#headers

Build correct CORS response headers and evaluate preflight requests — without re-reading the spec every time. The headers endpoint turns a simple policy (allowed origins, methods, request headers, whether credentials are allowed, a preflight max-age and any exposed response headers) into the exact set of Access-Control-* headers to return, and it handles the parts people get wrong: you cannot combine a wildcard origin with credentials, so it reflects the specific request origin and adds Vary: Origin instead; it omits the allow-origin header when an origin is not on your list; and it warns when a configuration would not behave as expected. The check endpoint takes an incoming request — its Origin, the (requested) method and the Access-Control-Request-Headers — and tells you whether it would pass CORS, the precise reason if it fails, and the response headers you should send back. Everything is computed locally and deterministically, so it is instant and private. Ideal for API gateways and backends, edge and serverless functions, debugging browser CORS errors, and getting a security policy exactly right. Pure local computation — no key, no third-party service, instant. Live, nothing stored. 3 endpoints. This builds and checks the headers; it does not make a cross-origin request — to inspect a live site's security headers use a security-headers API.

api.oanor.com/cors-api

Parse and build HTTP Content-Disposition headers (RFC 6266, with RFC 5987 filename* encoding). The parse endpoint reads a header into its disposition type (attachment, inline or form-data), its filename — correctly decoding the extended filename*=UTF-8''… form and preferring it over a plain filename exactly as the specification requires — the form-data field name, and any remaining parameters. The build endpoint assembles a correct header from simple fields and, when a filename contains non-ASCII characters (accents, emoji, CJK), automatically emits both an ASCII fallback filename and the percent-encoded filename*, so every browser shows the right download name while older clients still work. Everything is computed locally and deterministically, so it is instant and private — no file is ever fetched or stored. Ideal for file-download and upload endpoints, object storage and CDNs, content gateways and proxies, email and multipart handling, and debugging why a download is mis-named. Pure local computation — no key, no third-party service, instant. Live, nothing stored. 3 endpoints. This builds and parses the header string itself; it does not serve a file.

api.oanor.com/contentdisposition-api

Parse and build HTTP Cache-Control headers (RFC 9111). The parse endpoint turns a Cache-Control header into structured, named directives — public and private, no-store, no-cache, no-transform, max-age and s-maxage, must-revalidate and proxy-revalidate, immutable, stale-while-revalidate, stale-if-error, min-fresh and max-stale — together with a quick summary: whether the response is cacheable, whether it must be revalidated before use, its visibility (public or private) and its max-age in seconds. The build endpoint assembles a correct, canonically-ordered header from simple boolean and numeric fields, validating that the second-based directives are non-negative integers and quoting field-list forms of no-cache and private. Everything is computed locally and deterministically, so it is instant and private. Ideal for CDN and edge configuration, caching proxies and reverse proxies, API responses and static-asset tuning, and debugging why a response is (or is not) being cached. Pure local computation — no key, no third-party service, instant. Live, nothing stored. 3 endpoints. This builds and parses the header string itself; it does not fetch a URL.

api.oanor.com/cachecontrol-api

Parse and build RFC 8288 HTTP Link headers (Web Linking). The parse endpoint turns a Link header into a structured list — each link with its URI, its rel relation(s) and any target attributes (title, type, hreflang, media, anchor) — and also returns a handy rel→uri map, so you can grab the next, prev, first and last URLs for API pagination in a single step. It correctly handles the awkward parts: multiple comma-separated links, commas inside angle-bracketed URIs, quoted parameter values, multiple space-separated rel tokens, and RFC 8187 extended values. The build endpoint assembles a correct Link header from one or more link objects (or a single uri + rel with optional attributes), quoting values only where required. Everything is computed locally and deterministically, so it is instant and private. Ideal for paginated REST APIs and clients, hypermedia and HATEOAS, HTTP preload/prefetch hints, feed and alternate-format discovery, proxies and gateways. Pure local computation — no key, no third-party service, instant. Live, nothing stored. 3 endpoints. This builds and parses the Link header string itself; it does not fetch a URL.

api.oanor.com/linkheader-api

HTTP content negotiation as an API. The parse endpoint reads an Accept, Accept-Language, Accept-Encoding or Accept-Charset header — with quality (q) values and parameters — into a clean list ranked by the client's preference. The negotiate endpoint takes that header plus the list of values your server can actually serve and returns the single best match, along with the full ranked result and the entry that matched each candidate. It applies the correct rules for each kind: media-type type and subtype wildcards (text/*, */*), RFC 4647 language-range matching (a request for en matches your en-US, and en-US falls back to en), and exact matching with a * wildcard for encodings and charsets — and a q=0 entry correctly rejects a value. Everything runs locally and deterministically, so it is instant and private. Ideal for i18n middleware and locale selection, API versioning by media type, response-format and compression selection, CDNs, proxies and edge functions. Pure local computation — no key, no third-party service, instant. Live, nothing stored. 3 endpoints. This negotiates HTTP headers; to validate or decompose a single BCP-47 language tag use a BCP-47 API.

api.oanor.com/negotiate-api

Parse and build HTTP cookies. The parse endpoint reads a Set-Cookie header into its name, value and structured attributes — Domain, Path, Expires, Max-Age, Secure, HttpOnly, SameSite, Priority and Partitioned — or, with mode=cookie, splits a request Cookie header like "a=1; b=2; c=3" into an ordered list and a name→value map. The serialize endpoint builds a correct Set-Cookie string from simple fields, with sensible defaults (Path=/), proper date formatting for Expires, optional URL-encoding of the value, and validation of the cookie name, the date and the enum attributes — and it automatically adds Secure when SameSite=None, as browsers require. Everything is computed locally and deterministically, so it is instant and private. Ideal for web frameworks and middleware, API debugging and proxies, session and consent tooling, testing and security review. Pure local computation — no key, no third-party service, instant. Live, nothing stored. 3 endpoints. This parses and builds cookie strings; it does not fetch a URL — to inspect a live site's response headers use a security-headers or HTTP API.

api.oanor.com/cookie-api

A clean, programmatic reference for HTTP semantics, built on the official IANA registries. Look up any status code with its reason phrase and class (404 → Not Found, Client Error; 503 → Service Unavailable, Server Error), list a whole class (4xx, 5xx…); look up any method with its safe/idempotent flags (GET → safe + idempotent, POST → neither, DELETE → idempotent); or look up / search the 255 registered HTTP header fields (Content-Type, Authorization, …) with their registration status. Ideal for API tooling, HTTP clients, documentation, linters, learning resources and error pages.

api.oanor.com/http-api