A6 · Headers: Content-Type, Accept: Headers are the **labels and customs paperwork** on a parcel: without touching the contents (body), they answer "what is this, how should it b
Headers are the **labels and customs paperwork** on a parcel: without touching the contents (body), they answer "what is this, how should it be opened, who sends it, can it be cached". **Content-Type** = "the package inside is JSON" (so the server parses it that way), **Accept** = "reply to me in JSON" (the client's preference), **Authorization** = "this is my identity" (Bearer token), **Cache-Control** = "don't cache this / cache for this long". But if the data already travels in the body, why do these invisible labels matter so much? Because if a header is wrong/missing, the operation fails even with a correct body: missing `Content-Type` and the server treats JSON as plain text, missing `Authorization` and you get 401, wrong `Cache-Control` and stale data returns from cache so the test sees a "phantom" bug. In Java the equivalent is `@RequestHeader` and `HttpHeaders`; headers steer behavior like method parameters. In QA headers are the most insidious bug source because they are INVISIBLE: a request that works in Postman fails in automation because a header was forgotten, and gets debugged for hours as "same code, different result".
Four Headers a Tester Must Know
🎬 The Invisible Culprit: Works in Postman, Fails in Automation
The same POST /api/v1/bugs returns 201 in Postman but 400 in the automation test. The code is identical — what differs?
When you pick "raw JSON", Postman SILENTLY adds the `Content-Type: application/json` header — you don't see it, but it is sent.
The automation code forgets to add this header BY HAND. The server does not treat the body as JSON, sees it empty, and returns 400 saying "title required".
It gets debugged for hours as "correct code but failing". The culprit is a missing invisible header — not the body.
The lesson — GUI tools may add headers for you; in automation nothing is "automatic". When comparing two environments, check headers first.
Why the Authorization Header Is the Key to 401
Bearer token is sent…
The `Authorization: Bearer ` header carries the request's identity — with it the server knows "who you are".
Missing header = 401…
Without the header the server cannot resolve identity and returns 401 — no matter how correct the body is.