# CSP Source Check

> CSP Source Check is a paid API for AI agents from api.delx.ai, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-14).

Checks whether a caller-supplied source is present in a specified CSP directive, returning a deterministic pass/advisory finding as versioned JSON.

## Facts

- Endpoint: POST https://api.delx.ai/api/v1/x402/csp-source-check
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/csp-source-check-1357b30a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_YWGcyxoBM89PcxcUKrfWV

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability csp-source-check-1357b30a -d '<json body>'
```

Example prompt: Check whether the source 'https://cdn.example.com' is allowed under the 'script-src' directive in this CSP header: 'Content-Security-Policy: script-src https://cdn.example.com https://apis.google.com; default-src self'

## When to prefer this

Use this endpoint when an agent needs a deterministic, stateless, pay-per-call validation of whether a specific source URL or value is covered by a particular CSP directive before accepting, caching, redirecting, or retrying a web response. Prefer this over custom regex or in-agent logic when you need a versioned, auditable finding with explicit pass/advisory semantics and no state retention.

## Known failure modes

- Malformed CSP header string may result in a parsing error or advisory status
- Empty or missing source/directive fields may return an error or undefined finding
- Source not found in directive returns advisory status rather than hard failure
- Oversized inputs exceeding 8192 characters may be rejected
- Ambiguous directive names may fail to match the intended CSP policy field

## How this service works

CSP Source Check: CSP Source Check checks whether a caller-supplied source is present in one CSP directive from bounded caller-supplied values without an external provider. Call CSP Source Check before accepting, caching, redirecting, or retrying a caller-supplied web response. Returns normalized web evidence, the computed finding, and an explicit pass or advisory status for CSP Source Check as versioned deterministic JSON. Price: $0.001 USDC via x402 on Base. First-party, stateless, memory-onl…

## Output

A versioned deterministic JSON object containing: normalized web evidence (the parsed CSP header and directive), the computed finding (whether the source matched), and an explicit pass or advisory status indicating whether the supplied source is present in the specified CSP directive.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "header": {
   "type": "string",
   "maxLength": 8192,
   "description": "Header supplied to CSP Source Check; used only for this bounded calculation and processed in memory without retention."
  },
  "source": {
   "type": "string",
   "maxLength": 8192,
   "description": "Source supplied to CSP Source Check; used only for this bounded calculation and processed in memory without retention."
  },
  "directive": {
   "type": "string",
   "maxLength": 8192,
   "description": "Directive supplied to CSP Source Check; used only for this bounded calculation and processed in memory without retention."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "result": {
   "source": "https://api.example.com",
   "present": true,
   "sources": [
    "'self'",
    "https://api.example.com"
   ],
   "directive": "connect-src"
  },
  "schema": "delx/util-csp-source-check/v1",
  "status": "pass",
  "evidence": {
   "retained": false,
   "input_sha256": "28ce2f05a29beab331ef11c94ccca09b3de52f20fc1aaf0a876da89ecbba12bd",
   "external_calls": 0
  },
  "operation": "web_reliability:csp_source_check"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/csp-source-check-1357b30a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.delx.ai](https://www.zero.xyz/host/api.delx.ai/llms.txt)