Custom HTTP Header Profiles for AS2: FDA, API Gateways & Webhooks

TL;DR Custom HTTP headers are additional header name-value pairs attached to the HTTP request that carries an AS2 message, used to pass authentication tokens, routing codes or compliance identifiers a trading partner requires. A custom HTTP header profile is a saved set of those headers, stored against a specific partner, so the same values are applied automatically on every send instead of being typed in each time. The same profiles apply to outbound webhook requests.

In AS2 transmission, creating custom HTTP header profiles can be essential for several reasons. AS2 trading partners often need extra fields in the HTTP layer of a message, whether for authentication, routing, or compliance. In this article, let’s discuss what custom HTTP headers are, why AS2 trading partners ask for them, and how MFT Gateway can be used to facilitate such needs so you’re never entering the same values twice.

What Are Custom HTTP Header Profiles in AS2?

AS2 (Applicability Statement 2) transmits business documents over HTTP or HTTPS, and every AS2 message carries a set of HTTP headers alongside its payload. A custom HTTP header profile is a saved set of additional header name-value pairs, separate from the standard AS2 headers, that gets attached to messages sent to a specific trading partner. Instead of typing the same authentication token, routing code, or compliance identifier every time, MFT Gateway users save it once as a profile and apply it whenever they compose a message for that partner.

Why Custom HTTP Headers Matter in AS2 Communication

Custom headers solve real, recurring problems for AS2 trading partners. Here are some of the reasons why we need custom headers in AS2 transmissions.

Adding an Authentication Layer

Custom Authentication: AS2 users may need to add an additional security layer to their AS2 transmission. AS2 message recipients/servers may mandate message senders to add custom headers that could include authentication tokens or additional security information, ensuring that only authorized parties can transmit AS2 messages to their servers.

Meeting Vendor-Specific and Legacy Requirements

Vendor-Specific Requirements: When communicating with multiple AS2 trading partners, different partners might have specific requirements to include custom headers in the AS2 transmissions that are addressed to them.

Legacy Systems Integration: Backward compatibility is essential to maintain successful AS2 communication. Custom headers can help integrate AS2 transmissions with legacy systems that require specific header formats or fields.

Routing Messages and Handling Failed Transmissions

Routing Information: Headers can include routing information for better message handling and processing within complex network architectures. This could be very useful for users who have recipients with multiple routing centers like FDA (U.S. Food and Drug Administration).

Error Handling: Upon AS2 message send failures, custom headers can carry error codes or status messages in the retries/retransmissions, enabling better handling of transmission issues and automated responses.

Supporting Compliance, Auditing and Traceability

Regulatory Requirements: Certain industries or regulatory bodies like the FDA (U.S. Food and Drug Administration) or EMA (European Medicines Agency) may require specific information to be included in the headers for compliance purposes.

Auditing and Traceability: Headers can contain audit-related information, such as transaction IDs and user IDs, to maintain a comprehensive record of transactions. Moreover, headers can include unique identifiers and timestamps to track and verify the authenticity and integrity of messages.

How the FDA ESG Uses AS2 Custom Headers for Routing

When submitting electronic data to regulatory authorities such as the FDA (U.S. Food and Drug Administration) or EMA (European Medicines Agency) using AS2, specific custom headers may be required to ensure proper routing to multiple centers, authentication, and compliance with regulatory standards. These headers facilitate the secure and accurate transmission of sensitive pharmaceutical, clinical, or compliance data.

For example, FDA uses HTTP headers sent on the incoming AS2 request, to route submissions sent by their partners to the appropriate center. The primary headers are as follows:

To improve efficiency, uniformity and reduce the chance of errors, it is recommended to create a set of submission profiles for each, so that senders can quickly submit an application to FDA/EMA, without entering the headers each time.

Read more: What is the FDA ESG?

The 2026 API-Integration Reality: Why Header Profiles Matter More Than Ever

As organizations modernize their B2B infrastructure, the 2026 reality is that many trading partners no longer expose a plain AS2 server endpoint. Instead, inbound AS2 communication protocol traffic frequently passes through API management platforms such as AWS API Gateway, Google Apigee, or Azure API Management before reaching the destination AS2 server.

These API gateways commonly enforce organization-specific authentication and routing policies. Rather than relying solely on standard AS2 authentication mechanisms, they often require additional HTTP headers containing API keys, bearer tokens, tenant identifiers, subscription IDs, or routing metadata before allowing traffic to reach the backend AS2 EDI system.

This creates a challenge for organizations managing multiple AS2 integration projects. Every trading partner may expect a different set of AS2 custom headers, and manually entering these values for every transmission quickly becomes inefficient and error-prone.

This is where HTTP header profiles become particularly valuable. Instead of modifying application code or creating custom middleware for every partner, administrators can create reusable HTTP header profiles that automatically attach the required headers whenever messages are sent to a specific trading partner.

For organizations using AS2 connectivity across dozens or even hundreds of partners, header profiles provide several operational advantages:

• Eliminate repetitive manual entry of partner-specific headers.
• Standardize outbound requests across environments.
• Simplify onboarding of new trading partners.
• Reduce configuration errors during production deployments.
• Avoid custom development solely for gateway-specific authentication requirements.

As more enterprises adopt API gateways as their preferred security layer, reusable MFT gateway headers become an increasingly important capability. Organizations can continue using the standard AS2 protocol while satisfying modern API gateway requirements without introducing custom code or disrupting existing AS2 communication protocol workflows.

In other words, header profiles bridge the gap between traditional AS2 EDI infrastructure and modern API-managed architectures, allowing businesses to maintain reliable AS2 connectivity even as trading partner security requirements continue to evolve.

Configuring Header Profiles in MFT Gateway

Being an AS2 provider, MFT Gateway allows their users to configure such HTTP header profiles at the partner level as below.

Here the user can configure multiple header profiles for one partner and once configured, the user can proceed (or skip) to choose a profile when composing the message.

Custom HTTP header profiles can also be created and managed programmatically through the MFT Gateway REST API, making it easy to automate partner onboarding and configuration. Please refer to the REST API Postman Documentation for more information.

Custom HTTP Headers for Webhook Integrations

HTTP header customization in MFT Gateway is not limited to AS2 message transmissions. The same flexibility is available for Webhook Integrations, allowing outbound webhook requests to include custom HTTP headers required by downstream applications and APIs.

By default, MFT Gateway includes several system-generated headers in every webhook request, such as the message identifier, retry information, and (optionally) a cryptographic signature for payload verification. In addition to these default headers, users can configure one or more custom HTTP headers that will be attached to every webhook invocation. These custom headers are also preserved during automatic webhook retries, ensuring consistent authentication and request processing even when endpoints are temporarily unavailable.

This capability is particularly useful when integrating MFT Gateway with internal applications, API gateways, serverless functions, or SaaS platforms that require API keys, bearer tokens, tenant identifiers, or other vendor-specific headers for authentication and routing. Rather than modifying downstream services or introducing middleware, the required headers can be configured directly within the webhook integration settings.

Security Best Practices for Header-Carried Secrets

Many organizations now use custom HTTP headers to carry authentication tokens, API keys, subscription IDs, or other credentials required by API gateways. While this approach simplifies AS2 integration, it also requires strong operational security practices. Buyers increasingly expect vendors to demonstrate secure handling of credentials throughout their AS2 environment.

When implementing AS2 custom headers, consider the following best practices:

Store secrets securely

Avoid hardcoding API keys or bearer tokens in scripts or application code. Instead, store credentials in secure configuration repositories, encrypted credential stores, or dedicated secret management solutions that integrate with your AS2 server.

Rotate credentials regularly

Authentication tokens and API keys should have defined rotation schedules. Regular rotation reduces the impact of credential exposure and aligns with modern security compliance requirements.

Never log sensitive headers

Application logs, debug traces, and HTTP monitoring tools should mask or exclude authorization headers and other sensitive values. Logging API keys or bearer tokens can unintentionally expose credentials to administrators or attackers.

Scope credentials per trading partner

Each trading partner should receive its own authentication credentials whenever possible. Using partner-specific HTTP header profiles ensures that one compromised credential does not affect every AS2 server connection.

Apply least-privilege access

API keys should only grant the permissions required for the specific AS2 communication protocol workflow. Avoid sharing administrative credentials across multiple integrations.

Audit configuration changes

Maintain audit trails whenever MFT gateway headers or partner-specific header profiles are created, modified, or deleted. This improves accountability while supporting regulatory and security audits.

By combining reusable header profiles with sound credential management, organizations can strengthen AS2 connectivity without sacrificing operational simplicity. This approach enables secure AS2 EDI communications while meeting the higher security expectations that enterprises now place on B2B integrations.

Read more: Security Best Practices for Header-Carried Secrets

Frequently Asked Questions

Do all AS2 trading partners require custom headers?

No. Custom headers are only needed when a specific partner, or a regulatory body they report to, requires additional information beyond the standard AS2 headers.

Do custom headers change the AS2 protocol?

No. Custom headers supplement the standard AS2 protocol rather than replacing it. They simply provide additional information required by trading partners, API gateways, or security infrastructure while preserving standard AS2 communication protocol behavior.

Can I set different headers for each trading partner?

Yes. MFT Gateway allows you to create separate HTTP header profiles for each trading partner. This ensures that every AS2 connection automatically sends the correct authentication, routing, or compliance headers without manual configuration.

Can I use multiple header profiles for one AS2 partner?

Yes. MFT Gateway lets you save several profiles per partner, so you can pick the right one, such as a specific FDA submission type, when composing each message.

Do header profiles work for webhooks too?

Yes, provided the platform supports applying reusable webhook headers. The same concept used for AS2 custom headers can often be applied to outbound webhook requests, allowing consistent authentication and routing across integrations.

Custom HTTP Headers, What to Do Next?

Summing up what we’ve discussed, by implementing and configuring custom HTTP headers in AS2 transmissions, organizations can significantly enhance security, interoperability, message management, and compliance, ensuring that their electronic data interchange (EDI) processes are robust and efficient. Saving these headers as reusable profiles, rather than re-entering them for every message, also removes a common source of manual error for teams handling high transmission volumes or strict regulatory deadlines. As modern B2B integrations increasingly rely on API gateways and downstream webhook integrations, reusable header profiles help organizations meet evolving authentication requirements, strengthen the secure handling of header-carried secrets, and simplify integration management without custom development.

Contact our AS2 experts to see how MFT Gateway can help you configure custom HTTP header profiles for your AS2 trading partners.