HTTP
Request Headers API
/headersInspect a safe subset of the headers in your request.
No signup or API key required.
Parameters
No endpoint-specific parameters. Only the optional format=json parameter is accepted.
formatenumoptional · query- Only json is supported. format=text returns HTTP 400.
json
No request body. Unknown or repeated query parameters return HTTP 400.
Returns 200 OK
A JSON object with the following fields.
headersobject<string, string>- Safe request headers only: accept, accept-encoding, accept-language, content-type, user-agent. Missing headers are omitted; each value is capped at 1024 characters.
This endpoint supports JSON only.
Errors
Validation and service errors always return JSON.
errorstring- A machine-readable error code, such as invalid_parameter or rate_limited.
messagestring- A description of the problem.
400 Invalid parameters.
414 Query string exceeds 2048 characters.
429 Rate limit reached. Wait the seconds in Retry-After before retrying.
Usage notes
JSON only. Allowlist: accept, accept-encoding, accept-language, content-type, user-agent. Values capped at 1024 characters. Credentials, cookies, IP and Cloudflare internal headers excluded.
Debug Accept or User-Agent values in a client. The response intentionally excludes credentials, cookies, and internal forwarding headers.
Responses are not cached. Browser requests are supported through open CORS.
120 requests per minute per IP, with up to 30 per 10 seconds, shared across APIs. Limits are approximate per Cloudflare location. Full usage limits ↗