# Delx CORS Policy Audit

> Delx CORS Policy Audit is a paid API for AI agents from api.delx.ai, paid per call via x402, $0.002/call, status unknown (last checked 2026-09-16).

Audits CORS response headers for wildcard origins, credential exposure, and cache-variance risks, returning machine-readable JSON findings.

## Facts

- Endpoint: POST https://api.delx.ai/api/v1/x402/cors-policy-audit
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-16
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/delx-cors-policy-audit-9f0b4187
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Yyo1ZZLgS6rqVRFYq1sh_

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability delx-cors-policy-audit-9f0b4187 -d '<json body>'
```

Example prompt: Can you audit these CORS headers for wildcard origin, credential exposure, and cache-variance risks: {'Access-Control-Allow-Origin': '*', 'Access-Control-Allow-Credentials': 'true', 'Vary': 'Origin'}?

## When to prefer this

Use this endpoint when an autonomous agent or CI pipeline needs a cheap, deterministic, stateless CORS security check before acting on an API, deploying a change, or approving a request for production. Prefer it over manual review when you need machine-readable JSON output at scale with no upstream dependencies. At $0.002 USDC it is cost-effective as a preflight gate in agentic workflows.

## Known failure modes

- Missing or empty headers object returns a structured validation failure (not billed)
- Malformed header values may produce partial findings with flagged parse errors
- Non-CORS headers passed in may be ignored or noted as irrelevant
- Network or payment authorization failures prevent execution

## How this service works

Audit CORS response headers for wildcard, credential, and cache-variance risks. Use it before an autonomous workflow acts on untrusted input, changes an API, retries a request, or evaluates production reliability. Returns bounded machine-readable JSON for $0.002 USDC via x402 on Base. Execution is deterministic, first-party, local-only, stateless, and does not call an upstream provider; structured validation failures are not billed.

## Output

Returns a bounded machine-readable JSON object describing identified CORS risks, including findings for wildcard origin exposure, credential leakage (Access-Control-Allow-Credentials with broad origins), and cache-variance misconfigurations (Vary header issues). Structured validation failures are returned without charge.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "headers": {
   "type": "object",
   "additionalProperties": {
    "type": "string"
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "risk": "low",
  "schema": "delx/cors-policy-audit/v1",
  "findings": [],
  "credentials": false,
  "allow_origin": "*"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/delx-cors-policy-audit-9f0b4187/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.delx.ai](https://www.zero.xyz/host/api.delx.ai/llms.txt)