Signaling content version information in HTTP headers is not generally recommended. A more generally acceptable approach is to use content types. Using content types allows for version negotiation with Accept fields in the request.

For instance, the response could use application/protected-audience-kv+json or something along those lines.

If there is a need to make a breaking change to the format, a new content type can be minted. They are cheap.

See also RFC 6648.