We follow the github approach and put it all in the headers:

    < HTTP/1.1 200 OK
    * Server nginx/1.9.11 is not blacklisted
    < Server: nginx/1.9.11
    < Date: Thu, 10 Mar 2016 03:19:48 GMT
    < Content-Type: application/json
    < Content-Length: 247620
    < Connection: keep-alive
    < Count: 120
    < X-Frame-Options: SAMEORIGIN
    < Vary: Cookie
    < Link: <https://xxx.com/api/someresource/?limit=50&offset=50; rel="next">
    < Allow: GET, POST, HEAD, OPTIONS
    < X-Server: zzz
    < X-Frame-Options: SAMEORIGIN
    <