http)
h2c
When true, indicates that the request was satisfied by the cache; that is, it was not forwarded, and the response was obtained from the cache.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. hit is registered in HTTP Cache-Status. Defining reference: rfc9211.
Identifier (http)
hit
HMAC using SHA-256
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. The registry marks this value active; review compatibility before deploying it. hmac-sha256 is active in HTTP Signature Algorithms. Defining reference: RFC 9421, Section 3.3.3.
Identifier (http)
hmac-sha256
Registered value from the IANA HTTP registry.
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. HOBA is registered in HTTP Authentication Schemes. Defining reference: RFC7486, Section 3.
Identifier (http)
HOBA
Hostname verification only
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. host is registered in HTTP Mutual Authentication Host Validation Methods. Defining reference: RFC8120, Section 7.
Identifier (http)
host
Host header field of the incoming request
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. host is registered in HTTP Forwarded Parameters. Defining reference: rfc7239.
Identifier (http)
host
Hypertext Transfer Protocol
Upgrade values negotiate an alternate protocol or capability at a defined HTTP boundary. HTTP is registered in HTTP Upgrade Tokens. Defining reference: RFC9110, Section 2.5.
Identifier (http)
HTTP
The intermediary encountered an HTTP protocol error when communicating with the next hop. This error should only be used when a more specific one is not defined.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. http_protocol_error is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
http_protocol_error
The intermediary rejected the HTTP request based on its configuration and/or policy settings. The request wasn't forwarded to the next hop.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. http_request_denied is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
http_request_denied
The intermediary is generating a client (4xx) response on the origin's behalf. Applicable status codes include (but are not limited to) 400, 403, 405, 406, 408, 411, 413, 414, 415, 416, 417, and 429.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. http_request_error is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
http_request_error
The intermediary received a response to the request whose body was considered too large.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. http_response_body_size is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
http_response_body_size
The intermediary encountered an error decoding the content coding of the response.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. http_response_content_coding is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
http_response_content_coding
The intermediary received a response to the request whose header section was considered too large.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. http_response_header_section_size is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
http_response_header_section_size
The intermediary received a response to the request containing an individual header field line that was considered too large.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. http_response_header_size is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
http_response_header_size
The intermediary received an incomplete response to the request from the next hop.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. http_response_incomplete is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
http_response_incomplete
The intermediary reached a configured time limit waiting for the complete response.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. http_response_timeout is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
http_response_timeout
The intermediary received a response to the request whose trailer section was considered too large.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. http_response_trailer_section_size is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
http_response_trailer_section_size
The intermediary received a response to the request containing an individual trailer field line that was considered too large.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. http_response_trailer_size is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
http_response_trailer_size
The intermediary encountered an error decoding the transfer coding of the response.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. http_response_transfer_coding is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
http_response_transfer_coding
The process of negotiating an upgrade of the HTTP version between the intermediary and the next hop failed.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. http_upgrade_failed is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
http_upgrade_failed
Registered value from the IANA HTTP registry.
Cookie values control browser state, scope, lifetime, transport, and cross-site behavior. HttpOnly is registered in Cookie Attributes. Defining reference: RFC-ietf-httpbis-rfc6265bis-22, Section 4.1.2.6.
Identifier (http)
HttpOnly
Whether an HTTP response can be processed incrementally.
Priority values are scheduling hints that do not change HTTP correctness. i is registered in HTTP Priority. Defining reference: RFC9218, Section 4.2.
Identifier (http)
i
Reserved
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. identity is registered in HTTP Content Coding Registry. Defining reference: rfc9110.
Identifier (http)
identity
(withdrawn in errata to)
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. identity is registered in HTTP Transfer Coding Registry. Defining reference: rfc2616.
Identifier (http)
identity
Registered value from the IANA HTTP registry.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. immutable is registered in HTTP Cache Directive Registry. Defining reference: rfc8246.
Identifier (http)
immutable
The HTTP message contained the Incremental HTTP header field, but the intermediary refused to forward the message incrementally.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. incremental_refused is registered in HTTP Proxy Error Types. Defining reference: rfc10036.
Identifier (http)
incremental_refused
Registered value from the IANA HTTP registry.
Problem-type values identify machine-readable API error semantics and migration guidance. Invalid Digest Values is registered in HTTP Problem Types. Defining reference: RFC-ietf-httpapi-digest-fields-problem-types-06, Section 3.2.
Identifier (http)
Invalid Digest Values
IP Proxying
MASQUE values support proxying datagrams or traffic through HTTP/3 and extended CONNECT. ip is registered in MASQUE URI Suffixes. Defining reference: rfc9484.
Identifier (http)
ip
ISO-11770-4 KAM3, 2048-bit DL
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. iso-kam3-dl-2048-sha256 is registered in HTTP Mutual Authentication Algorithms. Defining reference: rfc8121.
Identifier (http)
iso-kam3-dl-2048-sha256
ISO-11770-4 KAM3, 4096-bit DL
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. iso-kam3-dl-4096-sha512 is registered in HTTP Mutual Authentication Algorithms. Defining reference: rfc8121.
Identifier (http)
iso-kam3-dl-4096-sha512
ISO-11770-4 KAM3, 256-bit EC
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. iso-kam3-ec-p256-sha256 is registered in HTTP Mutual Authentication Algorithms. Defining reference: rfc8121.
Identifier (http)
iso-kam3-ec-p256-sha256
ISO-11770-4 KAM3, 521-bit EC
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. iso-kam3-ec-p521-sha512 is registered in HTTP Mutual Authentication Algorithms. Defining reference: rfc8121.
Identifier (http)
iso-kam3-ec-p521-sha512
Conveys a representation of the cache key (see, Section 2) used for the response.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. key is registered in HTTP Cache-Status. Defining reference: rfc9211.
Identifier (http)
key
Single key value of Dictionary Structured Fields
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. key is registered in HTTP Signature Component Parameters. Defining reference: RFC 9421, Section 2.1.2.
Identifier (http)
key
Key identifier for the signing and verification keys used to create this signature
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. keyid is registered in HTTP Signature Metadata Parameters. Defining reference: RFC 9421, Section 2.3.
Identifier (http)
keyid
Registered value from the IANA HTTP registry.
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. location-when-logout is registered in HTTP Authentication Control Parameters. Defining reference: RFC8053, Section 4.5.
Identifier (http)
location-when-logout
Registered value from the IANA HTTP registry.
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. location-when-unauthenticated is registered in HTTP Authentication Control Parameters. Defining reference: RFC8053, Section 4.3.
Identifier (http)
location-when-unauthenticated
Registered value from the IANA HTTP registry.
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. logout-timeout is registered in HTTP Authentication Control Parameters. Defining reference: RFC8053, Section 4.6.
Identifier (http)
logout-timeout
Registered value from the IANA HTTP registry.
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. ma is registered in HTTP Alt-Svc Parameter Registry. Defining reference: RFC7838, Section 3.1.
Identifier (http)
ma
Registered value from the IANA HTTP registry.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. max-age is registered in HTTP Cache Directive Registry. Defining reference: RFC9111, Section 5.2.1.1, 5.2.2.1.
Identifier (http)
max-age
Registered value from the IANA HTTP registry.
Cookie values control browser state, scope, lifetime, transport, and cross-site behavior. Max-Age is registered in Cookie Attributes. Defining reference: RFC-ietf-httpbis-rfc6265bis-22, Section 4.1.2.2.
Identifier (http)
Max-Age
Registered value from the IANA HTTP registry.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. max-stale is registered in HTTP Cache Directive Registry. Defining reference: RFC9111, Section 5.2.1.2.
Identifier (http)
max-stale
The MD5 algorithm. It is vulnerable to collision attacks; seeand
Integrity registry values define algorithms or message metadata used to detect alteration of HTTP content or representations. The registry marks this value deprecated; review compatibility before deploying it. md5 is deprecated in Hash Algorithms for HTTP Digest Fields. Defining reference: rfc1321.
Identifier (http)
md5
The MD5 algorithm, as specified in. The output of this algorithm is encoded using the base64 encoding.
Integrity registry values define algorithms or message metadata used to detect alteration of HTTP content or representations. MD5 is registered in HTTP Digest Algorithm Values. Defining reference: rfc1321.
Identifier (http)
MD5
128
Integrity registry values define algorithms or message metadata used to detect alteration of HTTP content or representations. MD5 is registered in Hash Algorithms for HTTP Digest Authentication. Defining reference: rfc7616.
Identifier (http)
MD5
Registered value from the IANA HTTP registry.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. min-fresh is registered in HTTP Cache Directive Registry. Defining reference: RFC9111, Section 5.2.1.3.
Identifier (http)
min-fresh
Registered value from the IANA HTTP registry.
Problem-type values identify machine-readable API error semantics and migration guidance. Mismatched Digest Values is registered in HTTP Problem Types. Defining reference: RFC-ietf-httpapi-digest-fields-problem-types-06, Section 3.3.
Identifier (http)
Mismatched Digest Values
Registered value from the IANA HTTP registry.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. must-revalidate is registered in HTTP Cache Directive Registry. Defining reference: RFC9111, Section 5.2.2.2.
Identifier (http)
must-revalidate
Registered value from the IANA HTTP registry.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. must-understand is registered in HTTP Cache Directive Registry. Defining reference: RFC9111, Section 5.2.2.3.
Identifier (http)
must-understand
Registered value from the IANA HTTP registry.
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. Mutual is registered in HTTP Authentication Schemes. Defining reference: rfc8120.
Identifier (http)
Mutual
Single named query parameter
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. name is registered in HTTP Signature Component Parameters. Defining reference: RFC 9421, Section 2.2.8.
Identifier (http)
name
Registered value from the IANA HTTP registry.
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. Negotiate is registered in HTTP Authentication Schemes. Defining reference: RFC4559, Section 3.
Identifier (http)
Negotiate
The next-hop parameter's value is a String or Token that identifies the intermediary or origin server selected (and used, if contacted) to obtain this response. It might be a hostname, IP address, or alias.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. next-hop is registered in HTTP Proxy-Status Parameters. Defining reference: rfc9209.
Identifier (http)
next-hop
A string containing one or more DNS aliases or canonical names used to establish a proxied connection to the next hop.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. next-hop-aliases is registered in HTTP Proxy-Status Parameters. Defining reference: rfc9532.
Identifier (http)
next-hop-aliases
The next-protocol parameter's value indicates the Application-Layer Protocol Negotiation (ALPN) protocol identifierof the protocol used by the intermediary to connect to the next hop when obtaining this response.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. next-protocol is registered in HTTP Proxy-Status Parameters. Defining reference: rfc9209.
Identifier (http)
next-protocol
Registered value from the IANA HTTP registry.
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. no-auth is registered in HTTP Authentication Control Parameters. Defining reference: RFC8053, Section 4.4.
Identifier (http)
no-auth
Registered value from the IANA HTTP registry.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. no-cache is registered in HTTP Cache Directive Registry. Defining reference: RFC9111, Section 5.2.1.4, 5.2.2.4.
Identifier (http)
no-cache
Registered value from the IANA HTTP registry.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. no-store is registered in HTTP Cache Directive Registry. Defining reference: RFC9111, Section 5.2.1.5, 5.2.2.5.
Identifier (http)
no-store
Registered value from the IANA HTTP registry.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. no-transform is registered in HTTP Cache Directive Registry. Defining reference: RFC9111, Section 5.2.1.6, 5.2.2.6.
Identifier (http)
no-transform
A single-use nonce value
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. nonce is registered in HTTP Signature Metadata Parameters. Defining reference: RFC 9421, Section 2.3.
Identifier (http)
nonce
reserved as keyword to indicate range requests are not supported
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. none is registered in HTTP Range Unit Registry. Defining reference: rfc9110.
Identifier (http)
none
Registered value from the IANA HTTP registry.
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. OAuth is registered in HTTP Authentication Schemes. Defining reference: RFC5849, Section 3.5.1.
Identifier (http)
OAuth
Registered value from the IANA HTTP registry.
Problem-type values identify machine-readable API error semantics and migration guidance. Oblivious HTTP key configuration not acceptable is registered in HTTP Problem Types. Defining reference: RFC9458, Section 5.3.
Identifier (http)
Oblivious HTTP key configuration not acceptable
Indicates that the service is allowed to return references in place of resources that have previously been returned, with at least the properties requested, in the same response.
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. odata.allow-entityreferences is registered in HTTP Preferences. Defining reference: OData Version 4.01 Part 1: Protocol.
Identifier (http)
odata.allow-entityreferences
Requests that the service invoke the specified URL to signal some service state, such as the completion of an asynchronous result or availability of new or modified information. The service state that triggers the change is dependent upon the request.
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. odata.callback is registered in HTTP Preferences. Defining reference: OData Version 4.01 Part 1: Protocol.
Identifier (http)
odata.callback
Requests that the service attempt to continue processing a request that encounters non-fatal errors, for example in a multi-part request. The response SHOULD indicate what portions of the request were and were not able to be successfully handled.
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. odata.continue-on-error is registered in HTTP Preferences. Defining reference: OData Version 4.01 Part 1: Protocol.
Identifier (http)
odata.continue-on-error
Requests that the service initiate change tracking on the result of this request, according to the underlying protocol.
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. odata.track-changes is registered in HTTP Preferences. Defining reference: OData Version 4.01 Part 1: Protocol.
Identifier (http)
odata.track-changes
When the value is "minimal", it indicates that the client prefers that the server return a minimal response to a request. When the value is "representation", it indicates that the client prefers that the server include a representation of the current state of the resource in response to a request.
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. One of either "minimal" or "representation" is registered in HTTP Preferences. Defining reference: rfc7240.
Identifier (http)
One of either "minimal" or "representation"
When value is "strict", it indicates that the client wishes the server to apply strict validation and error handling to the processing of a request. When the value is "lenient", it indicates that the client wishes the server to apply lenient validation and error handling to the processing of the request.
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. One of either "strict" or "lenient" is registered in HTTP Preferences. Defining reference: rfc7240.
Identifier (http)
One of either "strict" or "lenient"
Specifies whether a server can omit properties with a null value or properties set to their default value from a response.
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. One of nulls - properties containing null values may be omitted from the response defaults - properties cont… is registered in HTTP Preferences. Defining reference: OData Version 4.01 Part 1: Protocol.
Identifier (http)
One of nulls - properties containing null values may be omitted from the
response defaults - properties cont…Registered value from the IANA HTTP registry.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. only-if-cached is registered in HTTP Cache Directive Registry. Defining reference: RFC9111, Section 5.2.1.7.
Identifier (http)
only-if-cached
Network Transfer Format for Java Archives
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. pack200-gzip is registered in HTTP Content Coding Registry. Defining reference: JSR 200: Network Transfer Format for Java.
Identifier (http)
pack200-gzip
Registered value from the IANA HTTP registry.
Cookie values control browser state, scope, lifetime, transport, and cross-site behavior. Path is registered in Cookie Attributes. Defining reference: RFC-ietf-httpbis-rfc6265bis-22, Section 4.1.2.4.
Identifier (http)
Path
Registered value from the IANA HTTP registry.
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. persist is registered in HTTP Alt-Svc Parameter Registry. Defining reference: RFC7838, Section 3.1.
Identifier (http)
persist
Registered value from the IANA HTTP registry.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. private is registered in HTTP Cache Directive Registry. Defining reference: RFC9111, Section 5.2.2.7.
Identifier (http)
private
Registered value from the IANA HTTP registry.
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. PrivateToken is registered in HTTP Authentication Schemes. Defining reference: RFC9577, Section 2.
Identifier (http)
PrivateToken
Application protocol used for incoming request
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. proto is registered in HTTP Forwarded Parameters. Defining reference: rfc7239.
Identifier (http)
proto
The intermediary encountered an error regarding its configuration.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. proxy_configuration_error is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
proxy_configuration_error
The intermediary encountered an internal error unrelated to the origin.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. proxy_internal_error is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
proxy_internal_error
The intermediary generated the response itself without attempting to connect to the next hop.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. proxy_internal_response is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
proxy_internal_response
The intermediary tried to forward the request to itself, or a loop has been detected using different means (e.g.,).
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. proxy_loop_detected is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
proxy_loop_detected
Registered value from the IANA HTTP registry.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. proxy-revalidate is registered in HTTP Cache Directive Registry. Defining reference: RFC9111, Section 5.2.2.8.
Identifier (http)
proxy-revalidate
Registered value from the IANA HTTP registry.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. public is registered in HTTP Cache Directive Registry. Defining reference: RFC9111, Section 5.2.2.9.
Identifier (http)
public
The received-status parameter's value indicates the HTTP status code that the intermediary received from the next-hop server when obtaining this response.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. received-status is registered in HTTP Proxy-Status Parameters. Defining reference: rfc9209.
Identifier (http)
received-status
Related request indicator
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. req is registered in HTTP Signature Component Parameters. Defining reference: RFC 9421, Section 2.4.
Identifier (http)
req
Indicates that the client prefers that the server respond asynchronously to a request.
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. respond-async is registered in HTTP Preferences. Defining reference: rfc7240.
Identifier (http)
respond-async
RSASSA-PSS using SHA-512
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. The registry marks this value active; review compatibility before deploying it. rsa-pss-sha512 is active in HTTP Signature Algorithms. Defining reference: RFC 9421, Section 3.3.1.
Identifier (http)
rsa-pss-sha512
RSASSA-PKCS1-v1_5 using SHA-256
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. The registry marks this value active; review compatibility before deploying it. rsa-v1_5-sha256 is active in HTTP Signature Algorithms. Defining reference: RFC 9421, Section 3.3.2.
Identifier (http)
rsa-v1_5-sha256
Registered value from the IANA HTTP registry.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. s-maxage is registered in HTTP Cache Directive Registry. Defining reference: RFC9111, Section 5.2.2.10.
Identifier (http)
s-maxage
Indicates that safe (i.e., unobjectionable) content is preferred.
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. safe is registered in HTTP Preferences. Defining reference: rfc8674.
Identifier (http)
safe
Registered value from the IANA HTTP registry.
Cookie values control browser state, scope, lifetime, transport, and cross-site behavior. SameSite is registered in Cookie Attributes. Defining reference: RFC-ietf-httpbis-rfc6265bis-22, Section 4.1.2.7.
Identifier (http)
SameSite
Registered value from the IANA HTTP registry.
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. SCRAM-SHA-1 is registered in HTTP Authentication Schemes. Defining reference: rfc7804.
Identifier (http)
SCRAM-SHA-1
Registered value from the IANA HTTP registry.
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. SCRAM-SHA-256 is registered in HTTP Authentication Schemes. Defining reference: rfc7804.
Identifier (http)
SCRAM-SHA-256
Registered value from the IANA HTTP registry.
Cookie values control browser state, scope, lifetime, transport, and cross-site behavior. Secure is registered in Cookie Attributes. Defining reference: RFC-ietf-httpbis-rfc6265bis-22, Section 4.1.2.5.
Identifier (http)
Secure
Registered value from the IANA HTTP registry.
Problem-type values identify machine-readable API error semantics and migration guidance. See HTTP Status Code is registered in HTTP Problem Types. Defining reference: rfc9457.
Identifier (http)
See HTTP Status Code
Strict Structured Field serialization
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. sf is registered in HTTP Signature Component Parameters. Defining reference: RFC 9421, Section 2.1.1.
Identifier (http)
sf
The SHA-1 algorithm. It is vulnerable to collision attacks; seeand
Integrity registry values define algorithms or message metadata used to detect alteration of HTTP content or representations. The registry marks this value deprecated; review compatibility before deploying it. sha is deprecated in Hash Algorithms for HTTP Digest Fields. Defining reference: rfc3174.
Identifier (http)
sha
The SHA-1 algorithm. The output of this algorithm is encoded using the base64 encoding.
Integrity registry values define algorithms or message metadata used to detect alteration of HTTP content or representations. SHA is registered in HTTP Digest Algorithm Values. Defining reference: http://csrc.nist.gov/publications/PubsFIPS.html.
Identifier (http)
SHA
The SHA-256 algorithm.
Integrity registry values define algorithms or message metadata used to detect alteration of HTTP content or representations. The registry marks this value active; review compatibility before deploying it. sha-256 is active in Hash Algorithms for HTTP Digest Fields. Defining reference: rfc6234.
Identifier (http)
sha-256
The SHA-256 algorithm. The output of this algorithm is encoded using the base64 encoding.
Integrity registry values define algorithms or message metadata used to detect alteration of HTTP content or representations. SHA-256 is registered in HTTP Digest Algorithm Values. Defining reference: http://csrc.nist.gov/publications/PubsFIPS.html.
Identifier (http)
SHA-256
256
Integrity registry values define algorithms or message metadata used to detect alteration of HTTP content or representations. SHA-256 is registered in Hash Algorithms for HTTP Digest Authentication. Defining reference: rfc7616.
Identifier (http)
SHA-256
The SHA-512 algorithm.
Integrity registry values define algorithms or message metadata used to detect alteration of HTTP content or representations. The registry marks this value active; review compatibility before deploying it. sha-512 is active in Hash Algorithms for HTTP Digest Fields. Defining reference: rfc6234.
Identifier (http)
sha-512
The SHA-512 algorithm. The output of this algorithm is encoded using the base64 encoding.
Integrity registry values define algorithms or message metadata used to detect alteration of HTTP content or representations. SHA-512 is registered in HTTP Digest Algorithm Values. Defining reference: http://csrc.nist.gov/publications/PubsFIPS.html.
Identifier (http)
SHA-512
256
Integrity registry values define algorithms or message metadata used to detect alteration of HTTP content or representations. SHA-512-256 is registered in Hash Algorithms for HTTP Digest Authentication. Defining reference: rfc7616.
Identifier (http)
SHA-512-256
Registered value from the IANA HTTP registry.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. stale-if-error is registered in HTTP Cache Directive Registry. Defining reference: RFC5861, Section 4.
Identifier (http)
stale-if-error
Registered value from the IANA HTTP registry.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. stale-while-revalidate is registered in HTTP Cache Directive Registry. Defining reference: RFC5861, Section 3.
Identifier (http)
stale-while-revalidate
Indicates whether the cache stored the response (see, Section 3); a true value indicates that it did.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. stored is registered in HTTP Cache-Status. Defining reference: rfc9211.
Identifier (http)
stored
An application-specific tag for a signature
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. tag is registered in HTTP Signature Metadata Parameters. Defining reference: RFC 9421, Section 2.3.
Identifier (http)
tag
Transport Layer Security
Upgrade values negotiate an alternate protocol or capability at a defined HTTP boundary. TLS is registered in HTTP Upgrade Tokens. Defining reference: rfc2817.
Identifier (http)
TLS
The intermediary received a TLS alert from the next hop.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. tls_alert_received is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
tls_alert_received
The intermediary encountered an error when verifying the certificate presented by the next hop.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. tls_certificate_error is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
tls_certificate_error
The intermediary encountered a TLS error when communicating with the next hop, either during the handshake or afterwards.
Proxy and gateway values describe processing across trust boundaries where fields, authority, and framing may be transformed. tls_protocol_error is registered in HTTP Proxy Error Types. Defining reference: rfc9209.
Identifier (http)
tls_protocol_error
TLS certificate-based
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. tls-server-end-point is registered in HTTP Mutual Authentication Host Validation Methods. Defining reference: RFC8120, Section 7.
Identifier (http)
tls-server-end-point
TLS unique key-based
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. tls-unique is registered in HTTP Mutual Authentication Host Validation Methods. Defining reference: RFC8120, Section 7.
Identifier (http)
tls-unique
Trailer
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. tr is registered in HTTP Signature Component Parameters. Defining reference: RFC 9421, Section 2.1.4.
Identifier (http)
tr
(reserved)
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. trailers is registered in HTTP Transfer Coding Registry. Defining reference: rfc9112.
Identifier (http)
trailers
Indicates the response’s remaining freshness lifetime (see, Section 4.2.1) as calculated by the cache, as an integer number of seconds, measured as closely as possible to when the response header section is sent by the cache.
Caching values control freshness, reuse, validation, and visibility across browser, proxy, and CDN layers. ttl is registered in HTTP Cache-Status. Defining reference: rfc9211.
Identifier (http)
ttl
The urgency of an HTTP response.
Priority values are scheduling hints that do not change HTTP correctness. u is registered in HTTP Priority. Defining reference: RFC9218, Section 4.1.
Identifier (http)
u
UDP Proxying
MASQUE values support proxying datagrams or traffic through HTTP/3 and extended CONNECT. udp is registered in MASQUE URI Suffixes. Defining reference: rfc9298.
Identifier (http)
udp
The algorithm used by the UNIX "cksum" command.
Integrity registry values define algorithms or message metadata used to detect alteration of HTTP content or representations. The registry marks this value deprecated; review compatibility before deploying it. unixcksum is deprecated in Hash Algorithms for HTTP Digest Fields. Defining reference: rfc4648.
Identifier (http)
unixcksum
The algorithm computed by the UNIX ``cksum'' command, as defined by the Single UNIX Specification, Version 2. The output of this algorithm is an ASCII digit string representing the 32-bit CRC, which is the first word of the output of the UNIX ``cksum'' command.
Integrity registry values define algorithms or message metadata used to detect alteration of HTTP content or representations. UNIXcksum is registered in HTTP Digest Algorithm Values.
Identifier (http)
UNIXcksum
The algorithm used by the UNIX "sum" command.
Integrity registry values define algorithms or message metadata used to detect alteration of HTTP content or representations. The registry marks this value deprecated; review compatibility before deploying it. unixsum is deprecated in Hash Algorithms for HTTP Digest Fields. Defining reference: rfc4648.
Identifier (http)
unixsum
The algorithm computed by the UNIX ``sum'' command, as defined by the Single UNIX Specification, Version 2. The output of this algorithm is an ASCII decimal-digit string representing the 16-bit checksum, which is the first word of the output of the UNIX ``sum'' command.
Integrity registry values define algorithms or message metadata used to detect alteration of HTTP content or representations. UNIXsum is registered in HTTP Digest Algorithm Values.
Identifier (http)
UNIXsum
Registered value from the IANA HTTP registry.
Problem-type values identify machine-readable API error semantics and migration guidance. Unsupported Hashing Algorithms is registered in HTTP Problem Types. Defining reference: RFC-ietf-httpapi-digest-fields-problem-types-06, Section 3.1.
Identifier (http)
Unsupported Hashing Algorithms
Registered value from the IANA HTTP registry.
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. username is registered in HTTP Authentication Control Parameters. Defining reference: RFC8053, Section 4.7.
Identifier (http)
username
Registered value from the IANA HTTP registry.
Authentication registry values define how a client proves identity or possession of credentials to an origin or proxy. vapid is registered in HTTP Authentication Schemes. Defining reference: RFC 8292, Section 3.
Identifier (http)
vapid
Indicates an upper bound to the length of time the client expects it will take the server to process the request once it has been received.
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. wait is registered in HTTP Preferences. Defining reference: rfc7240.
Identifier (http)
wait
The Web Socket Protocol
Upgrade values negotiate an alternate protocol or capability at a defined HTTP boundary. websocket is registered in HTTP Upgrade Tokens. Defining reference: rfc6455.
Identifier (http)
websocket
The Web Socket Protocol
Upgrade values negotiate an alternate protocol or capability at a defined HTTP boundary. WebSocket is registered in HTTP Upgrade Tokens. Defining reference: rfc6455.
Identifier (http)
WebSocket
Deprecated (alias for compress)
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. x-compress is registered in HTTP Content Coding Registry. Defining reference: rfc9110.
Identifier (http)
x-compress
Deprecated (alias for compress)
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. x-compress is registered in HTTP Transfer Coding Registry. Defining reference: rfc9112.
Identifier (http)
x-compress
Deprecated (alias for gzip)
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. x-gzip is registered in HTTP Content Coding Registry. Defining reference: rfc9110.
Identifier (http)
x-gzip
Deprecated (alias for gzip)
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. x-gzip is registered in HTTP Transfer Coding Registry. Defining reference: rfc9112.
Identifier (http)
x-gzip
A stream of bytes compressed using the Zstandard protocol with a Window_Size of not more than 8 MB.
HTTP parameter values extend negotiation, framing, preferences, range handling, or other protocol components. zstd is registered in HTTP Content Coding Registry. Defining reference: rfc9659.
Identifier (http)
zstd