{"uid":"cap_Gd-eXorzvIJ2-UP009hyu","slug":"security-header-diff-55a0ac80","name":"Security Header Diff","description":"Compare a fixed list of ten security-relevant response headers across two releases and name the specific reverts. Reports a header removed, added or changed, and separately a reduced Strict-Transport-Security max-age, dropped includeSubDomains, a newly permitted unsafe-inline or unsafe-eval, and a Content-Security-Policy that moved from enforcing to report-only so it no longer blocks anything. Observable differences only, not an assessment of whether either configuration is adequate.","url":"https://api.zfinia.com/x402/v1/security-header-diff?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"after":{"type":"object"},"before":{"type":"object"},"after_name":{"type":"string","maxLength":64},"before_name":{"type":"string","maxLength":64}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.11","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.11/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.11","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.11","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_QGisjglXoVTTj0LCGV--J","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.11","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Compares security-relevant HTTP response headers between two releases and reports specific regressions such as removed headers, weakened HSTS, newly permitted unsafe directives, and CSP enforcement downgrades.","exampleAgentPrompt":"Compare the security headers from our v2.3.1 release to our v2.4.0 release and tell me if anything regressed — especially if CSP moved to report-only, if unsafe-inline was added, or if HSTS max-age was shortened.","exampleUseCases":[{"title":"Pre-deploy security regression check","prompt":"Before we promote the new build to production, compare its security headers against the current production headers and flag any regressions — dropped headers, weakened HSTS, or newly permitted unsafe-inline or unsafe-eval."},{"title":"Post-incident rollback validation","prompt":"We just rolled back to v1.9.2 from v1.9.5 after an incident — compare the security headers of those two releases and tell me exactly what changed, especially if our Content-Security-Policy got weaker or switched to report-only."},{"title":"CI/CD pipeline security gate","prompt":"As part of our CI pipeline, diff the security headers from the staging build against the last known-good production snapshot and list any specific security regressions so we can block the merge if anything got worse."}],"resultDescription":"A structured report listing each observable difference across the ten tracked security headers: headers that were added, removed, or changed in value; a reduced Strict-Transport-Security max-age; removal of includeSubDomains from HSTS; addition of unsafe-inline or unsafe-eval to Content-Security-Policy; and a CSP that moved from enforcing to report-only mode. Does not assess overall adequacy — only reports observable differences.","failureModes":["Missing or malformed before/after objects returns a validation error","Headers objects with unexpected structure may cause incomplete diff results","Empty header sets may produce no findings even if configurations differ significantly","Very large or deeply nested header objects may be truncated or rejected"],"whenToPreferThis":"Choose this endpoint when you need a precise, named-regression diff of security headers between two specific release snapshots — especially when you need to detect HSTS weakening, CSP unsafe directive additions, or enforcement-to-report-only downgrades. Prefer this over generic diff tools when the security semantics of header changes (not just string differences) matter for release gating or audit trails.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-18T06:46:49.655Z","isFirstParty":false,"canonicalSlug":"security-header-diff-55a0ac80"}