Headers - Nito

Request

Header	Notes
`Authorization`	Required for authenticated routes. Public model discovery needs no key. `Bearer <z_sk_ key>`. See Authentication.
`Content-Type`	`application/json`; `multipart/form-data` for chat requests that upload image files.
`X-Org-ID`	Optional with an API key. On authenticated routes, must be the UUID of the key’s organization. Public model discovery ignores this header.
`X-Request-ID`	Caller-supplied trace ID, sanitized to 128 characters, echoed back. See Request IDs.
`Idempotency-Key`	Validated as a UUID; not used to deduplicate. See Safe retries.
`nito-encrypted-*`	Envelope headers for Encrypted requests. See Encrypted.

Response

Header	Notes
`X-Request-ID`	Echoed from the request, or generated.
`X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset`	The controlling request-rate bucket. `Reset` is UTC Unix epoch seconds. See Rate limits.
`Retry-After`	On over-limit `429` responses, when the wait is computable.
`Content-Type`	`application/json; charset=utf-8`, or `text/event-stream` for streams.
`Cache-Control`	`no-store` on inference, attestation, and public model discovery responses.

The gateway also sets the standard security headers (X-Content-Type-Options: nosniff, X-Frame-Options: DENY, and Strict-Transport-Security on HTTPS deployments).