---
schema_version: "1"
id: 3132d968c7a9d50fb2b45fc95561d296b95fe107d3e093f914c28b83720c62e8
title: Header Injection Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/latest/policies-included-header-injection.md
canonical_url: https://docs.mulesoft.com/gateway/latest/policies-included-header-injection
source_site: docs.mulesoft.com
content_type: documentation
content_hash: ec840324e278226335a31713f1ba08ac9e5f2d9027c1e8b9a8353457cba702c2
description: MuleSoft Documentation Site
release: "1.14"
latest: true
---
---
product: Omni Gateway
version: 1.14
is-latest-version: true
keywords: header injection, api gateway, flex gateway, gateway, policy
---

# Header Injection Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy name</strong></p></td><td><p>Header Injection</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Adds headers to a request or response.</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Transformation</p></td></tr><tr><td><p><strong>First Omni Gateway version available</strong></p></td><td><p>v1.0.0</p></td></tr><tr><td><p><strong>Release Notes</strong></p></td><td><p><a href="https://docs.mulesoft.com/release-notes/gateway/policies/header-injection-release-notes">Header Injection Policy</a></p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>500 - The configuration includes an expression that was not evaluated.</p></td></tr></tbody></table>

## Summary

The Header Injection policy adds HTTP headers to the request or response of a message. When you
configure this policy for your API, you must specify an inbound and outbound map of the headers that
you want to add in the message processing in the form of a key-value pair.

![A flow chart illustrating the process of setting header injection and removal policies for clients accessing an API through a proxy](/mulesoft/current/en-us/gateway/latest/_images/header-inject-remove-diagram.png)

You can optionally include DataWeave expressions in the value or name of the header. For example,
all headers matching the following configured expression are injected to the message:

`“#[attributes.requestPath]”`

If the injected header already exists in the message attributes, the policy creates a new header
without overriding the value of the existing one.

> [!NOTE] Only certain headers are restricted to support multiple values, and they will be
> overwritten using configured values. These headers are: `access-control-allow-origin`,
> `content-type`, `content-length`, `transfer-encoding`.
>
> To overwrite any other existing message header, remove it before adding your header. See the
> [Header Removal](https://docs.mulesoft.com/gateway/latest/policies-included-header-removal) policy.

## Configuring Policy Parameters

### Omni Gateway Local Mode

When you apply the policy via declarative configuration files, Refer to the following policy
definition and table of parameters:

\- policyRef: name: header-injection-flex config: inboundHeaders: <array> // OPTIONAL, default:
\[\] - key: <string> // REQUIRED value: <string> // REQUIRED outboundHeaders: <array> // OPTIONAL,
default: \[\] - key: <string> // REQUIRED value: <string> // REQUIRED

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required or Optional</th><th>Default Value</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>inboundHeaders</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>Empty array</p></div></div></td><td><div><div><p>List of headers to be injected at the beginning of the message processing.</p></div></div></td></tr><tr><td><div><div><p><code>inboundHeaders.key</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>A string or DataWeave expression for header name</p></div></div></td></tr><tr><td><div><div><p><code>inboundHeaders.value</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>A string or DataWeave expression for header value</p></div></div></td></tr><tr><td><div><div><p><code>outboundHeaders</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>Empty array</p></div></div></td><td><div><div><p>List of header to be injected at the end of the message processing.</p></div></div></td></tr><tr><td><div><div><p><code>outboundHeaders.key</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>A string or DataWeave expression for header name</p></div></div></td></tr><tr><td><div><div><p><code>outboundHeaders.value</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>A string or DataWeave expression for header value</p></div></div></td></tr></tbody></table>

> [!NOTE] `inboundHeaders` and `outboundHeaders` can not both be empty.

To use single quotes directly in a String value (for example
`"default-src 'none'; frame-ancestors 'none';"`), either:

- Use a DataWeave expression:

  #\["default-src 'none'; frame-ancestors 'none';"\]

- Use character escaping:

  "default-src \\'none\\'; frame-ancestors \\'none\\';"

#### Resource Configuration Example

In the following example, all the headers matching the configured `#[attributes.requestPath]`
expression are injected into the message.

\- policyRef: name: header-injection-flex config: inboundHeaders: - key: "new-inbound-header" value:
"#\[attributes.requestPath\]" outboundHeaders: - key: "new-outbound-header" value:
"#\[attributes.requestPath\]"

### Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table><colgroup><col> <col></colgroup><thead><tr><th><strong>Parameter</strong></th><th><strong>Description</strong></th></tr></thead><tbody><tr><td><div><div><p>Inbound Header Map</p></div></div></td><td><div><div><p>List of headers to be injected at the beginning of the message processing.</p></div></div></td></tr><tr><td><div><div><p>Inbound Header Key</p></div></div></td><td><div><div><p>String or Dataweave expression to be used as header name at the beginning of the message.</p></div></div></td></tr><tr><td><div><div><p>Inbound Header Value</p></div></div></td><td><div><div><p>String or Dataweave expression to be used as header value at the beginning of the message.</p></div></div></td></tr><tr><td><div><div><p>Outbound Header Map</p></div></div></td><td><div><div><p>List of headers to be injected at the end of the message processing.</p></div></div></td></tr><tr><td><div><div><p>Outbound Header Key</p></div></div></td><td><div><div><p>String or Dataweave expression to be used as header name at the end of the message processing.</p></div></div></td></tr><tr><td><div><div><p>Outbound Header Value</p></div></div></td><td><div><div><p>String or Dataweave expression to be used as header value at the end of the message processing.</p></div></div></td></tr><tr><td><div><div><p>Method &amp; Resource conditions</p></div></div></td><td><div><div><p>The option to add configurations to only a select few or all methods and resources of the API</p></div></div></td></tr></tbody></table>

> [!NOTE] Header keys should be compliance with
> [HTTP 1.1](https://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html#sec2.2) standard.

To use single quotes directly in a String value (for example
`"default-src 'none'; frame-ancestors 'none';"`), either:

- Use a DataWeave expression:

  #\["default-src 'none'; frame-ancestors 'none';"\]

- Use character escaping:

  "default-src \\'none\\'; frame-ancestors \\'none\\';"