# DevX API Health Audit (Quick Check)

> DevX API Health Audit (Quick Check) is a paid API for AI agents from apiaudit.madebydevx.com, paid per call via x402, $0.09/call, status unknown (last checked 2026-10-31).

Performs a 3-sample spot-check of a public API endpoint for $0.09 USDC, returning a grade (A–F), score, production-readiness verdict, latency stats, and the top 3 issues with concrete fixes.

## Facts

- Endpoint: POST https://apiaudit.madebydevx.com/v1/quick?utm_source=zero.xyz
- Price: $0.09/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/devx-api-health-audit-quick-check-9446c2d6
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_U1ZzCNKgJmUxhfgyfwSjB

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability devx-api-health-audit-quick-check-9446c2d6 -d '<json body>'
```

Example prompt: Can you do a quick health audit on https://api.myapp.com/v1/health using a GET request and tell me if it's production-ready, what grade it gets, and what the top issues are?

## When to prefer this

Choose this quick check when you need a fast, cheap ($0.09 USDC) spot-assessment of a single API endpoint before launch or integration — especially when you want an actionable letter grade and the top 3 concrete fixes without waiting for a comprehensive audit. Prefer the full /v1/audit endpoint ($9) when you need all findings, certificate expiry data, and 10-sample statistical confidence. This endpoint is ideal for automated pre-deployment gates, CI pipeline checks, or quickly vetting a third-party API.

## Known failure modes

- Unreachable or non-public target URL: not charged, returns an error indicating the endpoint could not be probed
- Invalid URL format or unsupported scheme: returns a 400-level validation error
- Target returns unexpected content type or malformed responses that cannot be assessed consistently
- Rate limiting or firewall on the target blocks the audit probes, resulting in partial or failed samples
- Idempotency key reuse with different inputs may return the cached report or an error depending on implementation

## How this service works

Full API Health Audit: give one public API endpoint URL (optional method, headers, body) and get a production-readiness report: latency min/median/p95 over 10 samples, error rate and uptime estimate, JSON schema consistency, security headers, CORS, TLS and cert expiry from CT logs, verdict with fixes. $9 USDC on Base; unreachable targets not charged. Cheaper first look: POST /v1/quick ($0.09: grade + top 3 issues). By DevX.

## Output

A JSON object containing: a verdict with letter grade (A–F), numeric score (0–100), production-ready boolean, and label; latency stats (median and p95 TTFB in ms); a list of up to 3 top issues each with a title, severity, and concrete fix recommendation; a reference to the full audit endpoint and its price; and payment metadata including transaction hash and operation ID.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "format": "uri",
   "maxLength": 2048,
   "description": "Public http(s) API endpoint to audit (only this URL is probed)"
  },
  "body": {
   "description": "Optional probe body for POST (string or JSON, max 16 KB)"
  },
  "method": {
   "enum": [
    "GET",
    "HEAD",
    "POST",
    "OPTIONS"
   ],
   "type": "string",
   "description": "Probe method (default GET). POST is sent once per sample."
  },
  "headers": {
   "type": "object",
   "description": "Optional request headers (e.g. authorization) used only for the probe; never stored or echoed",
   "additionalProperties": {
    "type": "string",
    "maxLength": 1024
   }
  },
  "requestKey": {
   "type": "string",
   "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$",
   "maxLength": 128,
   "minLength": 8,
   "description": "Optional idempotency key: same payer + requestKey + input within 7 days returns the stored report without a second charge."
  },
  "expect_status": {
   "type": "integer",
   "maximum": 599,
   "minimum": 100,
   "description": "Status code that counts as success (default: any status < 400)"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "result": {
   "tier": "quick",
   "verdict": {
    "grade": "C",
    "label": "needs work before production",
    "score": 70,
    "production_ready": false
   },
   "latency_ms": {
    "ttfb_p95": 12,
    "ttfb_median": 5
   },
   "top_issues": [
    {
     "fix": "Add: Strict-Transport-Security: max-age=31536000; includeSubDomains",
     "title": "No HSTS header",
     "severity": "medium"
    },
    {
     "fix": "Allow-list trusted origins; never reflect the Origin header when credentials are allowed.",
     "title": "CORS reflects any Origin with credentials",
     "severity": "medium"
    },
    {
     "fix": "Redirect (301/308) or reject (403/426) plain HTTP; combine with HSTS.",
     "title": "Plain HTTP is served, not redirected",
     "severity": "medium"
    }
   ],
   "full_report": {
    "url": "/v1/audit",
    "price_usd": "9.00"
   }
  },
  "status": "paid",
  "payment": {
   "status": "paid",
   "network": "eip155:8453",
   "tx_hash": "0x0000000000000000000000000000000000000000000000000000000000000000",
   "amount_raw": "90000"
  },
  "operation_id": "5d0c7a3e-1f2b-4c6d-8e9f-0a1b2c3d4e5f"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/devx-api-health-audit-quick-check-9446c2d6/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from apiaudit.madebydevx.com](https://www.zero.xyz/host/apiaudit.madebydevx.com/llms.txt)