Anatomy of an HTTP Request and Response

Once you've seen the structure, raw HTTP stops looking like a wall of text and becomes four predictable parts. This guide breaks a request and a response down line by line.

This is a supporting guide in The Complete Guide to HTTP.

A request, line by line

POST /api/users?notify=true HTTP/1.1
Host: example.com
Content-Type: application/json
Authorization: Bearer eyJhbGci...
Content-Length: 17

{ "name": "Ada" }

• Request line — the method (POST), the path with any query string (/api/users?notify=true), and the HTTP version.
• Headers — one Name: value per line. Host says which site; Content-Type describes the body; Authorization carries credentials; Content-Length is the body size in bytes.
• Blank line — a single empty line marks the end of the headers.
• Body — the payload. Present on POST/PUT/PATCH; absent on a typical GET.

A response, line by line

HTTP/1.1 201 Created
Content-Type: application/json
Location: /api/users/42
Content-Length: 24

{ "id": 42, "name": "Ada" }

• Status line — the version, the status code (201), and its reason phrase (Created).
• Headers — response metadata: Content-Type for the body, Location for the new resource's URL, caching and cookie headers, and so on.
• Body — the returned representation (JSON here), if any.

The query string vs the body

Both carry data, but they're different: the query string (?notify=true) is part of the URL — visible, logged, and meant for filtering/identifying a resource. The body carries the payload you're sending and can be much larger. Sensitive data belongs in the body (over HTTPS), never in the query string.

Related

Part of The Complete Guide to HTTP. See also How to Read and Parse HTTP Headers and HTTP Request Methods.

Try it

Copy the headers out of your browser's dev tools and turn them into readable JSON with the HTTP Headers Parser — entirely in your browser.