GET /api/users HTTP/1.1
Host: api.example.com
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9...
Content-Type: application/json
Accept: application/json
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0...
Cache-Control: no-cache
If-None-Match: "abc123"       ← ETag for conditional GET
Cookie: session=xyz789

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 1234
Cache-Control: max-age=3600, public
ETag: "abc123"
Last-Modified: Thu, 15 Jan 2026 10:00:00 GMT
Set-Cookie: session=xyz789; HttpOnly; Secure; SameSite=Strict
X-Request-Id: a1b2c3d4
Access-Control-Allow-Origin: https://app.example.com
Strict-Transport-Security: max-age=31536000; includeSubDomains

POST   /users          → 201 Created  (with Location: /users/42 header)
GET    /users/42       → 200 OK
PUT    /users/42       → 200 OK  (returns updated resource)
PATCH  /users/42       → 200 OK
DELETE /users/42       → 204 No Content
GET    /users/999      → 404 Not Found
POST   /users (duplicate email) → 409 Conflict
POST   /users (invalid email)   → 422 Unprocessable Entity
GET    /users (not logged in)   → 401 Unauthorized
GET    /admin/users (no perm)   → 403 Forbidden

# Tell browser to cache for 1 hour
Cache-Control: max-age=3600, public

# Never cache (API responses)
Cache-Control: no-store

# Revalidate before using cached version
Cache-Control: no-cache, must-revalidate

# ETag conditional request
Client sends: If-None-Match: "abc123"
Server sends: 304 Not Modified (if unchanged)
             200 OK + new ETag: "def456" (if changed)