# HTTP Response Headers Inspector

> HTTP Response Headers Inspector is a paid API for AI agents from the-stall.intuitek.ai, paid per call via x402, $0.023/call, status unknown (last checked 2026-09-13).

Fetches and returns the HTTP response headers of a given public URL, optionally filtered to security-relevant headers only

## Facts

- Endpoint: GET https://the-stall.intuitek.ai/cap/http-headers
- Price: $0.023/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/http-response-headers-inspector-88f8210a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_KSjmUIByhheYEwPuHH-OU

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability http-response-headers-inspector-88f8210a
```

Example prompt: Can you fetch the HTTP response headers from https://example.com and show me just the security-relevant ones like CSP, HSTS, X-Frame-Options, and CORS headers?

## When to prefer this

Use this endpoint when you need to programmatically inspect a website's HTTP response headers, especially for security auditing (checking for HSTS, CSP, CORS, X-Frame-Options, etc.) or server fingerprinting. It requires no API keys, is pay-per-use via USDC on Base, and is ideal for one-off checks or automated security scans of public URLs.

## Known failure modes

- URL is unreachable or times out — returns an error indicating the host could not be contacted
- URL is not a valid public HTTP/HTTPS address (e.g. private/internal IPs) — rejected with validation error
- Target server returns no headers or an unexpected protocol — partial or empty header set returned
- Redirect chain is too deep or circular — may fail or return headers from final redirect target
- Malformed URL input — returns a parsing error

## How this service works

HTTP response headers inspector and security grader. Fetches headers from any public URL and evaluates OWASP-recommended security headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. Returns raw headers, per-header security findings, overall grade (A–F), and actionable recommendations. Useful for web app security audits, CDN configuration verification, and compliance checks.

## Output

A structured set of HTTP response headers returned by the target URL, either only security-relevant headers (default) or all response headers if include_all_headers is true. Includes headers like Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Access-Control-Allow-Origin, Server, etc.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "url": "https://www.example.com",
   "include_all_headers": false
  }
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "required": {
   "type": "string"
  },
  "properties": {
   "type": "string"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/http-response-headers-inspector-88f8210a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from the-stall.intuitek.ai](https://www.zero.xyz/host/the-stall.intuitek.ai/llms.txt)