Agent WranglersRequests and responses Required
Set caching headers on every response
Send an explicit Cache-Control header on every API response. Send no-store on any API response with personal or account data.
How to do it
This covers JSON answers, which the back/forward cache never holds. HTML pages follow private responses instead. Without the header, caches may store some responses by their own rules, as RFC 9111 allows. Use private, no-store for answers that depend on the caller's token. Use public, max-age=<seconds> only for data that is the same for everyone, such as a product catalogue. Add Vary for every request header that changes the answer.
Example
GET /orders/ord_8f2k HTTP/1.1
Authorization: Bearer eyJhbGciOi...
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: private, no-storeHow to check
A contract test calls every route and finds Cache-Control on each answer. Every route that needs a token answers with no-store.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers api design playbook: https://agentwranglers.se/playbook/api-design/requests-and-responses/api-cache-headers.