I have confirmed that my API response has Cache-Control: public, max-age=30 but DXP environment response still says cf-cache-status DYNAMIC.
CF docs says:
Otherwise, if Cache-Control is set to public and the max-age is greater than 0, or if the Expires header is a date in the future, Cloudflare caches the resource.
If both max-age and an Expires header are set, max-age is used.
The code is similar to this example: https://stackoverflow.com/questions/15911356/setting-http-cache-control-headers-in-web-api/22620144#22620144
The method is GET, content-type is application/json and the URLs are /api/something-cool/ without querystrings.