HTTP requests will have headers. Sometimes you need them and would like to use them in the process. If you use API Type of Advanced, you can do any of the below. If you use Intermediate or Basic API Type, you can only get the default and custom X-WSS header values. It is often best to grab these values after the start step in case you use any connectors and the document properties are removed.
 

Default headers

These headers can be retrieved without doing any extra configuration. They are available as dynamic document properties (DDP's) within the process. The most updated list is here but the current list:

• Accept
• Content-Encoding
• Accept-Charset
• Content-Language
• Accept-Encoding
• Content-MD5
• Accept-Language
• Content-Type 

To retrieve, you need to use the DDP inheader_<header_name> e.g. for the Content Type header, inheader_Content-Type.
 

Custom X-WSS headers

Custom headers are not part of the standard set of headers you see in HTTP requests. These will be part of Boomi only and usually used specifically for Boomi. The custom headers have format of X-WSS-<header_name> and the header name is some other name you've decided to use. These custom headers are case sensitive so double check your name. 

To retrieve, use DDP header inheader_X-WSS-<header_name>. For example, if your custom header was X-WSS-userID, the DDP would be inheader_X-WSS-userID.

NOTE: At the moment, custom X-WSS headers are only available when using "SIMPLE" and "RESTful" APIs
 

Headers allowed through the API service

Essentially all other headers than the ones mentioned above. Beyond standard headers and custom X-WSS headers, you can pass through all other kinds using the Advanced Settings in the API service. In the Advanced Settings, you are able to define header names to become DDPs. Any header not in the default list of retrieved ones and you do not want to append X-WSS to, you need to list here. 



In this example, I have listed the X-API-KEY and tester header (non-standard ones); the Authorization and Host (which are recognizable standard headers). You can retrieve the header values the same way as the defaults by using inheader_<header_name>. For example, inheader_X-API-KEY, inheader_Authorization, etc. 
 

Removing Case Sensitivity API Request Headers when Passing to a Process

Normally, Dynamic Document Properties are case-sensitive and require the request headers to exactly match. You can add the following custom Runtime property to your runtime to store the header as a lowercase value when it is received as a DDP.  This allows the runtime to associate the Dynamic Document Property with the request header because the runtime will store it as a lowercase value when received and the DDP will also be a lowercase value.

You will need to restart the runtime after adding the property.

Note: As this is a runtime Property, please ensure you are adding it under the runtime Properties section and not System Properties.

Custom runtime Property to Add:
"com.boomi.container.sharedServer.http.header.includelowercase " with a value of "true"

For instructions on where to add Custom Properties see our documentation on Custom Properties
  
Note: The ENTIRE Dynamic Document Property in the process will need to be lowercase if you use this property for the request headers.
For example, if the client sends the request header "TESTER", we would set the DDP as "inheader_tester" for advanced APIs or "inheader_x-wss-tester" for simple APIs (excluding the quotes for both cases).

Tip: If you cannot retrieve specific header values, use the groovy script mentioned in this article Properties_Debug_Script to see exactly how they are passed from your source to the Boomi listener or API. By viewing all properties and headers without knowing their names in advance, you can identify the incoming format and extract precisely what you need.

Protected headers

Note: The headers in the advanced settings of the API service take precedence over the protected headers in the shared web server currently. 

If you have any headers in the protected headers, these should be prevented from being retrieved as a DDP. The protected headers are in the Shared Web Server settings. You can either use the default ones (which can't be edited, list is here under the Protected Headers section) or add your own headers you want to protect like the Authorization or X-API-KEY headers.