Code Connect: API Marketplace

Code Connect APIs return the following headers in responses:

Header name	Required?	Description	Example
`Strict-Transport-Security`	Yes	Indicates to browsers that an API should only be accessed using HTTPS, instead of using HTTP. Format: As defined by MDN	`strict-transport-security: max-age=31536000; includeSubDomains; preload`
`X-XSS-Protection`	Yes	Stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. Format: As defined by MDN	`x-xss-protection: 1;mode=block`
`Access-Control-Allow-Origin`	No*	Enables an API to communicate to a Browser-based API client (the origin server(s) allowed to communicate with it.) *This header is used by browser-based API clients. Format: As defined by MDN	`Access-Control-Allow-Origin: *`
`Access-Control-Max-Age`	No*	Communicates to Browser-based clients how long (in seconds) the results of the request can be cached. *This header is used by browser-based API clients. Format: As defined by MDN	`Access-Control-Max-Age: 600`
`Access-Control-Allow-Credentials`	No*	Code Connect APIs potentially consumable by Browser-based clients Enables cross-origin, Code Connect API invocation to be authenticated/authorized via the use of Cookies, Authorization headers, or Client (TLS) Certificates. *This header is used by browser-based API clients. Format: As defined by MDN	`Access-Control-Allow-Credentials: true`
`Content-Security-Policy`	No*	Used to assist in mitigating Cross-Site Scripting (XSS) attacks. *This header is used by browser-based API clients. Format: As defined by MDN	`Content-Security-Policy: script-src 'self' https://codeconnect.fisglobal.com`
`X-Content-Type-Options`	No*	Used by the server to indicate that the MIME types advertised in the Content-Type headers should be followed and not modified. *This header is used by browser-based API clients. Format: As defined by MDN	`X-Content-Type-Options: nosniff`
`X-Frame-Options`	No*	Indicates whether a browser should render content in a <frame>, <iframe> or <object>. *This header is used by browser-based API clients. Format: As defined by MDN	`X-Frame-Options: deny X-Frame-Options: sameorigin X-Frame-Options: allow-from https://codeconnect.fisglobal.com/`
`Public-Key-Pins`	No	Used to communicate a hash of the Code Connect Server Certificate to help users mitigate the risk of Man-in-the-Middle attacks. Users should verify the Server Certificate hash against a stored value shared separately from the response. Format: As defined by MDN

* = This header is conditionally required. Refer to the header description for the requirement conditions.