diff --git a/specification/storage/Microsoft.BlobStorage/models.tsp b/specification/storage/Microsoft.BlobStorage/models.tsp
index 6f6d8f4b23f1..a4b03465a7fb 100644
--- a/specification/storage/Microsoft.BlobStorage/models.tsp
+++ b/specification/storage/Microsoft.BlobStorage/models.tsp
@@ -1279,6 +1279,14 @@ alias AcceptRangesResponseHeader = {
   @header("Accept-Ranges") acceptRanges?: string;
 };
 
+/** The private accept ranges response header. */
+alias AcceptRangesResponseHeaderPrivate = {
+  /** Indicates that the service supports requests for partial blob content. */
+  @access(Access.internal)
+  @header("Accept-Ranges")
+  acceptRanges?: string;
+};
+
 /** The is current version response header. */
 alias IsCurrentVersionResponseHeader = {
   /** The value of this header indicates whether version of this blob is a current version, see also x-ms-version-id header. */
@@ -1492,6 +1500,14 @@ alias RequestServerEncryptedResponseHeader = {
   isServerEncrypted?: boolean;
 };
 
+/** The private request server encrypted response header. */
+alias RequestServerEncryptedResponseHeaderPrivate = {
+  /** The value of this header is set to true if the contents of the request are successfully encrypted using the specified algorithm, and false otherwise. */
+  @access(Access.internal)
+  @header("x-ms-request-server-encrypted")
+  isServerEncrypted?: boolean;
+};
+
 /** The server encrypted response header. */
 alias ServerEncryptedResponseHeader = {
   /** The value of this header is set to true if the contents of the request are successfully encrypted using the specified algorithm, and false otherwise. */
@@ -1499,6 +1515,14 @@ alias ServerEncryptedResponseHeader = {
   isServerEncrypted?: boolean;
 };
 
+/** The server encrypted response header. */
+alias ServerEncryptedResponseHeaderPrivate = {
+  /** The value of this header is set to true if the contents of the request are successfully encrypted using the specified algorithm, and false otherwise. */
+  @access(Access.internal)
+  @header("x-ms-server-encrypted")
+  isServerEncrypted?: boolean;
+};
+
 /** The legal hold response header. */
 alias LegalHoldResponseHeader = {
   /** Specifies the legal hold status to set on the blob. */
@@ -1527,6 +1551,14 @@ alias BlobSequenceNumberResponseHeader = {
   blobSequenceNumber: int64;
 };
 
+/** The private blob sequence number response header. */
+alias BlobSequenceNumberResponseHeaderPrivate = {
+  /** The current sequence number for a page blob. This header is not returned for block blobs or append blobs. */
+  @access(Access.internal)
+  @header("x-ms-blob-sequence-number")
+  blobSequenceNumber: int64;
+};
+
 /** The blob expiration options parameter. */
 alias BlobExpiryOptionsParameter = {
   /** Required. Indicates mode of the expiry time */
@@ -1601,6 +1633,14 @@ alias VersionIdResponseHeader = {
   versionId: string;
 };
 
+/** The private version ID response header. */
+alias VersionIdResponseHeaderPrivate = {
+  /** A DateTime value returned by the service that uniquely identifies the blob. The value of this header indicates the blob version, and may be used in subsequent requests to access this version of the blob. */
+  @access(Access.internal)
+  @header("x-ms-version-id")
+  versionId: string;
+};
+
 /** The creation time response header. */
 alias CreationTimeResponseHeader = {
   /** Returns the date and time the blob was created. */
@@ -1619,6 +1659,16 @@ alias LastModifiedResponseHeader = {
   lastModified: utcDateTime;
 };
 
+/** The private last modified response header */
+alias LastModifiedResponseHeaderPrivate = {
+  /** The date/time that the container was last modified. */
+  #suppress "@azure-tools/typespec-azure-core/known-encoding" "Existing API"
+  @encode("rfc7231")
+  @access(Access.internal)
+  @header("Last-Modified")
+  lastModified: utcDateTime;
+};
+
 /** The Date response header */
 alias DateResponseHeader = {
   /** UTC date/time value generated by the service that indicates the time at which the response was initiated */
@@ -1628,12 +1678,30 @@ alias DateResponseHeader = {
   date: utcDateTime;
 };
 
+/** The private Date response header */
+alias DateResponseHeaderPrivate = {
+  /** UTC date/time value generated by the service that indicates the time at which the response was initiated */
+  #suppress "@azure-tools/typespec-azure-core/known-encoding" "Existing API"
+  @encode("rfc7231")
+  @access(Access.internal)
+  @header("Date")
+  date: utcDateTime;
+};
+
 /** The ETag response header */
 alias EtagResponseHeader = {
   /** The ETag contains a value that you can use to perform operations conditionally. */
   @header("ETag") eTag: string;
 };
 
+/** The private ETag response header */
+alias EtagResponseHeaderPrivate = {
+  /** The ETag contains a value that you can use to perform operations conditionally. */
+  @access(Access.internal)
+  @header("ETag")
+  eTag: string;
+};
+
 /** The copy source tags header parameter. */
 alias CopySourceTagsParameter = {
   /** Optional, default 'replace'.  Indicates if source tags should be copied or replaced with the tags specified by x-ms-tags. */
@@ -1777,6 +1845,14 @@ alias EncryptionScopeResponseHeader = {
   encryptionScope?: string;
 };
 
+/** The private encryption scope response header. */
+alias EncryptionScopeResponseHeaderPrivate = {
+  /** If the blob has a MD5 hash, and if request contains range header (Range or x-ms-range), this response header is returned with the value of the whole blob's MD5 value. This value may or may not be equal to the value returned in Content-MD5 header, with the latter calculated from the requested range */
+  @access(Access.internal)
+  @header("x-ms-encryption-scope")
+  encryptionScope?: string;
+};
+
 /** The blob content disposition parameter. */
 alias BlobContentDispositionParameter = {
   /** Optional. Sets the blob's content disposition. If specified, this property is stored with the blob and returned with a read request. */
@@ -1920,6 +1996,14 @@ alias EncryptionKeySha256ResponseHeader = {
   encryptionKeySha256?: string;
 };
 
+/** The private encryption key SHA256 response header. */
+alias EncryptionKeySha256ResponseHeaderPrivate = {
+  /** The SHA-256 hash of the encryption key used to encrypt the blob. This header is only returned when the blob was encrypted with a customer-provided key. */
+  @access(Access.internal)
+  @header("x-ms-encryption-key-sha256")
+  encryptionKeySha256?: string;
+};
+
 /** The encryption key parameter. */
 alias EncryptionKeyParameter = {
   /** Optional.  Version 2019-07-07 and later.  Specifies the encryption key to use to encrypt the data provided in the request. If not specified, the request will be encrypted with the root account key. */
@@ -2218,6 +2302,7 @@ alias IsHierarchicalNamespaceEnabled = {
 
 alias StructuredBodyTypeResponseHeader = {
   /** Indicates the response body contains a structured message and specifies the message schema version and properties. */
+  @access(Access.internal)
   @header("x-ms-structured-body")
   structuredBodyType?: string;
 };
@@ -2230,12 +2315,14 @@ alias StructuredContentLengthParameter = {
 
 alias StructuredContentLengthResponseHeader = {
   /** The length of the blob/file content inside the message body when the response body is returned as a structured message. Will always be smaller than Content-Length. */
+  @access(Access.internal)
   @header("x-ms-structured-content-length")
   structuredContentLength?: int64;
 };
 
 alias StructuredBodyParameter = {
   /** Required if the request body is a structured message. Specifies the message schema version and properties. */
+  @access(Access.internal)
   @header("x-ms-structured-body")
   structuredBodyType?: string;
 };
diff --git a/specification/storage/Microsoft.BlobStorage/routes.tsp b/specification/storage/Microsoft.BlobStorage/routes.tsp
index c49f34a63b85..17e21ff7990e 100644
--- a/specification/storage/Microsoft.BlobStorage/routes.tsp
+++ b/specification/storage/Microsoft.BlobStorage/routes.tsp
@@ -11,6 +11,7 @@ namespace Storage.Blob {
   alias ApiVersionHeader = {
     /** Specifies the version of the operation to use for this request. */
     @apiVersion
+    @access(Access.internal)
     @header("x-ms-version")
     version: string;
   };
@@ -225,9 +226,9 @@ namespace Storage.Blob {
       },
       {
         @statusCode statusCode: 201;
-        ...EtagResponseHeader;
-        ...LastModifiedResponseHeader;
-        ...DateResponseHeader;
+        ...EtagResponseHeaderPrivate;
+        ...LastModifiedResponseHeaderPrivate;
+        ...DateResponseHeaderPrivate;
       }
     >;
 
@@ -246,7 +247,7 @@ namespace Storage.Blob {
         ...MetadataHeaders;
         ...EtagResponseHeader;
         ...LastModifiedResponseHeader;
-        ...DateResponseHeader;
+        ...DateResponseHeaderPrivate;
         ...LeaseDurationResponseHeader;
         ...LeaseStateResponseHeader;
         ...LeaseStatusResponseHeader;
@@ -287,7 +288,6 @@ namespace Storage.Blob {
       },
       {
         @statusCode statusCode: 202;
-        ...DateResponseHeader;
       }
     >;
 
@@ -306,9 +306,9 @@ namespace Storage.Blob {
         ...IfModifiedSinceParameter;
       },
       {
-        ...EtagResponseHeader;
-        ...LastModifiedResponseHeader;
-        ...DateResponseHeader;
+        ...EtagResponseHeaderPrivate;
+        ...LastModifiedResponseHeaderPrivate;
+        ...DateResponseHeaderPrivate;
       }
     >;
 
@@ -680,6 +680,7 @@ namespace Storage.Blob {
         rangeGetContentCrc64?: boolean,
 
         /** Specifies the response content should be returned as a structured message and specifies the message schema version and properties. */
+        @access(Access.internal)
         @header("x-ms-structured-body")
         structuredBodyType?: string,
 
@@ -721,8 +722,8 @@ namespace Storage.Blob {
         ...LeaseStatusResponseHeader;
         ...VersionIdResponseHeader;
         ...IsCurrentVersionResponseHeader;
-        ...AcceptRangesResponseHeader;
-        ...DateResponseHeader;
+        ...AcceptRangesResponseHeaderPrivate;
+        ...DateResponseHeaderPrivate;
         ...BlobCommittedBlockCountResponseHeader;
         ...ServerEncryptedResponseHeader;
         ...EncryptionKeySha256ResponseHeader;
@@ -774,8 +775,8 @@ namespace Storage.Blob {
         ...LeaseStatusResponseHeader;
         ...VersionIdResponseHeader;
         ...IsCurrentVersionResponseHeader;
-        ...AcceptRangesResponseHeader;
-        ...DateResponseHeader;
+        ...AcceptRangesResponseHeaderPrivate;
+        ...DateResponseHeaderPrivate;
         ...BlobCommittedBlockCountResponseHeader;
         ...ServerEncryptedResponseHeader;
         ...EncryptionKeySha256ResponseHeader;
@@ -847,8 +848,8 @@ namespace Storage.Blob {
           ...ContentLanguageResponseHeader;
           ...CacheControlResponseHeader;
           ...BlobSequenceNumberResponseHeader;
-          ...DateResponseHeader;
-          ...AcceptRangesResponseHeader;
+          ...DateResponseHeaderPrivate;
+          ...AcceptRangesResponseHeaderPrivate;
           ...BlobCommittedBlockCountResponseHeader;
           ...ServerEncryptedResponseHeader;
           ...EncryptionKeySha256ResponseHeader;
@@ -916,7 +917,7 @@ namespace Storage.Blob {
         },
         {
           @statusCode statusCode: 202;
-          ...DateResponseHeader;
+          ...DateResponseHeaderPrivate;
         }
       >;
 
@@ -981,10 +982,10 @@ namespace Storage.Blob {
           ...IfTagsParameter;
         },
         {
-          ...EtagResponseHeader;
-          ...LastModifiedResponseHeader;
-          ...BlobSequenceNumberResponseHeader;
-          ...DateResponseHeader;
+          ...EtagResponseHeaderPrivate;
+          ...LastModifiedResponseHeaderPrivate;
+          ...BlobSequenceNumberResponseHeaderPrivate;
+          ...DateResponseHeaderPrivate;
         }
       >;
 
@@ -1073,13 +1074,13 @@ namespace Storage.Blob {
           ...IfTagsParameter;
         },
         {
-          ...EtagResponseHeader;
-          ...LastModifiedResponseHeader;
-          ...VersionIdResponseHeader;
-          ...DateResponseHeader;
-          ...RequestServerEncryptedResponseHeader;
-          ...EncryptionKeySha256ResponseHeader;
-          ...EncryptionScopeResponseHeader;
+          ...EtagResponseHeaderPrivate;
+          ...LastModifiedResponseHeaderPrivate;
+          ...VersionIdResponseHeaderPrivate;
+          ...DateResponseHeaderPrivate;
+          ...RequestServerEncryptedResponseHeaderPrivate;
+          ...EncryptionKeySha256ResponseHeaderPrivate;
+          ...EncryptionScopeResponseHeaderPrivate;
         }
       >;
 
@@ -2109,7 +2110,7 @@ namespace Storage.Blob {
             ...LastModifiedResponseHeader;
             ...ContentMd5ResponseHeader;
             ...VersionIdResponseHeader;
-            ...DateResponseHeader;
+            ...DateResponseHeaderPrivate;
             ...RequestServerEncryptedResponseHeader;
             ...EncryptionKeySha256ResponseHeader;
             ...EncryptionScopeResponseHeader;
@@ -2209,7 +2210,7 @@ namespace Storage.Blob {
           },
           {
             @statusCode statusCode: 201;
-            ...DateResponseHeader;
+            ...DateResponseHeaderPrivate;
             ...ContentMd5ResponseHeader;
             ...ContentCrc64ResponseHeader;
             ...RequestServerEncryptedResponseHeader;
@@ -2309,7 +2310,7 @@ namespace Storage.Blob {
             ...ContentMd5ResponseHeader;
             ...ContentCrc64ResponseHeader;
             ...VersionIdResponseHeader;
-            ...DateResponseHeader;
+            ...DateResponseHeaderPrivate;
             ...RequestServerEncryptedResponseHeader;
             ...EncryptionKeySha256ResponseHeader;
             ...EncryptionScopeResponseHeader;
@@ -2343,7 +2344,7 @@ namespace Storage.Blob {
             ...LastModifiedResponseHeader;
             ...EtagResponseHeader;
             ...BlobContentLengthResponseHeader;
-            ...DateResponseHeader;
+            ...DateResponseHeaderPrivate;
           }
         >;