{"uid":"cap_CsuRjjRE0Knmne8o7G4j2","slug":"hsts-policy-check-b985284e","name":"HSTS Policy Check","description":"HSTS Policy Check: HSTS Policy Check checks HSTS max-age and subdomain directives against caller policy from bounded caller-supplied values without an external provider. Call HSTS Policy Check before accepting, caching, redirecting, or retrying a caller-supplied web response. Returns normalized web evidence, the computed finding, and an explicit pass or advisory status for HSTS Policy Check as versioned deterministic JSON. Price: $0.001 USDC via x402 on Base. First-party, stateless, memory-only…","url":"https://api.delx.ai/api/v1/x402/hsts-policy-check","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"header":{"type":"string","maxLength":8192,"description":"Header supplied to HSTS Policy Check; used only for this bounded calculation and processed in memory without retention."},"minimum_seconds":{"type":"integer","description":"Minimum Seconds supplied to HSTS Policy Check; used only for this bounded calculation and processed in memory without retention."},"require_subdomains":{"type":"boolean","description":"Require Subdomains supplied to HSTS Policy Check; used only for this bounded calculation and processed in memory without retention."}}},"responseSchema":{"type":"json","example":{"result":{"passed":true,"max_age_seconds":31536000,"include_subdomains":true},"schema":"delx/util-hsts-policy-check/v1","status":"pass","evidence":{"retained":false,"input_sha256":"f91d8b16767bb6c1225e616e67c4c99626e188225729eb1a7745334aa6398a81","external_calls":0},"operation":"web_reliability:hsts_policy_check"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_1nsFeF6Ag1zW0UZEPSuYz","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Validates an HTTP Strict-Transport-Security header value against caller-specified minimum max-age and subdomain inclusion requirements, returning a deterministic pass/advisory result.","exampleAgentPrompt":"Check this HSTS header — 'max-age=31536000; includeSubDomains' — against a minimum max-age of 31536000 seconds and confirm it also covers subdomains, then tell me if it passes.","exampleUseCases":[{"title":"Security preflight before caching response","prompt":"Before I cache this web response, check its HSTS header 'max-age=86400' against my policy of at least 31536000 seconds and subdomains required — does it pass?"},{"title":"Redirect safety check for agent pipeline","prompt":"I'm about to follow a redirect from an external URL. Validate its HSTS header 'max-age=63072000; includeSubDomains; preload' with a minimum of 15552000 seconds and subdomain requirement on, so I know it's safe."},{"title":"Compliance audit of vendor API endpoint","prompt":"Audit this vendor's HSTS header 'max-age=0' against our policy requiring at least 31536000 seconds and subdomains enforced, and give me the finding so I can flag non-compliance."}],"resultDescription":"Returns a versioned deterministic JSON object containing: normalized evidence parsed from the HSTS header (max-age value, subdomain flag), the computed policy finding, and an explicit pass or advisory status indicating whether the header meets the caller-supplied requirements.","failureModes":["Malformed or missing HSTS header string may result in advisory/fail status rather than an error","minimum_seconds not supplied defaults to no minimum check, potentially bypassing intent","require_subdomains not set defaults to false, silently skipping subdomain validation","Header string exceeding 8192 characters will be rejected","Payment failure via x402 prevents call from being processed"],"whenToPreferThis":"Use this endpoint when your agent pipeline needs a deterministic, stateless, policy-aware HSTS header validator without standing up custom parsing logic. Prefer it over manual regex or ad-hoc checks when you need structured findings with explicit pass/advisory status and normalized evidence, particularly as a preflight before caching, redirecting, or accepting external web responses.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T00:57:38.641Z","isFirstParty":false}