# apiacre.com Web Security Audit

> apiacre.com Web Security Audit is a paid API for AI agents from apiacre.com, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-13).

Scans a public website for TLS and browser security header weaknesses and returns a security score with remediation recommendations.

## Facts

- Endpoint: POST https://apiacre.com/v1/web/security-audit
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/apiacre-com-web-security-audit-866b6cad
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_EE18DD409mOfm-M8Oiu_K

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability apiacre-com-web-security-audit-866b6cad -d '<json body>'
```

Example prompt: Can you run a security audit on https://example.com and tell me what TLS issues or missing browser security headers it has, along with a security score and how to fix the problems?

## When to prefer this

Use this endpoint when you need a quick, automated TLS and HTTP security header audit for any publicly reachable website, especially when you want actionable fix recommendations alongside a scored assessment. Prefer this over manual tools like SSL Labs or securityheaders.com when you need to integrate security auditing into an automated workflow or agent pipeline.

## Known failure modes

- Non-public or unreachable URL returns an error indicating the site could not be scanned
- Invalid or malformed URL causes a validation error
- Private/intranet URLs are rejected as they are not publicly accessible
- Timeout if the target site is too slow to respond
- Rate limiting or blocking by the target site may cause incomplete results

## How this service works

Scan a public website for TLS and browser security header weaknesses and return a security score with fixes.

## Output

Returns a security score (numeric or graded), a list of detected TLS vulnerabilities, identified missing or misconfigured browser security headers (e.g. HSTS, CSP, X-Frame-Options), and specific remediation steps for each issue found.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "title": "Url",
   "format": "uri",
   "maxLength": 2083,
   "minLength": 1
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {
   "url": "https://example.com/",
   "score": 0,
   "missing": [
    {
     "header": "strict-transport-security",
     "purpose": "HSTS"
    },
    {
     "header": "content-security-policy",
     "purpose": "CSP"
    },
    {
     "header": "x-content-type-options",
     "purpose": "MIME sniffing protection"
    },
    {
     "header": "referrer-policy",
     "purpose": "Referrer policy"
    },
    {
     "header": "permissions-policy",
     "purpose": "Permissions policy"
    },
    {
     "header": "cross-origin-opener-policy",
     "purpose": "Cross-origin isolation"
    }
   ],
   "present": {},
   "cookieFlags": {
    "secure": false,
    "httpOnly": false,
    "sameSite": false
   }
  },
  "meta": {
   "cached": false,
   "sources": [],
   "warnings": [],
   "duration_ms": 42,
   "next_actions": []
  },
  "service": "web.security-audit",
  "version": "1",
  "request_id": "018f1f54-7f38-7ba2-8dc3-5f90272d9f1a"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/apiacre-com-web-security-audit-866b6cad/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from apiacre.com](https://www.zero.xyz/host/apiacre.com/llms.txt)