Headers

Most RealtimeX API endpoints require one or more HTTP headers to authenticate requests, identify the tenant, and specify the request format.

The following headers are commonly used throughout the API.

Standard Headers

Header	Required	Description
Authorization	Required	Bearer access token used to authenticate protected API requests.
Content-Type	Required	Specifies the format of the request body. Use `application/json` for JSON payloads.
Accept	Optional	Specifies the expected response format. Recommended value: `application/json`.
is-tenant	Required	Set to `true` when accessing tenant-scoped resources.
x-client-id	Required	The unique Client ID used to identify the tenant. Required when `is-tenant` is `true`.

Authorization

Protected endpoints require an access token in the Authorization header.

http

Authorization: Bearer <accessToken>

Requests without a valid access token receive a 401 Unauthorized response.

Content-Type

When sending data in the request body, specify the content type as JSON.

http

Content-Type: application/json

This header is required for most POST, PUT, and PATCH requests.

Tenant Headers

For tenant-specific operations, include both of the following headers:

http

1is-tenant: true2x-client-id: <client_id>

These headers allow the API to identify the tenant context and process the request against the correct client workspace.

Complete Request Example

A typical authenticated, tenant-scoped request includes the headers below:

http

1POST /api/v1/user/login/client HTTP/1.12Host: api.example.com3Authorization: Bearer <access_token>4Content-Type: application/json5Accept: application/json6is-tenant: true7x-client-id: your_client_id

Common Errors

Missing or invalid headers typically result in one of the following responses:

HTTP Status	Reason
400 Bad Request	Required headers are missing or invalid.
401 Unauthorized	Access token is missing, invalid, or expired.
403 Forbidden	The authenticated user does not have permission to access the requested resource.

Best Practices

Always send requests over HTTPS.
Store access tokens securely and never expose them in client-side source code.
Use the latest access token after every successful token refresh.
Include tenant headers only for tenant-scoped endpoints.
Set Content-Type: application/json whenever sending a JSON request body.

Standard Headers

Header	Required	Description
Authorization	Required	Bearer access token used to authenticate protected API requests.
Content-Type	Required	Specifies the format of the request body. Use `application/json` for JSON payloads.
Accept	Optional	Specifies the expected response format. Recommended value: `application/json`.
is-tenant	Required	Set to `true` when accessing tenant-scoped resources.
x-client-id	Required	The unique Client ID used to identify the tenant. Required when `is-tenant` is `true`.

Common Errors

Missing or invalid headers typically result in one of the following responses:

HTTP Status	Reason
400 Bad Request	Required headers are missing or invalid.
401 Unauthorized	Access token is missing, invalid, or expired.
403 Forbidden	The authenticated user does not have permission to access the requested resource.

Best Practices

Always send requests over HTTPS.
Store access tokens securely and never expose them in client-side source code.
Use the latest access token after every successful token refresh.
Include tenant headers only for tenant-scoped endpoints.
Set Content-Type: application/json whenever sending a JSON request body.