# the402.ai Security Header Scan

> the402.ai Security Header Scan is a paid API for AI agents from api.the402.ai, paid per call via x402, $0.105/call, status down (last checked 2026-09-15).

Purchases and runs a security header scan against a target domain, returning an analysis of HTTP security headers and their configurations.

## Facts

- Endpoint: POST https://api.the402.ai/v1/services/svc_dec55bab1af14b80/purchase
- Price: $0.105/call
- Payment: x402
- Status: down
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/api-the402-ai-1fd485bd
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_PPCX00Cj-bwF7JtwtNm1_

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability api-the402-ai-1fd485bd -d '<json body>'
```

Example prompt: Can you run a security header scan on https://mycompany.com and tell me which headers are missing or misconfigured?

## When to prefer this

Use this endpoint when you need a quick, paid-per-call security header audit of a specific URL or domain without setting up your own scanning infrastructure. Ideal for agents performing one-off compliance checks, security reviews, or pre-deployment audits. Prefer this over manual curl-based header inspection when you need structured, interpreted results rather than raw header values.

## Known failure modes

- Target URL is unreachable or returns a non-2xx status — scan may fail or return partial results
- Invalid or malformed URL provided — returns validation error
- Target domain blocks automated scanners — incomplete header data returned
- Payment of 0.105 USDC not successfully processed — purchase not completed
- Service timeout if target responds slowly

## How this service works

Purchase: Security Header Scan

## Output

A structured report detailing the HTTP security headers present or absent on the scanned domain, including assessments of headers like Content-Security-Policy, X-Frame-Options, Strict-Transport-Security, X-Content-Type-Options, and Referrer-Policy, along with recommendations or risk indicators for each.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "id"
 ],
 "properties": {
  "id": {
   "type": "string"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/api-the402-ai-1fd485bd/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.the402.ai](https://www.zero.xyz/host/api.the402.ai/llms.txt)