HTTP headers supported by Cortex

Request Headers

Authentication

Cortex supports the following standard HTTP request headers for authenticating a user:

Authorization

Sets the access token, which was created by the reference OAuth2 implementation.

Accept

Specifies the Cortex response format used. The options are:

• application/json: The responses are returned in the plain JSON format
• application/hal+json: The responses are returned in the HAL (Hypertext Application Language) format

Accept-Language

Sets the client’s language and preferred locale variant.

Custom Headers

Cortex supports setting these custom HTTP request headers:

X-Ep-Data-Policy-Segments

Specifies the data policy segments relevant to the current customer. You can specify more than one data policy segment by separating the segments using a comma. You can view the data policies associated with a data segment by entering the data policy segment name in the X-Ep-Data-Policy-Segments header.

X-Ep-User-Id

Sets the identifier of the shopper. This can be used when integrating with an alternate authentication provider in a trusted environment.

X-Ep-User-Roles

Sets the roles of the shopper. This can be used when integrating with an alternate authentication provider in a trusted environment. Multiple roles should be separated by commas.

X-Ep-User-Scopes

Sets the scopes that the shopper can access. This can be used when integrating with an alternate authentication provider in a trusted environment. Multiple scopes should be separated by commas.

X-Ep-User-Traits

Sets the shopper’s traits (including language and currency) which are used to personalize the responses returned to client.

X-Forwarded-Base

Sets the alternate base URL for the links returned in a response. This rewrites the links base URL, which is useful when Cortex is deployed behind a proxy server.

Response Headers

Cortex supports setting these standard HTTP response headers:

Cache-Control

Sets the response’s cacheability.

When a resource’s max-age is not set, Cortex sets the following cache control header:no-cache.

When a resource’s max-age is greater than 0, the cache-control max-age property is set to match. For instance, if a resource’s max-age is set to 600, then Cortex sets the following cache control header: private, no-transform, max-age=600

Content-Type

Sets the response’s media-type.

Location

Sets the reference location of a newly created resource.

WWW-Authenticate

Set by the reference OAuth2 implementation when an acceptable Authorization header has not been set.