# Saylor Innovations HTTP Security Header Auditor

> Saylor Innovations HTTP Security Header Auditor is a paid API for AI agents from saylorinnovations.com, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-13).

Audits HTTP security headers for any public URL and returns a letter grade, numeric score, and per-header findings covering HSTS, CSP, clickjacking protection, referrer policy, and cookies

## Facts

- Endpoint: GET https://saylorinnovations.com/api/audit/headers?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/saylor-innovations-http-security-header-auditor-52db4b15
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap__Jezi2UL17YDjB36M8B5U

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability saylor-innovations-http-security-header-auditor-52db4b15
```

Example prompt: Can you run a security header audit on https://example.com and tell me the letter grade, score, and which headers are failing or missing?

## When to prefer this

Use this endpoint when you need a quick, structured HTTP security header assessment of a public URL with machine-readable per-header findings and an actionable letter grade. It is ideal for automated security compliance checks, pre-launch audits, or continuous monitoring workflows. Prefer it over generic web scanners when you specifically need header-level detail (HSTS, CSP, clickjacking, referrer policy, cookie flags) returned as structured JSON rather than an HTML report.

## Known failure modes

- Private, loopback, or link-local IP addresses are refused
- Malformed or non-HTTP/HTTPS URLs are rejected by pattern validation
- Unreachable or offline URLs may return an error or incomplete findings
- Rate-limit or network timeouts on slow external servers
- Redirect chains that exceed a limit may be truncated

## How this service works

HTTP security header audit for any URL - HSTS, CSP, clickjacking, referrer policy, cookies and a letter grade

## Output

A JSON object containing the final audited URL, a letter grade (A–F), a numeric score (0–100), a boolean HTTPS flag, a summary of passing/warning/failing check counts, and an array of per-header findings — each with the header name, observed detail, pass/warn/fail/info status, and a recommended fix value where applicable. Also includes redirect count, HTTP status code, and timestamp.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "POST",
      "PUT",
      "PATCH",
      "DELETE",
      "HEAD"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "url"
     ],
     "properties": {
      "url": {
       "type": "string",
       "pattern": "^(https?://)?[A-Za-z0-9.-]+\\.[A-Za-z]{2,}.*$",
       "examples": [
        "https://example.com",
        "github.com"
       ],
       "maxLength": 2000,
       "description": "Public http(s) URL or bare domain to audit; private, loopback and link-local addresses are refused"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "json"
    },
    "example": {
     "type": "object",
     "required": [
      "url",
      "grade",
      "score",
      "findings"
     ],
     "properties": {
      "url": {
       "type": "string",
       "description": "Final URL after redirects that was audited"
      },
      "grade": {
       "type": "string",
       "description": "Letter grade A to F"
      },
      "https": {
       "type": "boolean",
       "description": "True when the final URL is HTTPS"
      },
      "scope": {
       "type": [
        "string",
        "null"
       ],
       "description": "Scope the result covers"
      },
      "score": {
       "type": "number",
       "description": "Score from 0 to 100 (penalties per missing or weak header)"
      },
      "summary": {
       "type": "object",
       "description": "Counts of failing, warning and passing checks"
      },
      "findings": {
       "type": "array",
       "items": {
        "type": "object",
        "properties": {
         "fix": {
          "type": [
           "string",
           "null"
          ],
          "description": "Recommended header value or action, or null"
         },
         "detail": {
          "type": "string",
          "description": "What was observed"
         },
         "header": {
          "type": "string",
          "description": "Header or check name"
         },
         "status": {
          "typ
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/saylor-innovations-http-security-header-auditor-52db4b15/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from saylorinnovations.com](https://www.zero.xyz/host/saylorinnovations.com/llms.txt)