> ## Documentation Index
> Fetch the complete documentation index at: https://docs.m1amdocs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# HTTP Headers

Storefront Gateway APIs consume and produce a variety of standard and Storefront Gateway-specific headers.

## Standard REST Headers

**Authorization**

The **Authorization** header is required for all Storefront Gateway API requests. A valid JSON Web Token (JWT) access token of the **Bearer** type must be included in the **Authorization** header.

```
Authorization: Bearer <token>
```

```
**Example**
GET /account/1 HTTP/1.1
Host: ulm.uxpsystemsdemo.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```

If the token is invalid or expired, a 401 Unauthorized error is typically returned.

For information about how to get an access token, see:

**Content-Type**

Specifies both the media type (of the content of the request body) that the client sends to Storefront Gateway, as well as the media type (of the content of the response body) that Storefront Gateway returns to the client. Requests sent to Storefront Gateway must be in a proper JSON format, and thus the header must use `application/json`.

```
**Example**
Content-Type: application/json
```

This header is required. The request returns an error if no `Content-Type` is supplied.

**Accept**

Specifies the media type(s) that the client is capable of accepting in the body of a response. Clients must support accepting the `application/json` media type, as it is the only format in which Storefront Gateway exchanges data.

```
**Example**
Accept: application/json
```

This header is not mandatory for clients to provide (Storefront Gateway will assume `application/json` without it), but clients are encouraged to include it.

**Note:** The list of all standard REST headers is available here: [https://tools.ietf.org/html/rfc7231#section-5](https://tools.ietf.org/html/rfc7231#section-5)

## Storefront Gateway-Specific Headers

**X-B3-TraceId**

Returned by Storefront Gateway on every request. The header value contains a uniquely generated string to identify the request for logging and tracing purposes.

```
**Example**
X-B3-TraceId: dd950f07f143ebcb
```

Clients may optionally provide this header with their own requests, set to a value of their own choosing (or generation). Storefront Gateway will use this client-supplied value instead of generating one. This may be desirable in machine-to-machine integrations with Storefront Gateway, where tracing requests (and subsequent responses) across multiple different services requires consistent trace IDs across all components. See Request Tracing for more details.

**X-Tenant-ID**

Returned by Storefront Gateway on every request. This header identifies the Storefront Gateway tenant this API is serving. Clients typically do not need to concern themselves with this header.

```
**Example**
X-Tenant-ID: maple
```

**X-Correlation-Process-ID**

Returned by Storefront Gateway on every request involving a Storefront Gateway Process. This header provides unique identifier for the current instance of the Process. The value matches the `processId` returned in the response body.

```
X-Correlation-Process-ID: c4ca8b77-898b-4ee0-a74a-e4f5947b9162
```

**X-Total-Count**

This header identifies the total count of available results for a request when the response returns multiple results. The header is used to support Pagination parameters.

```
**Example**
GET /runtime/{runtimeId}/features 
Header: X-Total-Count = 12
```

## Cookie Headers

The following headers are sent in a REST response to be stored by the client.

**JSESSIONID**

Assigned when a user authenticates into Storefront Gateway and the system opens a user session on the server. Used by all non-anonymous endpoints.

**JRUNTIMEID**

Runtime cookie for tracking the runtime device from which a user is accessing a service (by signing in to Storefront Gateway).

**mint-sso-token (Remember Me cookie)**

Assigned to a user when they log in to Storefront Gateway. Acts like a remember me cookie for auto-login.

* **[API Request Tracing](c_requestTracing)**

* **[Tracking User Runtimes](c_trackingRuntimes)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.