HTTP Headers

Name: HTTP Headers
Creator: staticdata.dev
License: https://opensource.org/licenses/MIT

The HTTP header fields you actually encounter building and debugging web services — content negotiation, caching, CORS, cookies, authentication, and the modern security headers. Each entry notes whether it travels on the request, the response, or both, gives a realistic example, and cites the RFC or web standard that defines it.

v1.0.0 MIT 86 records Updated 2026-10-05 stable Source: RFC 9110 (HTTP Semantics), IANA HTTP Field Name Registry, MDN HTTP Headers Reference

Quick fetch

Stable URL. CORS-enabled. No auth.

bash

curl https://staticdata.dev/v1/http-headers.json

Or use as a typed import: import { httpHeaders } from "https://staticdata.dev/v1/http-headers.ts"

Formats

JSON 22.8 KB

/v1/http-headers.json

Open

min: 19.3 KB · /v1/http-headers.min.json
CSV 12.9 KB

/v1/http-headers.csv

Open
TypeScript 23.0 KB

/v1/http-headers.ts

export const httpHeaders

type HttpHeader = (typeof httpHeaders)[number]

Open

Schema

Each record in the dataset has the following shape.

Schema
Field	Type	Description	Example
name	string	Canonical header field name	Cache-Control
direction	string	request, response, or both	both
description	string	What the header does	Directives for caching mechanisms in both requests and responses.
example	string	A representative header line	Cache-Control: public, max-age=3600, immutable
standard	string	Defining specification	RFC 9111
deprecated	boolean	Whether the header is deprecated	false

Preview

First 10 records.

Data preview
name	direction	description	example	standard	deprecated
Accept	request	Media types the client can understand, used in content negotiation.	Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8	RFC 9110	false
Accept-CH	response	Lists the client hint headers a server is willing to receive in subsequent requests.	Accept-CH: Sec-CH-UA, Sec-CH-UA-Mobile	RFC 8942	false
Accept-Charset	request	Character sets the client accepts. Deprecated; servers should ignore it and use UTF-8.	Accept-Charset: utf-8	RFC 9110	true
Accept-Encoding	request	Content encodings (compression algorithms) the client supports.	Accept-Encoding: gzip, deflate, br	RFC 9110	false
Accept-Language	request	Natural languages the client prefers, used in content negotiation.	Accept-Language: en-US,en;q=0.9	RFC 9110	false
Accept-Patch	response	Media types accepted by the server in a PATCH request.	Accept-Patch: application/json-patch+json	RFC 5789	false
Accept-Ranges	response	Indicates whether the server supports range requests for the resource.	Accept-Ranges: bytes	RFC 9110	false
Access-Control-Allow-Credentials	response	Tells the browser whether to expose the response when the request's credentials mode is include.	Access-Control-Allow-Credentials: true	WHATWG Fetch	false
Access-Control-Allow-Headers	response	Headers allowed in the actual request, returned in response to a CORS preflight.	Access-Control-Allow-Headers: Content-Type, Authorization	WHATWG Fetch	false
Access-Control-Allow-Methods	response	Methods allowed when accessing the resource, returned in response to a CORS preflight.	Access-Control-Allow-Methods: GET, POST, PUT, DELETE	WHATWG Fetch	false

Showing 10 of 86. View full data: JSON · CSV

Fetch examples

Drop-in snippets in five languages.

curl

curl -sSL https://staticdata.dev/v1/http-headers.json | jq '.[0]'

JavaScript

import type { HttpHeader } from "https://staticdata.dev/v1/http-headers.ts";

const res = await fetch("https://staticdata.dev/v1/http-headers.min.json");
if (!res.ok) throw new Error(`Fetch failed: ${res.status}`);
const httpHeaders: HttpHeader[] = await res.json();
console.log(httpHeaders[0]);

Python

import urllib.request, json

with urllib.request.urlopen("https://staticdata.dev/v1/http-headers.min.json") as r:
    httpHeaders = json.load(r)

print(httpHeaders[0])

package main

import (
	"encoding/json"
	"fmt"
	"net/http"
)

func main() {
	resp, err := http.Get("https://staticdata.dev/v1/http-headers.min.json")
	if err != nil { panic(err) }
	defer resp.Body.Close()

	var data []map[string]any
	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
		panic(err)
	}
	fmt.Println(data[0])
}

Rust

use serde_json::Value;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let body = ureq::get("https://staticdata.dev/v1/http-headers.min.json").call()?.into_string()?;
    let data: Vec<Value> = serde_json::from_str(&body)?;
    println!("{:?}", data.first());
    Ok(())
}

Sources and methodology

This is a curated set of the HTTP header fields developers meet in day-to-day work, not an exhaustive dump of the registry. Field names are verified against the IANA HTTP Field Name Registry (all except the unregistered X-Forwarded-*, X-XSS-Protection and Upgrade-Insecure-Requests), and the standard column cites the specification that currently defines each field — RFC 9110/9111/9112 for the core HTTP semantics, caching, and message syntax, and the relevant WHATWG/W3C standard for headers defined outside the RFCs (CORS, CSP, Permissions-Policy, Fetch Metadata, and similar).

direction is opinionated and reflects normal usage: request for headers a client sends, response for headers a server returns, and both for headers that legitimately appear in either direction (such as Content-Type, Cache-Control, and Date). A handful of headers are physically capable of appearing in the other direction in unusual setups; the value records the common case.

deprecated marks fields the standards discourage for new work — Accept-Charset, Pragma, and X-XSS-Protection among them. The widely deployed X-Forwarded-* headers are labelled Non-standard in the standard column: they are de facto conventions standardized as the single Forwarded header (RFC 7239), but kept here because real infrastructure still emits them. The example values are illustrative; tokens are truncated where a full value would be long or sensitive.

Versioning

URLs under /v1/ are stable: field names and types will not change in a way that breaks consumers. Values can be corrected or records added when the upstream source changes; schema-incompatible updates ship under a new version path. See the http-headers changelog for this dataset's history.