# Security Header Audit API

> Security Header Audit API is a paid API for AI agents from domain.hugen.tokyo, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-14).

Checks a domain's HTTP security headers across 10 vectors and assigns an A-F security grade with information leakage detection

## Facts

- Endpoint: GET https://domain.hugen.tokyo/domain/headers
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/domain-hugen-tokyo-ea0b5cdd
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_3SMb9f4PZE1YHQCo2OYgv

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability domain-hugen-tokyo-ea0b5cdd
```

Example prompt: Can you run a full security header audit on example.com and tell me the grade it gets — especially whether it has CSP, HSTS, and X-Frame-Options set, and if the server is leaking any technology info?

## When to prefer this

Use this endpoint when you need a fast, structured audit of a single domain's HTTP security posture with a letter grade. It is ideal for security compliance checks, pre-launch audits, or monitoring header regressions. Prefer it over manual curl-based checks or full-stack scanners when you specifically want header analysis with grading and information leakage detection in a single lightweight API call.

## Known failure modes

- Domain does not exist or is unreachable — returns error or partial result
- Domain blocks external HTTP requests — headers may not be retrievable
- Payment not processed — 402 response requiring USDC payment on Base or Solana
- Invalid domain format — request rejected
- Timeout on slow-responding domain — partial or empty header results

## How this service works

Security header audit — 10 headers checked: CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, CORP, COEP, COOP. Information leakage detection via Server/X-Powered-By headers. A-F security grade. Accepts USDC payments on Base and Solana

## Output

Returns the status of 10 security headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, CORP, COEP, COOP), information leakage findings from Server and X-Powered-By headers, and an overall A-F security grade for the domain.

## Example request

```json
{
 "domain": "example.com"
}
```

## Request schema (JSON Schema)

```json
{
 "properties": {
  "input": {
   "required": [
    "method"
   ]
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/domain-hugen-tokyo-ea0b5cdd/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from domain.hugen.tokyo](https://www.zero.xyz/host/domain.hugen.tokyo/llms.txt)