# fetchx402 HTTP Response Headers Inspector

> fetchx402 HTTP Response Headers Inspector is a paid API for AI agents from api.fetchx402.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-09-15).

Fetches live allowlisted HTTPS response headers (HSTS, CSP, server, CORS) for a public domain by issuing a real HEAD or GET request to port 443, without following redirects.

## Facts

- Endpoint: GET https://api.fetchx402.com/v1/tools/headers
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/fetchx402-http-response-headers-inspector-f34894f2
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ugGyoBfyyX7EtL1Y0D-mI

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability fetchx402-http-response-headers-inspector-f34894f2
```

Example prompt: Can you check what security headers stripe.com actually returns right now — specifically whether they have HSTS, a Content-Security-Policy, and what the Server header says?

## When to prefer this

Use this endpoint when you need the live, real HTTP headers an origin currently serves and cannot rely on cached or guessed values. Prefer it for security audits, verifying HSTS or CSP configuration, checking CORS policy before API integration, or fingerprinting server software. It is the right choice over generic HTTP clients when you need a pay-per-use, agent-friendly fetch that enforces HTTPS on port 443 and rejects internal/private hostnames.

## Known failure modes

- Domain is an IP address, localhost, or internal/mDNS name — rejected with an error
- Origin returns 4xx/5xx HTTP status — headers may still be returned but content may be empty
- HEAD returns 405/501 — endpoint falls back to GET automatically
- Domain does not resolve in DNS — connection error returned
- TLS handshake failure — no headers returned
- Redirect encountered — not followed, only the initial response headers are returned

## How this service works

Read allowlisted HTTPS response headers for a hostname (HSTS, CSP, server, CORS). Use when you need live origin headers and must not guess. HEAD of https://{domain}/ on :443; GET if HEAD is 405/501. Redirects are not followed.

## Output

A map of allowlisted HTTP response headers returned by the origin for the given domain, including security-relevant headers such as Strict-Transport-Security, Content-Security-Policy, Access-Control-Allow-Origin, X-Frame-Options, and Server. The response reflects a live HEAD (or GET if HEAD is rejected) to port 443 without redirect following.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "headers": {
     "type": "object",
     "additionalProperties": {
      "type": "string"
     }
    },
    "queryParams": {
     "type": "object",
     "required": [
      "domain"
     ],
     "properties": {
      "domain": {
       "type": "string",
       "description": "Public fully-qualified domain name to fetch, such as example.com. We HEAD https://{domain}/ on :443 (GET if HEAD is 405/501). IPs, localhost, and internal/mDNS names are rejected. Redirects are not followed."
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "url": "https://example.com/",
  "domain": "example.com",
  "method": "HEAD",
  "status": 200,
  "headers": {
   "server": "ECS (nyb/1D2A)",
   "location": null,
   "content-type": "text/html",
   "x-powered-by": null,
   "cache-control": "max-age=604800",
   "referrer-policy": null,
   "x-frame-options": null,
   "www-authenticate": null,
   "permissions-policy": null,
   "x-content-type-options": null,
   "content-security-policy": null,
   "strict-transport-security": "max-age=31536000",
   "cross-origin-opener-policy": null,
   "access-control-allow-origin": null,
   "cross-origin-resource-policy": null,
   "content-security-policy-report-only": null
  },
  "peer_ip": "23.215.0.138"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/fetchx402-http-response-headers-inspector-f34894f2/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.fetchx402.com](https://www.zero.xyz/host/api.fetchx402.com/llms.txt)