Headers

Every API request requires the following headers:

Header	Required	Description
`Authorization`	Yes	Bearer token for authentication.
`Accept`	Yes	Specifies the response format. Use `application/vnd.taffrail.json+html` for the Advice endpoint or `application/json` for other endpoints. See Advice Content Types.
`Taffrail-Version`	No	API version. Accepted values: `1` or `2`. Defaults to `2`.

Example Request Headers

Authorization: Bearer <API_KEY>
Accept: application/vnd.taffrail.json+html
Taffrail-Version: 2

Analytics Headers (Optional)

Requests made directly from an end user's browser need none of these — the request itself already carries the user's context. When your backend calls the Advice API on a user's behalf, that context is lost: the connection comes from your server, so analytics would attribute every request to your datacenter. Forward it with these headers:

Header	Required	Description
`Taffrail-SID`	No	Opaque session identifier for the end user. Reuse the same value across a visitor's requests so they correlate into one session.
`Taffrail-Client-IP`	No	The end user's IPv4 or IPv6 address. Values that don't parse as a real IP address are ignored.
`Taffrail-Api-Referrer`	No	URL of the page that originated the request. Takes precedence over the standard `Referer` header.

These headers feed usage analytics only — they are never used for authorization or advice evaluation, and omitting them changes nothing about the response.

Authorization: Bearer <API_KEY>
Accept: application/vnd.taffrail.json+html
Taffrail-Version: 2
Taffrail-SID: 8f4a2c1e-session-0042
Taffrail-Client-IP: 76.19.84.205
Taffrail-Api-Referrer: https://www.example-bank.com/planning/retirement

Response Headers

The API returns the following headers with every response:

Header	Description
`X-API-Version`	The API version used to process the request.
`X-Request-Id`	A unique identifier for the request, useful for debugging and support inquiries.
`X-Response-Date`	The UTC timestamp when the response was generated.