Overview

application/xml is the media type for Extensible Markup Language documents, widely used in SOAP, RSS/Atom feeds, configuration files, and enterprise integrations. It expresses hierarchy through tags and supports strict validation via schemas (XSD).

Details

RFC 7303 defines both application/xml and text/xml. The key difference is the default when no charset parameter is present: application/xml determines encoding from the document's own XML declaration (`<?xml version="1.0" encoding="..."?>`) and any byte order mark, whereas legacy text/xml historically defaulted to US-ASCII when unspecified, causing bugs. XML is therefore best served as application/xml.

Types using the `+xml` structured syntax suffix (application/atom+xml, image/svg+xml, application/soap+xml) all inherit XML processing rules. A server sends the concrete type while a client can recognize the suffix and apply an XML parser.

Syntax

e.g. Content-Type: application/xml; charset=utf-8

File extensions

Notes

• XML parsers expand external entities by default, so parsing untrusted XML enables XXE (XML External Entity) attacks that leak local files or trigger SSRF; disable DTD and external entity resolution in the parser.
• Encoding can be declared in two places (the HTTP charset parameter and the XML declaration), which can conflict. RFC 7303 makes the HTTP charset authoritative — keep the two in sync.
• New APIs favor JSON, but XML remains central in financial, telecom, and government legacy systems and in the SAML/SOAP world.

Related types

Related headers