# Delx CSP Policy Audit

> Delx CSP Policy Audit is a paid API for AI agents from api.delx.ai, paid per call via x402, $0.002/call, status unknown (last checked 2026-09-13).

Audits a Content-Security-Policy header string for missing defaults and unsafe script directives, returning structured JSON findings.

## Facts

- Endpoint: POST https://api.delx.ai/api/v1/x402/csp-policy-audit
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/delx-csp-policy-audit-afc36736
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_gaWUWF8_sWYwFIWHUJebT

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability delx-csp-policy-audit-afc36736 -d '<json body>'
```

Example prompt: Can you audit this Content-Security-Policy for any missing defaults or unsafe script directives: "default-src 'self'; script-src 'unsafe-inline' https://cdn.example.com; style-src 'self'"?

## When to prefer this

Choose this endpoint when you need a deterministic, stateless, first-party CSP audit without calling any upstream provider — ideal as a preflight check in autonomous agent workflows before acting on untrusted input, deploying API changes, or evaluating production HTTP headers. It is inexpensive at $0.002 USDC and returns structured JSON suitable for programmatic consumption.

## Known failure modes

- Policy string exceeds 100,000 character limit — request rejected
- Malformed or empty policy string — validation error returned without charge
- Missing required 'policy' field in request body — error response
- Network timeout before response — retry may be needed

## How this service works

Audit a Content-Security-Policy for missing defaults and unsafe script directives. Use it before an autonomous workflow acts on untrusted input, changes an API, retries a request, or evaluates production reliability. Returns bounded machine-readable JSON for $0.002 USDC via x402 on Base. Execution is deterministic, first-party, local-only, stateless, and does not call an upstream provider; structured validation failures are not billed.

## Output

A bounded machine-readable JSON object listing any detected issues in the provided CSP, including missing directive defaults and unsafe script-related directives such as unsafe-inline or unsafe-eval. Structured validation failures are not billed.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "policy": {
   "type": "string",
   "maxLength": 100000
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "risk": "low",
  "schema": "delx/csp-policy-audit/v1",
  "findings": [],
  "directives": [
   "default-src",
   "script-src"
  ],
  "directive_count": 2
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/delx-csp-policy-audit-afc36736/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.delx.ai](https://www.zero.xyz/host/api.delx.ai/llms.txt)