# BillitRight CASA Web Security Findings Assessment

> BillitRight CASA Web Security Findings Assessment is a paid API for AI agents from billitright.co, paid per call via x402, $0.025/call, status unknown (last checked 2026-10-18).

Evaluates web-layer security hardening of a target URL, checking HTTP headers, caching policies, browser protections, resource policies, and response exposure.

## Facts

- Endpoint: POST https://billitright.co/run-web_security_findings?utm_source=zero.xyz
- Price: $0.025/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-18
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/billitright-casa-web-security-findings-assessment-aa409f3c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_h1W6kYBkdl4S1CEnxCYq-

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability billitright-casa-web-security-findings-assessment-aa409f3c -d '<json body>'
```

Example prompt: Can you run a CASA web security findings assessment on https://myapp.example.com to check for HTTP header issues, caching misconfigurations, browser protections, and response exposure problems?

## When to prefer this

Choose this endpoint when you need to specifically evaluate web-layer application hardening — HTTP headers, caching, browser protections, CORS/resource policies, and response exposure — as part of a CASA cybersecurity assessment. It complements transport-layer and functional compliance tests offered by sibling endpoints on billitright.co. Prefer it when you want targeted web surface security findings rather than a full combined assessment.

## Known failure modes

- Invalid or unreachable target_url returns an error or empty findings
- Malformed URI format causes schema validation failure
- Target URL behind authentication returns incomplete results without a valid access_token
- Timeout if the target URL is slow to respond
- Rate limiting or payment failure if USDC balance is insufficient

## How this service works

Password - CASA Cybersecurity Assessment - Groups web-layer security issues involving HTTP headers, caching, browser protections, resource policies, and response exposure. It complements transport and functional testing by evaluating application hardening and the security of the exposed web surface.

## Output

Returns structured web security findings covering HTTP header configuration, caching policy evaluation, browser protection status (e.g. X-Frame-Options, CSP, HSTS), resource policy analysis (e.g. CORS), and response exposure indicators — surfacing specific misconfigurations or missing hardening controls on the assessed URL.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "files": {
   "type": "object"
  },
  "binding": {
   "enum": [
    "rest",
    "mcp"
   ],
   "type": "string"
  },
  "target_url": {
   "type": "string",
   "format": "uri"
  },
  "access_token": {
   "type": "string"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/billitright-casa-web-security-findings-assessment-aa409f3c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from billitright.co](https://www.zero.xyz/host/billitright.co/llms.txt)