# web.headers

**stable** **2 credits**

HTTP status, response headers (cookie values redacted) and redirect chain of a URL.

`GET /v1/web/headers`

## What you get

One Web record in Onekey's unified shape, in `data`. If the record does not exist you get a `404 not_found` and are not charged.

**Also known as:** `/on_page/page` on APIs that nest their paths. See [Alternatives and equivalents](https://onekey.dev/docs/alternatives.md).

## What it costs

- **2 credits** for a fresh fetch, charged only when it succeeds.
- **Free when served from cache (0.2 credit for a cached response over 100 KB).**
- **Free** if the request is invalid (never charged) or the source fails or reports not found (refunded).

## Parameters

| Name | Type | Required | Default | What it is | Constraints |
| --- | --- | --- | --- | --- | --- |
| `url` | string | yes | (required) | Absolute http(s) URL of the page (ports 80/443 only; private/internal hosts are refused) | max 2048 chars; must match `https?://[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?(?::(?:80\|443))?(?:[/?][\x21-\x5b\x5d-\x7e]*)?`; trimmed |

## Request

```bash
curl "https://api.onekey.dev/v1/web/headers?url=https%3A%2F%2Fwww.python.org%2F" \
  -H "x-api-key: YOUR_API_KEY"
```

```python
import requests

res = requests.get(
    "https://api.onekey.dev/v1/web/headers",
    params={"url": "https://www.python.org/"},
    headers={"x-api-key": "YOUR_API_KEY"},
)
body = res.json()

if body["success"]:
    print(body["data"])
else:
    print(body["error"]["code"], body["error"]["message"])
```

```javascript
const params = new URLSearchParams({ url: "https://www.python.org/" });
const res = await fetch(`https://api.onekey.dev/v1/web/headers?${params}`, {
  headers: { "x-api-key": "YOUR_API_KEY" },
});
const body = await res.json();

if (body.success) console.log(body.data);
else console.error(body.error.code, body.error.message);
```

## Recorded response

A real Web response, recorded and returned in Onekey's shape. Fields the platform does not provide are `null`.

```json
{
  "success": true,
  "data": {
    "content": {
      "url": "https://www.python.org/"
    },
    "ext": {
      "httpStatus": 200,
      "https": true,
      "redirectCount": 0,
      "headers": {
        "connection": "keep-alive",
        "content-length": "52588",
        "server": "nginx",
        "via": "1.1 varnish, 1.1 varnish, 1.1 varnish",
        "x-frame-options": "SAMEORIGIN",
        "content-security-policy-report-only": "object-src 'none'; form-action 'self'; style-src 'self' 'unsafe-inline' https://ajax.googleapis.com; base-uri 'self'; default-src 'self'; script-src 'self' 'nonce-ji8kEvh74xHsJpBawxmIgQ==' https://analytics.python.org https://media.ethicalads.io https://ajax.googleapis.com; font-src 'self' data:; img-src 'self' data: https://media.ethicalads.io; frame-ancestors 'self'; connect-src 'self' https://console.python.org https://analytics.python.org https://server.ethicalads.io https://2p66nmmycsj3.statuspage.io; report-uri https://o20004.ingest.us.sentry.io/api/39935/security/?sentry_key=95f826ce8a6d47e9ab5dbb055c24eb74",
        "content-type": "text/html; charset=utf-8",
        "accept-ranges": "bytes",
        "date": "Mon, 28 Sep 2026 20:12:15 GMT",
        "age": "1038",
        "x-served-by": "cache-iad-kcgs7200050-IAD, cache-iad-kcgs7200050-IAD, cache-iad-kcgs7270046-IAD, cache-bom-vanm7210082-BOM",
        "x-cache": "MISS, HIT, HIT",
        "x-cache-hits": "0, 133, 17",
        "x-timer": "S1790626335.092565,VS0,VE0",
        "vary": "Cookie",
        "strict-transport-security": "max-age=63072000; includeSubDomains; preload"
      },
      "contentType": "text/html; charset=utf-8",
      "contentLength": 52588,
      "server": "nginx",
      "poweredBy": null,
      "cacheControl": null,
      "lastModified": null,
      "etag": null,
      "contentEncoding": null,
      "chain": [
        {
          "url": "https://www.python.org/",
          "status": 200,
          "location": null
        }
      ]
    }
  },
  "metadata": {
    "platform": "web",
    "endpoint": "headers",
    "cached": false,
    "stale": false,
    "age_s": 0,
    "fetched_at": "2026-01-01T12:00:00+00:00",
    "credits_charged": 2,
    "request_id": "7f3a9c2e5b1d4c8fa2e6d0b9c4f18e37"
  },
  "error": null
}
```

## Field mapping

How this endpoint's source fields become Onekey's [unified schema](https://onekey.dev/docs/schema.md). Fields the source lacks come back as `null`.

| Source path | Onekey field | Transform |
| --- | --- | --- |
| `finalUrl` | `content.url` | `safeUrl` |
| `status` | `ext.httpStatus` | `toNumber` |
| `https` | `ext.https` | `toBoolean` |
| `redirectCount` | `ext.redirectCount` | `toNumber` |
| `headers` | `ext.headers` | - |
| `contentType` | `ext.contentType` | - |
| `contentLength` | `ext.contentLength` | `toNumber` |
| `server` | `ext.server` | - |
| `poweredBy` | `ext.poweredBy` | - |
| `cacheControl` | `ext.cacheControl` | - |
| `lastModified` | `ext.lastModified` | - |
| `etag` | `ext.etag` | - |
| `contentEncoding` | `ext.contentEncoding` | - |
| `chain` | `ext.chain` | - |

## Caching and freshness

- Fresh for about 10 minutes. Repeat calls in that window are served from cache and are free.
- Between 10 minutes and 1 hour the cached copy is still served instantly and marked `stale: true` while Onekey refreshes it in the background.
- If the source is down when a refresh is needed, the last copy can be served for up to 1 hour more (marked stale).
- A "not found" is remembered for 2 minutes and is free.
- The cache is shared across all customers, which is what keeps repeat calls cheap.

## What can go wrong

| Status | Code | What to do |
| --- | --- | --- |
| 401 | `unauthorized` | Check the `x-api-key` header. |
| 402 | `insufficient_credits` | [Add credits](https://onekey.dev/pricing); your balance must cover the price. |
| 404 | `not_found` | That record does not exist. Free; do not retry. |
| 422 | `invalid_params` | Fix the parameters using the table above. Free. |
| 429 | `rate_limited` | Wait `Retry-After` seconds, then retry. |
| 502 | `upstream_error` | The source failed. Refunded; retry with backoff. |

See [Errors](https://onekey.dev/docs/errors.md) for the full list and retry guidance.

Status: stable (verified against the live source).