{"uid":"cap_XkwUz7DznrGZWUFe5kzS3","slug":"devx-api-health-audit-0ed8cd2f","name":"DevX API Health Audit","description":"Full API Health Audit: give one public API endpoint URL (optional method, headers, body) and get a production-readiness report: latency min/median/p95 over 10 samples, error rate and uptime estimate, JSON schema consistency, security headers, CORS, TLS and cert expiry from CT logs, verdict with fixes. $9 USDC on Base; unreachable targets not charged. Cheaper first look: POST /v1/quick ($0.09: grade + top 3 issues). By DevX.","url":"https://apiaudit.madebydevx.com/v1/audit?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"url":{"type":"string","format":"uri","maxLength":2048,"description":"Public http(s) API endpoint to audit (only this URL is probed)"},"body":{"description":"Optional probe body for POST (string or JSON, max 16 KB)"},"method":{"enum":["GET","HEAD","POST","OPTIONS"],"type":"string","description":"Probe method (default GET). POST is sent once per sample."},"headers":{"type":"object","description":"Optional request headers (e.g. authorization) used only for the probe; never stored or echoed","additionalProperties":{"type":"string","maxLength":1024}},"requestKey":{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$","maxLength":128,"minLength":8,"description":"Optional idempotency key: same payer + requestKey + input within 7 days returns the stored report without a second charge."},"expect_status":{"type":"integer","maximum":599,"minimum":100,"description":"Status code that counts as success (default: any status < 400)"}}},"responseSchema":{"type":"json","example":{"result":{"tier":"quick","verdict":{"grade":"C","label":"needs work before production","score":70,"production_ready":false},"latency_ms":{"ttfb_p95":12,"ttfb_median":5},"top_issues":[{"fix":"Add: Strict-Transport-Security: max-age=31536000; includeSubDomains","title":"No HSTS header","severity":"medium"},{"fix":"Allow-list trusted origins; never reflect the Origin header when credentials are allowed.","title":"CORS reflects any Origin with credentials","severity":"medium"},{"fix":"Redirect (301/308) or reject (403/426) plain HTTP; combine with HSTS.","title":"Plain HTTP is served, not redirected","severity":"medium"}],"full_report":{"url":"/v1/audit","price_usd":"9.00"}},"status":"paid","payment":{"status":"paid","network":"eip155:8453","tx_hash":"0x0000000000000000000000000000000000000000000000000000000000000000","amount_raw":"90000"},"operation_id":"5d0c7a3e-1f2b-4c6d-8e9f-0a1b2c3d4e5f"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.09","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.09/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.09","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.09","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_2PtyGJIrvgdtmMu2_BHcg","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.09","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Runs a production-readiness audit on a public API endpoint, measuring latency, uptime, security headers, TLS, CORS, and JSON schema consistency for $9 USDC per run.","exampleAgentPrompt":"Can you run a production-readiness audit on https://api.myapp.com/v1/users using GET with 10 samples and tell me if it's safe to launch — I want to see latency percentiles, security header issues, and any TLS problems?","exampleUseCases":[{"title":"Pre-launch API security check","prompt":"Before we go live tomorrow, can you audit https://api.myproduct.com/health with a GET request using 10 samples and give me a full production-readiness report — especially any CORS or security header problems I need to fix?"},{"title":"Third-party API reliability check","prompt":"I'm integrating with a payment partner's endpoint at https://partner.payments.io/v2/charge — can you probe it with a POST and 10 samples to check its latency percentiles and uptime before I commit to using it in production?"},{"title":"Post-deploy regression audit","prompt":"We just deployed a new version of our API — can you re-audit https://api.example.com/v2/orders with GET and 10 samples to make sure we haven't broken any security headers or TLS settings compared to what we had before?"}],"resultDescription":"A structured JSON report containing: latency stats (min, median, p95, max, stdev) over the sampled requests; error rate and uptime spot estimate; HTTP status code breakdown; JSON schema consistency across responses; security header findings (HSTS, CSP, CORS, nosniff, cookie flags); TLS validity and certificate expiry details; a scored verdict (0–100, letter grade A–F) with a plain-English summary; and a prioritized list of issues with severity levels and concrete fix recommendations. Also includes payment confirmation details (tx hash, network, amount).","failureModes":["Target URL unreachable — audit is aborted and no charge is applied","Invalid URL format — request rejected with validation error","Target returns unexpected content-type — JSON consistency check skipped","TLS certificate lookup fails if CT log has no record — certificate section omitted","Rate limiting by target server causes elevated error rate in results","Idempotency key reuse with different inputs — may return previous report or conflict error"],"whenToPreferThis":"Choose this endpoint when you need a comprehensive, automated pre-launch or ongoing production-readiness check for a single public API endpoint, combining latency benchmarking, security header analysis, TLS validation, and CORS inspection in one report. It is ideal for developers and agents that want actionable, prioritized fixes rather than raw metrics. Prefer this over generic uptime monitors when security posture (HSTS, CORS, cookies) matters, and over manual curl-based testing when you need statistical latency percentiles from multiple samples.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-30T19:04:00.643Z","isFirstParty":false,"canonicalSlug":"devx-api-health-audit-0ed8cd2f"}