The meta robots tag lives in the head of an HTML document. That leaves a gap: a PDF, an image, a CSV export, or a video file has no head to put it in. X-Robots-Tag closes the gap by sending the same directives in the HTTP response header.
The syntax matches. X-Robots-Tag: noindex keeps a file out of the index, noindex, nofollow adds link handling, and unavailable_after sets an expiry date for time-limited content. A user-agent can be named to target one crawler, and multiple directives can be sent as separate headers.
The most common real use is a library of PDFs that should be downloadable from the site but should not compete with the HTML pages that describe them. Configuring it happens at the server or CDN layer, matched on file extension or path.
The rule that catches people is shared with meta robots: a URL blocked in robots.txt is never fetched, so its X-Robots-Tag is never read. To remove a page from the index, let the crawler reach it and let it read the directive.