HTTP headers

Below are the request and response headers supported by our endpoints at https://api.truelayer.com.

Most Data API calls only strictly need the Authorization header, but two optional request headers — X-Client-Correlation-Id and X-PSU-IP — noticeably improve observability and reliability, and a couple of response headers are worth capturing on every call. This page explains when to reach for each.

Using headers in a Data API request

A typical authenticated Data API request combines the required Authorization header with the optional headers you'll usually want in production.

Request Headers

Header	Value
`Authorization`	Required on every request. Use the `access_token` from the auth flow. A missing or expired token returns `401 unauthorized` / `invalid_token`.
`X-Client-Correlation-Id`	Optional. Set your own generated ID (e.g. your internal request or trace ID) to correlate a Data API call with your own logs. Because it isn't echoed back in the response, store the mapping to `X-TL-Correlation-Id` (below) yourself.
`X-PSU-IP`	The PSU’s IP address to be passed on to the bank in order to avoid rate limiting. Include it whenever the call is initiated by the end user (ie they're actively in your app). Passing the user's real IP tells the bank the request is attended, which avoids the rate limits that many EU banks apply to unattended calls. Don't send a server IP.

Response Headers

Header	Value
`X-TL-Correlation-Id`	Unique Id per request. We recommend logging this and always sharing it with our Client Ops team when opening incident tickets
`X-Credentials-Id`	CredentialsId of the access token used
`X-Request-Id`	Not recommended: `X-TL-Correlation-Id` should be used instead
`Cache-Control`	`max-age=n` where n number of seconds
`Content-Encoding`	`gzip`
`Content-Type`	`application/json; charset=utf-8`
`Date`	Date and time the message was sent
`Last-Modified`	Indicates the date and time a resource was last modified
`Content-Security-Policy`	`default-src 'none'; frame-ancestors 'none';`
`X-Content-Type-Options`	`nosniff`
`X-Frame-Options`	`deny`
`X-XSS-Protection`	`1; mode=block`
`Referrer-Policy`	`no-referrer`

Which response headers to act on

Most response headers are standard security/transport headers you can ignore. In practice, capture these on every Data API call:

X-TL-Correlation-Id — log it against every request. It's the single most useful value to give TrueLayer support when investigating a specific call, and it's how you tie a response back to the X-Client-Correlation-Id you sent.
X-Credentials-Id — identifies the set of credentials (the connection) the access token belongs to. Use it to reconcile a response with the right user or connection, especially if you manage many. It matches the credentials_id returned in asynchronous webhook payloads.
Cache-Control / Last-Modified — indicate how fresh the returned data is. Use them to judge whether you're seeing cached data and how recently the resource was updated before deciding to re-request.

📘
Always log X-TL-Correlation-Id. Pairing it with your own X-Client-Correlation-Id gives you a request you can trace end to end across your systems and TrueLayer's.

Example Data request

curl "https://api.truelayer.com/data/v1/accounts" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  -H "X-Client-Correlation-Id: 4f1a9c2e-7b3d-4e8a-9c1f-2a6b5d0e3f77" \
  -H "X-PSU-IP: 203.0.113.42"