Headers

Headers are defined per Serverless HTTP event. The tables below describe the common contract; service-specific additions are documented in the owning OpenAPI operation.

Request

Header	Required	Purpose
`X-Api-Key`	`private: true` methods	API Gateway API key; primary auth path
`Content-Type`	JSON request bodies	Usually `application/json`
`Authorization`	SigV4/IAM callers only	Allowed by CORS, not the normal drive-apig auth path
`X-Amz-Date`, `X-Amz-Security-Token`, `X-Amz-User-Agent`	SigV4/IAM callers only	AWS signing artifacts
`mode`	service-specific	Used by selected geo and marketplace endpoints
`sentry-trace`	optional	Sentry trace propagation on routes that allow it
`traceparent`, `baggage`	optional	OpenTelemetry propagation when clients send it

Common CORS allow-list:

Content-Type, Authorization, X-Api-Key, X-Amz-Date,
X-Amz-Security-Token, X-Amz-User-Agent

Some endpoints add headers such as mode or sentry-trace. Check services/<service>/serverless.yml before changing browser-facing requests.

Response

Header	Purpose
`Access-Control-Allow-Origin`	Usually `*` from Serverless CORS config
`Access-Control-Allow-Credentials`	Often `true` on handlers that return explicit CORS headers
`Access-Control-Allow-Headers`	Mirrors the method CORS allow-list
`Access-Control-Max-Age`	Long-lived preflight cache on selected endpoints
`Cache-Control`	Service-specific cache policy
`Vary`	Cache variation, commonly `Accept-Encoding, Origin`
`ETag`	Conditional requests on selected cacheable routes
`Expires`	HTTP date on selected cacheable routes
`x-ratelimit-limit`, `x-ratelimit-remaining`, `x-ratelimit-reset`, `x-ratelimit-resource`	Leads in-handler token bucket failures

CORS

API Gateway generates preflight OPTIONS from each method's cors config. The OpenAPI specs intentionally do not list synthetic OPTIONS operations.