# DevX API Health Audit

> DevX API Health Audit is a paid API for AI agents from apiaudit.madebydevx.com, paid per call via x402, $0.09/call, status unknown (last checked 2026-10-30).

Runs a production-readiness audit on a public API endpoint, measuring latency, uptime, security headers, TLS, CORS, and JSON schema consistency for $9 USDC per run.

## Facts

- Endpoint: POST https://apiaudit.madebydevx.com/v1/audit?utm_source=zero.xyz
- Price: $0.09/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-30
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/devx-api-health-audit-0ed8cd2f
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_XkwUz7DznrGZWUFe5kzS3

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability devx-api-health-audit-0ed8cd2f -d '<json body>'
```

Example prompt: Can you run a production-readiness audit on https://api.myapp.com/v1/users using GET with 10 samples and tell me if it's safe to launch — I want to see latency percentiles, security header issues, and any TLS problems?

## When to prefer this

Choose this endpoint when you need a comprehensive, automated pre-launch or ongoing production-readiness check for a single public API endpoint, combining latency benchmarking, security header analysis, TLS validation, and CORS inspection in one report. It is ideal for developers and agents that want actionable, prioritized fixes rather than raw metrics. Prefer this over generic uptime monitors when security posture (HSTS, CORS, cookies) matters, and over manual curl-based testing when you need statistical latency percentiles from multiple samples.

## Known failure modes

- Target URL unreachable — audit is aborted and no charge is applied
- Invalid URL format — request rejected with validation error
- Target returns unexpected content-type — JSON consistency check skipped
- TLS certificate lookup fails if CT log has no record — certificate section omitted
- Rate limiting by target server causes elevated error rate in results
- Idempotency key reuse with different inputs — may return previous report or conflict error

## How this service works

Full API Health Audit: give one public API endpoint URL (optional method, headers, body) and get a production-readiness report: latency min/median/p95 over 10 samples, error rate and uptime estimate, JSON schema consistency, security headers, CORS, TLS and cert expiry from CT logs, verdict with fixes. $9 USDC on Base; unreachable targets not charged. Cheaper first look: POST /v1/quick ($0.09: grade + top 3 issues). By DevX.

## Output

A structured JSON report containing: latency stats (min, median, p95, max, stdev) over the sampled requests; error rate and uptime spot estimate; HTTP status code breakdown; JSON schema consistency across responses; security header findings (HSTS, CSP, CORS, nosniff, cookie flags); TLS validity and certificate expiry details; a scored verdict (0–100, letter grade A–F) with a plain-English summary; and a prioritized list of issues with severity levels and concrete fix recommendations. Also includes payment confirmation details (tx hash, network, amount).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "format": "uri",
   "maxLength": 2048,
   "description": "Public http(s) API endpoint to audit (only this URL is probed)"
  },
  "body": {
   "description": "Optional probe body for POST (string or JSON, max 16 KB)"
  },
  "method": {
   "enum": [
    "GET",
    "HEAD",
    "POST",
    "OPTIONS"
   ],
   "type": "string",
   "description": "Probe method (default GET). POST is sent once per sample."
  },
  "headers": {
   "type": "object",
   "description": "Optional request headers (e.g. authorization) used only for the probe; never stored or echoed",
   "additionalProperties": {
    "type": "string",
    "maxLength": 1024
   }
  },
  "requestKey": {
   "type": "string",
   "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$",
   "maxLength": 128,
   "minLength": 8,
   "description": "Optional idempotency key: same payer + requestKey + input within 7 days returns the stored report without a second charge."
  },
  "expect_status": {
   "type": "integer",
   "maximum": 599,
   "minimum": 100,
   "description": "Status code that counts as success (default: any status < 400)"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "result": {
   "tier": "quick",
   "verdict": {
    "grade": "C",
    "label": "needs work before production",
    "score": 70,
    "production_ready": false
   },
   "latency_ms": {
    "ttfb_p95": 12,
    "ttfb_median": 5
   },
   "top_issues": [
    {
     "fix": "Add: Strict-Transport-Security: max-age=31536000; includeSubDomains",
     "title": "No HSTS header",
     "severity": "medium"
    },
    {
     "fix": "Allow-list trusted origins; never reflect the Origin header when credentials are allowed.",
     "title": "CORS reflects any Origin with credentials",
     "severity": "medium"
    },
    {
     "fix": "Redirect (301/308) or reject (403/426) plain HTTP; combine with HSTS.",
     "title": "Plain HTTP is served, not redirected",
     "severity": "medium"
    }
   ],
   "full_report": {
    "url": "/v1/audit",
    "price_usd": "9.00"
   }
  },
  "status": "paid",
  "payment": {
   "status": "paid",
   "network": "eip155:8453",
   "tx_hash": "0x0000000000000000000000000000000000000000000000000000000000000000",
   "amount_raw": "90000"
  },
  "operation_id": "5d0c7a3e-1f2b-4c6d-8e9f-0a1b2c3d4e5f"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/devx-api-health-audit-0ed8cd2f/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from apiaudit.madebydevx.com](https://www.zero.xyz/host/apiaudit.madebydevx.com/llms.txt)