---
title: "Set caching headers on every response · Agent Wranglers"
url: https://agentwranglers.se/playbook/api-design/requests-and-responses/api-cache-headers
updated: 2026-10-20
licence: "All rights reserved"
---

# Set caching headers on every response

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Requests and responses](https://agentwranglers.se/playbook/api-design/requests-and-responses)
- Rule: Send an explicit `Cache-Control` header on every API response. Send `no-store` on any API response with personal or account data.
- How: This covers JSON answers, which the back/forward cache never holds. HTML pages follow [private responses](https://agentwranglers.se/playbook/adversarial-testing/requests-and-files/private-responses-uncached) instead. Without the header, caches may store some responses by their own rules, as RFC 9111 allows. Use `private, no-store` for answers that depend on the caller's token. Use `public, max-age=<seconds>` only for data that is the same for everyone, such as a product catalogue. Add `Vary` for every request header that changes the answer.
- Check: A contract test calls every route and finds `Cache-Control` on each answer. Every route that needs a token answers with `no-store`.

Example:

```http
GET /orders/ord_8f2k HTTP/1.1
Authorization: Bearer eyJhbGciOi...

HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: private, no-store
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers api design playbook: https://agentwranglers.se/playbook/api-design/requests-and-responses/api-cache-headers`.

- Previous: [Say which format PATCH accepts](https://agentwranglers.se/playbook/api-design/requests-and-responses/patch-format)
- [Requests and responses](https://agentwranglers.se/playbook/api-design/requests-and-responses)