Response headers

The subscription response can carry settings in HTTP headers. The same keys can be written as #key: value lines at the top of the body (see Subscription format); when both are present, the header wins. Keys are case-insensitive. This page lists every key mins implements.

How values are read

Type	Rule
bool	`true` or `1` turns the setting on. Any other non-empty value (`false`, `0`, `yes`, `True`) turns it off. Write lowercase `true`/`false` or `1`/`0`. Exception: `per-app-proxy-enable` accepts only `1` or `0`.
text	Plain text, or `base64:` followed by base64 of UTF-8 text (use it for non-ASCII or multi-line text, since header values must be ASCII). Longer text is cut to the limit, not rejected.
URL	Must be `https://` with a valid host and no whitespace. Six keys also accept a `mins://` link, which always opens the import preview: `support-url`, `profile-web-page-url`, `announce-url`, `premium-url`, `sub-info-button-link`, `sub-expire-button-link`.
list	Items separated by commas and/or whitespace.
range	`N` or `N-M`: unsigned integers with `N` not greater than `M`.
seconds	Integer from 5 to 15.

Other rules:

An empty or blank value is treated as “not sent”: the previous value stays.
Send each header once. Repeated headers with the same name are joined with a comma.
Ordinary HTTP headers (Content-Type, Server, Date and so on) are not subscription keys. They are skipped silently and do not appear under Not applied.
A key that is valid but carries an invalid value is skipped with a reason; the rest of the headers are still applied.

Approval

Settings that change how the device routes traffic, resolves DNS, starts or listens on a local port are never applied silently. They are stored as pending and shown to the user in the import preview (Subscription requests settings changes, with Current and Proposed values) or on the subscription screen (Subscription wants to change settings), with Accept and Reject buttons.

Until the user accepts, the previous value stays in effect.
A rejected value is remembered and is not proposed again until your panel sends a different value for that key. Sending the already accepted value does nothing.
After Accept while connected through that subscription, the client reconnects to apply the change.
All other keys are applied at once and listed under Set by subscription, where the user can override each of them with their own value or return it to their global setting.

Keys that require approval, marked “Yes” in the tables below: routing-enable, proxy-enable, tun-enable, exclude-local-networks-enable, exclude-routes, exclude-routes-set, include-all-networks-enable, exclude-apns-enable, inbound-http-enable, dns-from-json-enable, app-auto-start, and every key starting with per-app-proxy- or server-address-resolve-.

Presentation

Key	Value	Limits	Effect	Approval
`profile-title`	text	25 characters	Subscription name. A name the user typed takes precedence.	No
`profile-description`	text	200 characters	Description on the subscription card.	No
`announce`	text	200 characters	Announcement shown with the subscription’s group on the home screen and on the subscription screen.	No
`announce-url`	URL	`https://` or `mins://`	Learn more button on the announcement, on the subscription screen.	No
`support-url`	URL	`https://` or `mins://`	Support link under Provider links.	No
`profile-web-page-url`	URL	`https://` or `mins://`	Website link.	No
`premium-url`	URL	`https://` or `mins://`	Website: plan link.	No
`support-email`	address	contains `@`; no whitespace, control characters, `?`, `&` or `#`	Email support link (opens a `mailto:`).	No
`sub-info-text` (alias `banner-text`)	text	200 characters	Information card on the subscription screen.	No
`sub-info-button-text` (alias `banner-button-text`)	text	25 characters	Label of the card’s button. Default: Learn more.	No
`sub-info-button-link` (alias `banner-button-url`)	URL	`https://` or `mins://`	Target of the card’s button. Without it the card has no button.	No
`sub-info-color`	`red`, `blue`, `green`		Tone of the card: error color, default accent, success color. Other colors are not accepted.	No
`serverDescription`	text	30 characters	Default description for servers of the subscription that have none of their own.	No

Traffic and expiry

Key	Value	Limits	Effect	Approval
`subscription-userinfo`	`upload=<bytes>; download=<bytes>; total=<bytes>; expire=<unix seconds>`	Unsigned integers; unknown fields and invalid numbers are skipped with a warning; at least one valid field is required	Shows used traffic (`upload` + `download`) of `total`, and the days left until `expire`. `total=0` or absent means no limit, `expire=0` or absent means no expiry. The display switches to the warning tone at 90% of the limit or 3 days left, and to the error tone when the limit is used up or the date has passed.	No
`notification-subs-expire`, `sub-expire`	bool		`false` turns off the expiry notifications for this subscription. Default: on. The client notifies when 3 days are left, when 1 day is left and when the subscription has expired, once per stage. Requires `expire` in `subscription-userinfo`.	No
`sub-expire-button-link`	URL	`https://` or `mins://` in the app; the notification action accepts only `https://`	Renew button on the subscription card and in the expiry notification.	No

Updates and migration

Key	Value	Limits	Effect	Approval
`profile-update-interval`	integer hours	greater than 0	Interval of automatic updates. Default: 6 hours when not sent.	No
`subscription-auto-update-enable`	bool		`false` turns off automatic updates of this subscription.	No
`subscription-auto-update-open-enable`	bool		`true`: every app launch updates all subscriptions, regardless of intervals. Applies to the device; the last subscription that sent it decides.	No
`subscription-request-timeout`	seconds	5 to 15	Timeout for fetching this subscription. Default: 9.	No
`new-url`	URL	`https://`	Replaces the stored subscription URL from this response on. The subscription card shows Subscription URL changed with the old and the new address. If the new address is not HTTPS the update fails with “Insecure subscription migration refused”. Takes precedence over `new-domain`.	No
`new-domain`	host name	no `/`, `:`, `?`, `#`, `@` or whitespace	Replaces only the host of the stored URL; scheme, port, path and query stay. Same notice and HTTPS rule as `new-url`.	No
`fallback-url`	URL	`https://`	Second address tried once when fetching the main URL fails. Saved from a successful response, so it works from the second fetch on.	No
`change-user-agent`	string	no control characters	`User-Agent` for the next requests of this subscription, replacing the user’s preset. See Request headers.	No
`manual-block-user-agent`	bool		`true` locks the User-Agent choice on the subscription screen.	No
`subscription-always-hwid-enable`	bool		`true` marks the subscription as requiring the device identifier. If the user turned Send device identifier (HWID) off, a warning explains that updates may stop; the choice stays with the user.	No

Server list behavior

Key	Value	Limits	Effect	Approval
`subscription-autoconnect`	bool		`true`: when the app starts with a server of this subscription selected, it connects automatically. Also right after the subscription is first imported.	No
`subscription-autoconnect-type`	`lastused`, `lowestdelay`, `random`		Which server the autoconnect picks. `lastused` (default): the last selected server of the group, or the first one if there is none. `lowestdelay`: pings the group and takes the fastest. `random`.	No
`subscription-ping-onopen-enabled`	bool		Pings the servers of this subscription at app start and after import.	No
`subscriptions-sort-type` (alias `sort-order`)	`without`, `ping`, `alphabet`	`sort-order` also accepts `none` (= `without`) and `name` (= `alphabet`)	Order of servers in the group: provider’s order, by ping, by name.	No
`subscriptions-collapse`	bool		`false`: the group cannot be collapsed.	No
`subscriptions-expand-now`	bool		`true`: the group is expanded when the subscription updates.	No
`subscription-pin`	bool		`true`: the group is pinned above the others.	No

Ping

Key	Value	Limits	Effect	Approval
`ping-type`	`tcp`, `proxy`, `proxy-head`, `icmp`		How servers of this subscription are measured. A server’s own `mins.ping.type` and the user’s per-server choice override it.	No
`ping-result`	`time`, `icon`		Show the number or only the quality color.	No
`check-url-via-proxy`	URL	`https://` only (no `mins://`)	Probe address for `proxy` and `proxy-head`. Default `https://www.gstatic.com/generate_204`.	No
`proxy-ping-timeout`	seconds	5 to 15	Ping timeout. Default 5 seconds.	No
`proxy-ping-mode`	`default`	only `default`	Accepted and stored; no effect. Other values (`double`, `keepalive`) are rejected.	No

Traffic tuning

These apply only to servers the client builds itself: servers that came from links, or bare outbounds in JSON. A full Xray JSON server is used as is, and every key in this table is rejected for a JSON subscription with the reason “Traffic controls do not override a full Xray JSON configuration”. Fragmentation and noises shape TCP connections; they cannot be applied to UDP-based servers (Hysteria2, WireGuard, mKCP), which fail to build while they are on.

Key	Value	Limits	Effect	Approval
`fragmentation-enable`	bool		Turns TLS fragmentation on or off.	No
`fragmentation-packets`	`tlshello`, or range	`all` is rejected	Which packets to split.	No
`fragmentation-length`	range		Fragment size in bytes, for example `50-100`.	No
`fragmentation-interval`	range		Delay between fragments, for example `10-20`.	No
`fragmentation-maxsplit`	range		Maximum number of splits.	No
`noises-enable`	bool		Turns noise packets on or off.	No
`noises-packet-type` (alias `noises-type`)	`array`, `str`, `hex`, `base64`, `rand`	default `array`	Format of `noises-packet`.	No
`noises-packet`	string	must match the type (below)	The noise payload. If it does not match its declared type, all `noises-*` keys of the response are ignored.	No
`noises-delay`	range		Delay in milliseconds.	No
`noises-rand`	range		Random payload length.	No
`noises-rand-range`	range	default `0-255`	Value range of the random bytes.	No
`mux-enable`	bool		Turns multiplexing on or off.	No
`mux-tcp-connections`	integer	32-bit signed integer; mins applies no range check	Mux TCP concurrency.	No
`mux-xudp-connections`	integer	32-bit signed integer; mins applies no range check	Mux XUDP concurrency.	No
`mux-quic`	`reject`, `allow`, `skip`		How QUIC (UDP 443) is handled by Mux.	No
`sniffing-enable`	bool		Turns destination sniffing on or off.	No

noises-packet formats: array is bytes, 1,2,3 or [1,2,3]; str is any string; hex is comma-separated hex pairs such as 0a0b,ff00; base64 is comma-separated base64 items; rand is a range such as 10-20.

Device settings (approval)

These keys change how the whole device behaves while the subscription’s servers are used. Every key here except user-agent-geo-files needs the user’s approval.

Key	Value	Limits	Effect	Approval
`proxy-enable`	bool	must be the opposite of `tun-enable` when both are sent	`true`: connection mode Proxy only; `false`: VPN (TUN).	Yes
`tun-enable`	bool	see above	`true`: VPN (TUN); `false`: Proxy only. If both are sent with the same value, both are ignored. If only one is sent, the other one is dropped.	Yes
`exclude-local-networks-enable`	bool		Bypass local networks.	Yes
`exclude-routes`	list	IPs or CIDR (`10.0.0.0/8`, `2001:db8::/32`)	Adds to Excluded routes: these go direct.	Yes
`exclude-routes-set`	list	same	Replaces Excluded routes.	Yes
`include-all-networks-enable`	bool		Include all networks. iOS and macOS only.	Yes
`exclude-apns-enable`	bool		Exclude Apple push notifications. iOS and macOS only.	Yes
`inbound-http-enable`	bool		In VPN mode also opens a local proxy port on `127.0.0.1` with generated credentials.	Yes
`dns-from-json-enable`	bool		For full JSON servers only. `true` (default): the JSON’s own `dns` is used. `false`: the DNS generated from the routing profile in effect replaces it.	Yes
`server-address-resolve-enable`	bool	needs both keys below	Before connecting, resolves the domain names of the subscription’s servers through the DoH resolver below and connects to the IP. SNI and `Host` stay unchanged. Link servers only. If resolving fails the original domain is used with a warning.	Yes
`server-address-resolve-dns-domain`	URL	`https://` DoH endpoint	The DoH resolver.	Yes
`server-address-resolve-dns-ip`	IP	IP literal	Address of that resolver, so it needs no lookup itself.	Yes
`app-auto-start`	bool		Android: Start at boot.	Yes
`routing-enable`	bool		`true`: the subscription’s servers use the subscription’s routing profile. `false`: no routing profile for them. Set implicitly to `true` when `routing` carries a profile meant to be on (JSON, base64, an `https://` URL or an `onadd` link).	Yes
`routing`	profile	see Routing profiles	A routing profile as JSON, base64 of JSON (optionally `base64:`), an `https://` URL, or a `mins://`/`happ://`/`incy://` routing link. The profile is saved inactive and is used by this subscription’s servers only after `routing-enable` is approved. A URL is downloaded when the subscription is imported; later updates do not download it again, so send the profile inline if it changes often. A profile that fails validation is skipped as “Invalid routing profile”.	Through `routing-enable`
`user-agent-geo-files`	`safari-mac`, `chrome-win`, `safari-ios`, `firefox-win`, `chrome-android`		Browser User-Agent used to download geo files (Geo files User-Agent). Applies to the device; the last subscription that sent it decides.	No

Split tunneling by app

Per-app routing exists on Android, Windows and Linux only. The unsuffixed keys (per-app-proxy-enable, per-app-proxy-mode, per-app-proxy-list, per-app-proxy-list-set, per-app-proxy-list-invert) are the Android variants: they are read on every platform except Windows and Linux, which ignore them and use the -windows and -linux keys instead. The -windows keys are read only on Windows and the -linux keys only on Linux. On iOS and macOS an approved per-app setting makes the connection fail with “Per-app routing is not supported on this platform”. Use the x-device-os request header (see Request headers) and send these keys only to the platforms that support them.

Key	Value	Effect	Approval
`per-app-proxy-enable`	`1` or `0`	Unsuffixed key (Android variant). `0`: per-app mode off. `1`: turns on the “only selected” mode if no mode is set.	Yes
`per-app-proxy-mode`	`off`, `on`, `bypass` (`proxy` is read as `on`)	Unsuffixed key (Android variant). `on`: only the listed apps use the VPN. `bypass`: all apps except the listed ones.	Yes
`per-app-proxy-list`	list of package IDs	Unsuffixed key (Android variant). Adds to the list.	Yes
`per-app-proxy-list-set`	list	Unsuffixed key (Android variant). Replaces the list.	Yes
`per-app-proxy-list-invert`	list	Unsuffixed key (Android variant). Sets the “all except listed” mode and replaces the list.	Yes
`per-app-proxy-mode-windows`	`off`, `on`, `bypass`	Windows. Same meaning as `per-app-proxy-mode`.	Yes
`per-app-proxy-list-windows-add`, `per-app-proxy-list-windows-set`	list of executable names	Windows. Add to or replace the list.	Yes
`per-app-proxy-mode-linux`	`off`, `on`, `bypass`	Linux. Same meaning.	Yes
`per-app-proxy-list-linux-add`, `per-app-proxy-list-linux-set`	list of executable names	Linux. Add to or replace the list.	Yes

Rejected keys

These are recognized and refused. They appear under Not applied in the subscription’s details with the reason below (the reason text is shown in English).

Key	Reason
`hide-settings`, `hide-url`, `hide-check`	Providers cannot hide client settings or controls.
`color-profile`, `banner-bg-color`, `banner-button-color`	Provider colors are not applied; the application theme belongs to the user.
`custom-tunnel-config`	sing-box configuration is outside the supported scope.
`hide-vpn-icon`	The system VPN indicator cannot be hidden.
`subscription-alternative-hwid-enabled`	Alternative HWID format is undocumented.
`no-limit-enabled`, `no-limit-xhttp-enabled`	Xray memory-limit controls do not apply to this engine.

Any other header is not a subscription key and is skipped silently, with no warning. That includes Happ and INCY options mins does not implement, such as tun-type, socks-auth-* or http-auth-*. (An unknown #key: value line in the body is different: it is read as intended metadata and skipped with “Unsupported subscription parameter”.)

Value-level rejections: a key from the tables above with a value outside its limits is skipped with a reason such as “Timeout must be 5–15 seconds”, “Expected a positive interval in hours”, “Unsupported parameter value”, “Expected IP literals or CIDR networks”, “Unsafe URL ignored; HTTPS is required (mins links require import preview)” or “INCY boolean parameters require 1 or 0”.

Examples

A response with the common keys. The base64 values decode to Example VPN and Planned maintenance on Friday, 02:00-03:00 UTC.

HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
profile-title: base64:RXhhbXBsZSBWUE4=
profile-update-interval: 12
subscription-userinfo: upload=1073741824; download=5368709120; total=107374182400; expire=1798761600
support-url: https://t.me/example_support
profile-web-page-url: https://example.com
announce: base64:UGxhbm5lZCBtYWludGVuYW5jZSBvbiBGcmlkYXksIDAyOjAwLTAzOjAwIFVUQw==
announce-url: https://example.com/status
sub-expire-button-link: https://example.com/renew
sub-info-text: Renew by Friday and keep your plan
sub-info-button-text: Renew
sub-info-button-link: https://example.com/renew
sub-info-color: red
subscriptions-sort-type: ping
ping-type: proxy-head
check-url-via-proxy: https://cp.cloudflare.com/generate_204
subscription-ping-onopen-enabled: true

vless://11111111-1111-4111-8111-111111111111@fi.example.com:443?type=ws&security=tls&sni=fi.example.com&path=%2Fws&host=fi.example.com#Finland
hysteria2://s3cret@de.example.com:443/?sni=de.example.com#Germany

Fragmentation and noises work only with TCP/TLS servers. Use them in a subscription that has no Hysteria2, WireGuard or mKCP servers (see Traffic tuning), for example VLESS only:

HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
fragmentation-enable: true
fragmentation-packets: tlshello
fragmentation-length: 50-100
fragmentation-interval: 10-20

vless://11111111-1111-4111-8111-111111111111@fi.example.com:443?type=ws&security=tls&sni=fi.example.com&path=%2Fws&host=fi.example.com#Finland
vless://11111111-1111-4111-8111-111111111111@nl.example.com:443?security=tls&sni=nl.example.com#Netherlands

The same settings that need approval: split tunneling off for a banking app on Android, a local network exception and a routing profile. The user is asked once; if they reject, this exact set is not offered again.

HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
exclude-local-networks-enable: true
exclude-routes: 10.0.0.0/8, 192.168.0.0/16
per-app-proxy-mode: bypass
per-app-proxy-list: com.example.bank, com.example.wallet
routing: https://example.com/routing/ru.json

vless://11111111-1111-4111-8111-111111111111@fi.example.com:443?security=tls#Finland