MIME Types: A List of Common Media Types

How a MIME type is written

type "/" subtype [ "+" suffix ] [ ";" parameter "=" value ]

application/json
text/html; charset=utf-8
application/problem+json
multipart/form-data; boundary=----x7Tq2

The type is the broad family and the subtype the exact format. Names are not case-sensitive and are conventionally written in lower case. A parameter after a semicolon adds detail: charset on text types, and the required boundary on multipart bodies.

MIME types for API requests and responses

Text, documents and archives

Images, audio, video and fonts

Reading a type you have not seen before

Structured suffixes: +json and +xml

A suffix says which general syntax a specialised format is built on. application/problem+json is a specific kind of error document, and it is also JSON, so a client that does not know the specific type can still parse it as JSON. image/svg+xml is an image that happens to be XML. When you meet an unfamiliar type ending in +json, treat the body as JSON and read the provider's documentation for what the fields mean.

Vendor types: vnd.

A subtype beginning vnd. belongs to a particular company or product. APIs use them for versioning: GitHub's API, for example, accepts Accept: application/vnd.github+json. The long Office types in the table above are vendor types too.

The x- prefix

Subtypes starting with x- were never registered. The convention is discouraged for new types, but several old ones are permanent fixtures: application/x-www-form-urlencoded is among the most used media types on the web.

charset

The charset parameter matters on text/* types, where leaving it off invites the receiver to guess and turn accented characters into nonsense. application/json defines no charset parameter, because JSON between systems is always UTF-8. Adding ; charset=utf-8 to it is common and harmless.

Where MIME types appear in HTTP

Two status codes exist only for mismatches between them. A server that cannot read the format you sent answers 415 Unsupported Media Type. A server that cannot produce any format your Accept header lists answers 406 Not Acceptable. The Content-Type header guide goes through both headers in detail, and the curl Content-Type example shows how to set them on a command line.

Sniffing, and how to stop it

When a response has a missing or implausible Content-Type, browsers may inspect the bytes and decide the format themselves. That is how a file uploaded as a harmless image can end up executed as a script. Servers prevent it by sending the correct type along with X-Content-Type-Options: nosniff, which tells the browser to believe the header. If you serve files that users uploaded, send both, and serve anything you cannot identify as application/octet-stream so it downloads instead of rendering.

A file extension is a hint for people and operating systems; over HTTP only the header counts. A JSON response served as text/html will be treated as HTML however its URL ends. To see what a server really sends, request the URL in the API tester and read the content-type response header, or use a curl HEAD request.

References

• IANA: Media Types registry — The authoritative list of every registered type.
• RFC 6838: Media Type Specifications and Registration — The naming rules: trees, vendor prefixes and structured suffixes.
• MDN: MIME types — How browsers use media types, including sniffing.
• MDN: Common media types — A longer table of types by file extension.

These links leave api-tester.com, which is independent of the organisations they point to.

Frequently asked questions