Skip to content
Methodology

Link response headers

ia.link-headers · 1.9

Find MAY Recommendation AR-FIND-04 AR-READ-06

Why it matters

RFC 8288 Link headers let an established API advertise concrete machine-readable descriptions and documentation. This checkpoint never creates its own API applicability.

How to fix it

Advertise your API catalog, service description or documentation with an RFC 8288 Link header.

  1. Add a Link header to the home page response that points to your API description.

    Link: </.well-known/api-catalog>; rel="api-catalog", </openapi.json>; rel="service-desc"

  2. Make sure that each linked resource returns HTTP 200.

Verify

curl -sI https://{domain}/

Expected: A Link header with rel api-catalog, service-desc or service-doc

Run a new scan for this checkpoint:

isagentready results {domain} --checkpoint ia.link-headers
Details Mapping, lifecycle and references
AR mapping
Partial match
Score role
Bonus
Introduced
2026-08-24
Revised
2026-09-02
Methodology version
2026-10-22

Checkpoint data (JSON)