Eight Named, One Delivered: The Expose List on Our API Host and the Route That Proves It
I work on OnePassApps, the team behind app.onepassapps.com. This is a measurement of our own API host, api.onepassapps.com, taken today, 11 November 2026, over plain HTTPS with no cookies and no JavaScript.
It is a follow-up to earlier posts here, so I will say up front which parts are old. The eight-name list itself, and the finding that five of the eight actually arrive on the JSON routes, are both already written up. What is new here is the one route where the list and the response disagree the most, and a before-and-after test with an Origin header.
For reference, the list is this: X-Request-Id, X-RateLimit-Limit, X-RateLimit-Remaining, X-Concurrency-Limit, X-Concurrency-Remaining, Retry-After, X-ToolPass-Credits-Changed and X-ToolPass-Impersonating. On the JSON routes I asked, five of those eight arrive. The three that never do were flagged in the earlier post: Retry-After, X-ToolPass-Credits-Changed and X-ToolPass-Impersonating.
The clearest proof that the list is a statement about the host rather than an inventory of any one response is the API host's own robots.txt, api.onepassapps.com/robots.txt, not the app host's static file. It answers 200 and carries the same eight-name list attached, but only one of the eight actually arrives: X-Request-Id. The reason is visible in the header set. /api/health carries 32 distinct header names across 33 header lines, because server-timing arrives twice, while robots.txt carries 27 names on 27 lines with nothing repeated. The names robots.txt drops are x-concurrency-limit, x-concurrency-remaining, x-ratelimit-limit, x-ratelimit-remaining, x-robots-tag. Seven of the eight names in the expose list therefore have nothing on that route to point at, and the rate-limit headers the list names are simply not in the response at all.
I sent every route twice, once with no Origin header and once with Origin: https://example.com. The header count did not move: 33 lines before, 33 lines after, and the expose list was the same list of eight both times, byte for byte. Nothing about that list is conditioned on the origin.
The one thing that did change with the Origin header was access-control-allow-origin. With https://app.onepassapps.com the API host echoes that origin back. With https://example.com, with https://onepassapps.com, or with no Origin header at all, it sent no access-control-allow-origin on the response, which is an absent header rather than a wildcard. The thirteen-origin sweep and the fixed preflight are in the earlier allow-list post.
The earlier posts that carry the parts I am not repeating, and which are the canonical source for each figure above: the rate-limit post https://dev.to/onepassapps/the-rate-limit-is-not-one-number-120-60-and-30-on-the-same-api-host-and-the-one-route-that-2ech the origin allow-list post https://dev.to/onepassapps/the-origin-allow-list-of-apionepassappscom-two-allowed-origins-one-fixed-preflight-and-40la the runtime post https://dev.to/onepassapps/the-maintenance-message-ships-with-the-switch-off-what-apiruntime-actually-sends-2e0n and the method-contract post https://dev.to/onepassapps/the-method-contract-of-apponepassappscom-56-urls-one-405-53km
What this is not: one build, one day, one region, plain HTTPS, no cookies and no JavaScript. I asked five API routes, /api/health, /api/products, /api/vote-board/items, a path that does not exist and robots.txt, plus the app home page, and I sent one preflight to the API host and one OPTIONS request to the app host, which answered 405 Method Not Allowed. I did not sweep every route, so I make no claim about routes I did not ask, and I did not trigger the busy 503, so the Retry-After line comes from the earlier measurement rather than from today.
The apps are free, they need no account, and they run in your browser tab: https://app.onepassapps.com?utm_source=devto&utm_medium=post&utm_campaign=api-expose-list&utm_content=app-link The guides: https://app.onepassapps.com/guides?utm_source=devto&utm_medium=post&utm_campaign=api-expose-list&utm_content=guides-link
Questions about how the apps work are welcome, and corrections are better than praise. I write here as the OnePassApps team.
Top comments (0)