# API HTTP Compression

> Negotiate and apply HTTP compression for APIs: Brotli/gzip/zstd, Accept-Encoding, Vary, and BREACH mitigations. Use when enabling compression or debugging encoding issues.

- Skill: `deangrant/api-http-compression` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add deangrant/api-http-compression`
- Raw SKILL.md: https://api.skillmd.com/api/skills/deangrant/api-http-compression/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: deangrant (https://skillmd.com/u/deangrant)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/deangrant/api-http-compression

---


# HTTP Compression

Use this skill when compressing API response bodies.

---

## 1. Negotiation

Client: `Accept-Encoding: br, gzip`. Server picks; set `Content-Encoding` and
`Vary: Accept-Encoding`. Prefer Brotli with gzip fallback; consider size
threshold (~1KB+).

---

## 2. Safety

Avoid compressing secrets alongside attacker-controlled input over TLS without
BREACH mitigations (separate secrets, disable compression on sensitive
endpoints, or randomize).

Do not double-compress already compressed binaries (images, zip).

---

## 3. Quick checklist

- [ ] Accept-Encoding honored; Content-Encoding set.
- [ ] Vary: Accept-Encoding present.
- [ ] Min-size threshold; skip precompressed types.
- [ ] Sensitive endpoints reviewed for BREACH.

See [reference.md](reference.md) and [examples.md](examples.md).