how can we send key based encrypted parameter in an api request in the header instead of sending directly

Question

[AllowAnonymous]
        [HttpGet]
        [Route("api/HelpVideo/{ID}")]
        [ResponseType(typeof(HttpResponseMessage))]
        public HttpResponseMessage GetHelpVideo(int ID)
        {
            try
            {
                HelpContent obj = db.HelpContents.Find(ID);
                string FileName = string.Empty;
                FileName = obj.FileName;
                if (!string.IsNullOrEmpty(FileName))
                {
                    FileProvider = new FileProvider(0, Global.FileLocationType.HelpDocument);
                    if (!FileProvider.Exists(FileName))
                    {
                        return this.Request.CreateResponse(HttpStatusCode.NotFound, new { Status = Global.Status.NotFound.ToString(), Message = Global.StatusMessage.NotFound });

                    }
                    string rootPath = HttpContext.Current.Server.MapPath(ConfigurationManager.AppSettings[AppSettingsKey] + "/Help/");
                    //var decodedFileName = Uri.UnescapeDataString(FileName);
                    var vidFile = File.OpenRead(Path.Combine(rootPath, FileName));

                    return new ProgressiveDownload(Request).ResultMessage(vidFile, "video/mp4");

                }
                else
                {

                    return this.Request.CreateResponse(HttpStatusCode.NotFound, new { Status = Global.Status.NotFound.ToString(), Message = Global.StatusMessage.NotFound });
                }
            }
            catch (Exception ex)
            {
                Global.InsertException(ex);
                return this.Request.CreateResponse(HttpStatusCode.InternalServerError, new { Status = Global.Status.Invalid.ToString(), Message = Global.StatusMessage.Invalid, MessageDetail = ex.Message + (ex.InnerException == null ? "" : ex.InnerException.Message) });

            }
        }

Answer 1

the server would encrypt the id before giving to the client app. if you don't want on url, a form post is probably easier to client code than a custom header.

<form method="post" action="my_url">
   <input type="hidden" name="id" value="the value">
  <submit>click me</submit>
</form>