HTTP Headers for API Testing: Content-Type, Accept, Caching and ETag

Headers are the small key-value lines that travel with every request and response. They decide whether the server reads your body as JSON, who you are, which format comes back, whether a response may be cached, and whether two people editing the same record overwrite each other. Many testers ignore headers and miss whole categories of bugs. In this lesson you will learn the headers that matter for API testing, with real-life examples and live calls.

What Are HTTP Headers? (The Parcel Label Example)

Headers are written as Name: value, one per line. Names are case-insensitive: content-type and Content-Type are the same header (Playwright returns all names in lower case).

Request Headers Every Tester Should Know

Response Headers Every Tester Should Check

See them live. Press Send and look at link and x-total-count in the output:

curl -i \
  "https://sqatools.in/wp-json/sqa-api/v1/users?per_page=2"

Content Negotiation: Content-Type vs Accept

These two are confused all the time:

• Content-Type describes the body being sent (in a request: what you send; in a response: what the server sends).
• Accept is a request header saying what format you would like back.

curl -i \
  -H "Accept: text/csv" \
  "https://sqatools.in/wp-json/sqa-api/v1/users/1"

The practice API answers 406 because it can return only JSON or XML. Change Accept to application/xml and you get XML.

Caching Headers: Cache-Control, ETag and 304

Caching saves bandwidth and makes apps fast. A product image or a catalogue page that hasn’t changed doesn’t need to be downloaded again.

Cache-Control

• max-age=3600: the response can be reused for 1 hour.
• no-cache: may be stored, but must be revalidated with the server before use.
• no-store: never store it. Required for sensitive data such as bank balances, OTPs and personal details.
• private vs public: whether shared caches (CDN, proxies) may store it.

ETag and conditional requests

An ETag is a fingerprint of the current version of a resource. The client stores it and next time asks: “send it only if it changed” using If-None-Match.

1. GET /products/101 → 200, ETag: "c2aee9e25c4daa9445361e1bb4a749f7".
2. GET /products/101 with If-None-Match: "c2aee9e25c4daa9445361e1bb4a749f7" → 304 Not Modified, empty body.

curl -i \
  -H "If-None-Match: \"c2aee9e25c4daa9445361e1bb4a749f7\"" \
  "https://sqatools.in/wp-json/sqa-api/v1/products/101"

If the browser shows 200 instead of 304 here, the product data has changed since this lesson was written; copy the new ETag from a normal GET and try again.

Optimistic Locking with If-Match (Prevent Lost Updates)

# 1. Create an object, note ETag "v1"
curl -i -X PUT "https://sqatools.in/wp-json/sqa-api/v1/objects/ticket-500" \
  -H "Content-Type: application/json" -d '{"name":"Ticket 500","data":{"priority":"low"}}'

# 2. Update with the current version: 200, ETag becomes "v2"
curl -i -X PATCH ".../objects/ticket-500" -H "If-Match: \"v1\"" \
  -H "Content-Type: application/json" -d '{"data":{"priority":"high"}}'

# 3. Update again with the OLD version: 412 Precondition Failed
curl -i -X PATCH ".../objects/ticket-500" -H "If-Match: \"v1\"" \
  -H "Content-Type: application/json" -d '{"data":{"status":"closed"}}'

The practice API’s 412 message: If-Match “v1” does not match the current version “v2”. Someone changed the object; GET it again.

Security Headers to Verify

CORS is covered in detail in HTTPS, Cookies and CORS.

Testing Headers with Playwright

import { test, expect } from '@playwright/test';

const BASE = 'https://sqatools.in/wp-json/sqa-api/v1';

test('JSON content type and no caching of user data', async ({ request }) => {
  const res = await request.get(`${BASE}/users/1`);
  const h = res.headers();                       // all names are lower case
  expect(h['content-type']).toContain('application/json');
  expect(h['cache-control']).toContain('no-store');
  expect(h['x-content-type-options']).toBe('nosniff');
});

test('ETag + If-None-Match gives 304', async ({ request }) => {
  const first = await request.get(`${BASE}/products/101`);
  const etag = first.headers()['etag'];
  expect(etag).toBeTruthy();

  const second = await request.get(`${BASE}/products/101`, {
    headers: { 'If-None-Match': etag },
  });
  expect(second.status()).toBe(304);
  expect((await second.body()).length).toBe(0);
});

test('stale If-Match is rejected with 412', async ({ request }) => {
  const url = `${BASE}/objects/lock-${Date.now()}`;
  await request.put(url, { data: { name: 'Ticket', data: { priority: 'low' }, ttl: 60 } });  // v1
  await request.patch(url, { data: { data: { priority: 'high' } }, headers: { 'If-Match': '"v1"' } }); // v2
  const stale = await request.patch(url, { data: { data: { status: 'closed' } }, headers: { 'If-Match': '"v1"' } });
  expect(stale.status()).toBe(412);
});

test('pagination headers', async ({ request }) => {
  const res = await request.get(`${BASE}/users?per_page=5`);
  expect(res.headers()['x-total-count']).toBe('12');
  expect(res.headers()['link']).toContain('rel="next"');
});

Header Testing Checklist

• Correct Content-Type on every response, including errors.
• Missing/wrong Content-Type on requests gives 415, not 500.
• Unsupported Accept gives 406.
• Location on 201; Allow on 405; WWW-Authenticate on 401; Retry-After on 429/503.
• Personal data is never publicly cacheable.
• ETag changes when the resource changes; 304 when it doesn’t; 412 on stale If-Match.
• No version-revealing headers; security headers present.
• Header names treated case-insensitively.

Interview Questions: HTTP Headers