Security Headers - Law4Devs

Every response from the Law4Devs API includes a set of security headers designed to protect both the API and its consumers. These headers are set automatically — no configuration required on your end.

Response Headers

Header	Value	Purpose
`X-Content-Type-Options`	`nosniff`	Prevents MIME-type sniffing attacks in browsers
`X-Frame-Options`	`DENY`	Prevents the API response from being embedded in iframes
`X-XSS-Protection`	`1; mode=block`	Legacy XSS filter for older browsers
`Referrer-Policy`	`strict-origin-when-cross-origin`	Controls how much referrer information is included
`X-API-Version`	`1.0`	Signals the current API version on every response
`X-Request-ID`	UUID (per-request)	Unique identifier for each request — use this when reporting issues

The Server header is stripped from all responses to avoid fingerprinting the underlying infrastructure.

Using `X-Request-ID`

Every response carries a unique X-Request-ID header. Log this value alongside your application errors — it lets the Law4Devs team trace a specific request end-to-end when you report an issue.

curl -v -H "X-API-Key: YOUR_API_KEY" \
  https://api.law4devs.eu/v1/frameworks 2>&1 | grep X-Request-ID

# < X-Request-ID: 4f2a1c8e-9b3d-47e2-a1f0-8c5d6e7b9a2c

Using `X-API-Version`

The X-API-Version header is included in every response so your application can detect version changes without parsing the URL.

import requests

response = requests.get(
    "https://api.law4devs.eu/v1/frameworks",
    headers={"X-API-Key": "YOUR_API_KEY"},
)
api_version = response.headers.get("X-API-Version")
print(f"API version: {api_version}")  # API version: 1.0