---
schema_version: "1"
id: 1e5d433667b18a20c030d0df423fb1b22d56c34ec51cdc5cb8a13209f77b457a
title: Header Removal Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.13/policies-included-header-removal.md
canonical_url: https://docs.mulesoft.com/gateway/1.13/policies-included-header-removal
source_site: docs.mulesoft.com
content_type: documentation
content_hash: ae9117f4e04409bd67932bb4ec799210ed4509b1c564cfe9484248e3d14b9dbb
description: MuleSoft Documentation Site
release: "1.13"
latest: false
---
---
product: Omni Gateway
version: 1.13
keywords: header removal, api gateway, flex gateway, gateway, policy
---

# Header Removal Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy name</strong></p></td><td><p>Header Removal</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Removes headers from a request or a response</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Transformation</p></td></tr><tr><td><p><strong>First Omni Gateway version available</strong></p></td><td><p>v1.0.0</p></td></tr><tr><td><p><strong>Release Notes</strong></p></td><td><p><a href="https://docs.mulesoft.com/release-notes/gateway/policies/header-removal-release-notes">Header Removal</a></p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>500 - The configuration includes an expression that was not evaluated.</p></td></tr></tbody></table>

## Summary

The Header Removal policy removes all listed headers from a request or a response of a message when
you specify an inbound and outbound map of the headers that you want to remove with a key-value
pair.

![A flow chart illustrating the process of setting header injection and removal policies for clients accessing an API through a proxy](/mulesoft/current/en-us/gateway/1.13/_images/header-inject-remove-diagram.png)

You can optionally include DataWeave expressions in the value of the header. For example, all
headers matching the following configured expression are injected to the message:

`“#[attributes.requestPath]”`

> [!NOTE] The following headers may not be removed: accept, host, content-type, content-length,
> date, transfer-encoding, connection,

## Configuring Policy Parameters

### Omni Gateway Local Mode

When you apply the policy via declarative configuration files, Refer to the following policy
definition and table of parameters:

\- policyRef: name: header-removal-flex config: inboundHeaders: <array> // OPTIONAL, default: \[\]
outboundHeaders: <array> // OPTIONAL, default: \[\]

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required or Optional</th><th>Default Value</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>inboundHeaders</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>Empty array</p></div></div></td><td><div><div><p>Map of header names or regular expressions to be removed at the beginning of the message processing, for example, <code>Cache-Control, Access-Control.*</code></p></div></div></td></tr><tr><td><div><div><p><code>outboundHeaders</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>Empty array</p></div></div></td><td><div><div><p>Map of header names or regular expressions to be removed at the end of the message processing, for example, <code>Access-Control-Allow-Credentials</code></p></div><div><div data-type="NOTE"><div><p><code>inboundHeaders</code> and <code>outboundHeaders</code> can not both be empty.</p></div></div></div></div></td></tr></tbody></table>

#### Resource Configuration Example

\- policyRef: name: header-removal-flex config: inboundHeaders: - "Cache-Control" -
"Access-Control.\*" outboundHeaders: - "Access-Control-Allow-Credentials"

### Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table><colgroup><col> <col></colgroup><thead><tr><th><strong>Parameter</strong></th><th><strong>Description</strong></th></tr></thead><tbody><tr><td><div><div><p>Inbound Header Map</p></div></div></td><td><div><div><p>List of header names or regular expressions (comma separated) to be removed at the beginning of the message processing, for example, <code>Cache-Control, Access-Control.*</code></p></div></div></td></tr><tr><td><div><div><p>Outbound Header Map</p></div></div></td><td><div><div><p>List of header names or regular expressions (comma separated) to be removed at the end of the message processing, for example, <code>Access-Control-Allow-Credentials</code></p></div></div></td></tr><tr><td><div><div><p>Method &amp; Resource conditions</p></div></div></td><td><div><div><p>The option to add configurations to only a select few or all methods and resources of the API</p></div></div></td></tr></tbody></table>

## How This Policy Works

Because every header that matches a Header Removal policy parameter is removed from the message, you
must be careful about how you configure that parameter.

For example, the following parameter configuration removes any header starting with the word
`Access-Control`, such as the `Access-Control-Allow-Credentials` and `Access-Control-Allow-Origin`
headers from a message. The configuration also removes the `Cache-Control` header:

![Removed headers at the start of message processing](/mulesoft/current/en-us/gateway/1.13/_images/remove-inbound-header.png)

Figure 1. Inbound Header