# HTTP Header Diff

> HTTP Header Diff is a paid API for AI agents from api.delx.ai, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-15).

Compares two HTTP header maps case-insensitively, redacting sensitive values, and returns a structured diff of added, removed, and changed headers.

## Facts

- Endpoint: POST https://api.delx.ai/api/v1/x402/http-header-diff
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/http-header-diff-bd6d32a7
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_JnS8AE9fgMRI8dVVUZgq1

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability http-header-diff-bd6d32a7 -d '<json body>'
```

Example prompt: Compare these two HTTP header sets for me — the before set has 'Content-Type: application/json' and 'Authorization: Bearer abc123', and the after set adds 'X-Frame-Options: DENY' and drops 'Authorization' — tell me what changed, and make sure sensitive values like Authorization are redacted in the output.

## When to prefer this

Choose this endpoint when you need a fast, deterministic, security-aware diff of two HTTP header snapshots without fetching any URLs or retaining data. It is ideal for detecting configuration drift post-deployment, auditing header changes after TLS or proxy reconfiguration, or any workflow where sensitive header values must be automatically redacted before logging or reporting. Prefer it over general-purpose diff tools when HTTP-specific case-insensitive comparison and built-in redaction of auth and cookie headers are required.

## Known failure modes

- Input exceeds 200 properties per header map — request rejected
- Malformed JSON body — returns parse error
- Missing both before and after fields — returns validation error
- Payment not provided or insufficient — x402 payment required response
- Header values that are not strings may cause type errors

## How this service works

Compare two caller-supplied HTTP header maps case-insensitively while redacting Authorization, Cookie, Set-Cookie, and Proxy-Authorization values. Use after header or TLS inspection to identify configuration drift and security-sensitive changes. Returns bounded deterministic JSON for 0.001 USDC via x402 on Base; no URL fetch or retention.

## Output

A bounded deterministic JSON object listing headers that were added, removed, or modified between the before and after maps, with values for Authorization, Cookie, Set-Cookie, and Proxy-Authorization replaced by redacted placeholders. The result is case-insensitive and contains no fetched or retained data.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "after": {
   "type": "object",
   "maxProperties": 200
  },
  "before": {
   "type": "object",
   "maxProperties": 200
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "added": [],
  "schema": "delx/util-http-header-diff/v1",
  "changed": [
   {
    "name": "strict-transport-security",
    "after": "max-age=31536000",
    "before": "max-age=60"
   }
  ],
  "removed": [],
  "unchanged_count": 1,
  "credential_values_redacted": true,
  "security_sensitive_changes": [
   "strict-transport-security"
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/http-header-diff-bd6d32a7/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.delx.ai](https://www.zero.xyz/host/api.delx.ai/llms.txt)