{"uid":"cap_zihXQm4uCjwpCyalfXzjG","slug":"security-headers-audit-api-640c3c8b","name":"Security Headers Audit API","description":"URL-to-clean-markdown extraction API, on-demand broken-link scan API, pre-deploy link audit API, DNS health audit API, llms.txt / AI-crawler audit API, spec-linted llms.txt audit API, email-deliverability (SPF/DKIM/DMARC) audit API, PDF-to-markdown conversion API, technology-stack fingerprinting API, security-headers audit API, and PDF metadata-intel API for coding agents. Paid per call in USDC via x402 on Base.","url":"https://x402-extract-service.onrender.com/headers","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"url":{"type":"string","format":"uri","description":"Public http(s) URL whose response security headers to audit."}}},"responseSchema":{"type":"json","example":{"ok":true,"url":"https://example.com/","grade":"B","score":85,"checks":[{"value":"max-age=63072000; includeSubDomains; preload","detail":"long max-age with includeSubDomains and preload","header":"strict-transport-security","verdict":"pass"},{"value":null,"detail":"header missing: no XSS/data-injection containment","header":"content-security-policy","verdict":"fail","remediation":"Deploy a Content-Security-Policy, e.g. default-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'."}],"counts":{"fail":1,"pass":8,"warn":2,"total":11},"summary":"8/11 pass, 2 warning(s), 1 failure(s) — grade B","finalUrl":"https://example.com/","checkedAt":"2026-09-15T00:00:00.000Z","pricePaidAtomic":"20000"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_aK72VCzHjzKPwqPkhhqLO","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Audits HTTP security headers for a given URL, returning a grade, score, per-header pass/warn/fail verdicts, and remediation advice.","exampleAgentPrompt":"Can you audit the security headers for https://mycompany.com and tell me which ones are missing or misconfigured, along with a grade and specific remediation steps?","exampleUseCases":[{"title":"Pre-launch security header check","prompt":"Before we go live with our new site at https://staging.acmecorp.com, can you audit its security headers and tell me what's failing or missing so we can fix it before launch?"},{"title":"Continuous monitoring of header regressions","prompt":"Run a security headers audit on https://dashboard.myapp.io and let me know if anything has changed or degraded — especially CSP, HSTS, and X-Frame-Options."},{"title":"Vendor security due diligence","prompt":"I need to assess the HTTP security posture of https://thirdpartyapi.com — can you check their security headers, give me a grade, and flag any serious gaps I should raise with them?"}],"resultDescription":"Returns a JSON object with: overall letter grade (e.g. A–F), numeric score (0–100), a list of per-header check results each with header name, current value, verdict (pass/warn/fail), detail explanation, and remediation guidance for failures. Also includes aggregate counts of passes/warnings/failures, a human-readable summary, the final resolved URL, and the timestamp of the check.","failureModes":["Invalid or unreachable URL returns an error response","Private/internal URLs (localhost, RFC-1918) may be blocked or return no data","Redirect chains may resolve to an unexpected final URL affecting results","Sites with bot-blocking may return incomplete or misleading header data","Payment failure via x402 results in 402 response and no audit data"],"whenToPreferThis":"Choose this endpoint when you need a structured, graded audit of HTTP security headers for any public URL — especially useful for pre-deploy checks, security reviews, vendor assessments, or automated monitoring pipelines. It provides actionable remediation advice per header, making it more useful than raw curl header dumps or generic scanner tools. Paid per call via USDC/x402 on Base, so ideal for agent workflows that need programmatic, on-demand audits without a subscription.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-19T12:33:05.116Z","isFirstParty":false}