{"uid":"cap_ugGyoBfyyX7EtL1Y0D-mI","slug":"fetchx402-http-response-headers-inspector-f34894f2","name":"fetchx402 HTTP Response Headers Inspector","description":"Read allowlisted HTTPS response headers for a hostname (HSTS, CSP, server, CORS). Use when you need live origin headers and must not guess. HEAD of https://{domain}/ on :443; GET if HEAD is 405/501. Redirects are not followed.","url":"https://api.fetchx402.com/v1/tools/headers","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"headers":{"type":"object","additionalProperties":{"type":"string"}},"queryParams":{"type":"object","required":["domain"],"properties":{"domain":{"type":"string","description":"Public fully-qualified domain name to fetch, such as example.com. We HEAD https://{domain}/ on :443 (GET if HEAD is 405/501). IPs, localhost, and internal/mDNS names are rejected. Redirects are not followed."}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"url":"https://example.com/","domain":"example.com","method":"HEAD","status":200,"headers":{"server":"ECS (nyb/1D2A)","location":null,"content-type":"text/html","x-powered-by":null,"cache-control":"max-age=604800","referrer-policy":null,"x-frame-options":null,"www-authenticate":null,"permissions-policy":null,"x-content-type-options":null,"content-security-policy":null,"strict-transport-security":"max-age=31536000","cross-origin-opener-policy":null,"access-control-allow-origin":null,"cross-origin-resource-policy":null,"content-security-policy-report-only":null},"peer_ip":"23.215.0.138"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_jvvF-tk6CBLhLLF_RfXAw","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Fetches live allowlisted HTTPS response headers (HSTS, CSP, server, CORS) for a public domain by issuing a real HEAD or GET request to port 443, without following redirects.","exampleAgentPrompt":"Can you check what security headers stripe.com actually returns right now — specifically whether they have HSTS, a Content-Security-Policy, and what the Server header says?","exampleUseCases":[{"title":"Security audit of a competitor's headers","prompt":"Can you look up what HTTP security headers shopify.com is sending — I want to know if they have HSTS, CSP, and CORS configured?"},{"title":"Verifying CORS policy before integration","prompt":"Before I wire up my frontend to api.github.com, can you check what CORS headers their origin actually returns so I know what origins they allow?"},{"title":"Server fingerprinting for reconnaissance","prompt":"What does the Server header say for cloudflare.com right now — are they hiding their stack or exposing it?"}],"resultDescription":"A map of allowlisted HTTP response headers returned by the origin for the given domain, including security-relevant headers such as Strict-Transport-Security, Content-Security-Policy, Access-Control-Allow-Origin, X-Frame-Options, and Server. The response reflects a live HEAD (or GET if HEAD is rejected) to port 443 without redirect following.","failureModes":["Domain is an IP address, localhost, or internal/mDNS name — rejected with an error","Origin returns 4xx/5xx HTTP status — headers may still be returned but content may be empty","HEAD returns 405/501 — endpoint falls back to GET automatically","Domain does not resolve in DNS — connection error returned","TLS handshake failure — no headers returned","Redirect encountered — not followed, only the initial response headers are returned"],"whenToPreferThis":"Use this endpoint when you need the live, real HTTP headers an origin currently serves and cannot rely on cached or guessed values. Prefer it for security audits, verifying HSTS or CSP configuration, checking CORS policy before API integration, or fingerprinting server software. It is the right choice over generic HTTP clients when you need a pay-per-use, agent-friendly fetch that enforces HTTPS on port 443 and rejects internal/private hostnames.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T00:34:51.284Z","isFirstParty":false}