feat(guidelines): add new rule for sending user agent header #76
Conversation
| # MUST send `User-Agent` header | ||
|
|
||
| API providers must be able to easily identify which client is calling their API. | ||
| The `User-Agent` header saves the API provider manual work, e.g. retrieving this information from the token or reading the access log. |
There was a problem hiding this comment.
access log reading is still needed, but the User-Agent value is directly visible in the access log, which is not the case for e.g. client_id JWT claim as part of the OAuth2 Bearer Token.
|
I'm struggling a bit with the fact that we cleaned up the guidelines from consumer-facing rules and now introducing a new one. Would it be an option to extend the "About the API" section with such things? Otherwise, I think it's an important rule 👍 |
|
as provider of the product data api - we have given our users the recommendation to set the user-agent (i think we have a coverage of ~90 percentage) for technical identification purpose. The feedback was every time good. If anybody is interested in visualizing user based traffic we have build a dataflow overview. Out of my perspective it could be "SHOULD" as a best practice |
I absolutely agree with this. Consumers should get the information in the "About the API" section. If this rule is desired, I'd vote for renaming it to "Must design APIs that allow identification of user agents" or alike. |
|
Closing this PR, as this is a consumer-facing topic, it will be taken care of in the Consumer API Portal. |
Changelog:
New
User-Agentheader R000074