# Security Header Diff

> Security Header Diff is a paid API for AI agents from api.zfinia.com, paid per call via x402, $0.11/call, status unknown (last checked 2026-10-18).

Compares security-relevant HTTP response headers between two releases and reports specific regressions such as removed headers, weakened HSTS, newly permitted unsafe directives, and CSP enforcement downgrades.

## Facts

- Endpoint: POST https://api.zfinia.com/x402/v1/security-header-diff?utm_source=zero.xyz
- Price: $0.11/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-18
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/security-header-diff-55a0ac80
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Gd-eXorzvIJ2-UP009hyu

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability security-header-diff-55a0ac80 -d '<json body>'
```

Example prompt: Compare the security headers from our v2.3.1 release to our v2.4.0 release and tell me if anything regressed — especially if CSP moved to report-only, if unsafe-inline was added, or if HSTS max-age was shortened.

## When to prefer this

Choose this endpoint when you need a precise, named-regression diff of security headers between two specific release snapshots — especially when you need to detect HSTS weakening, CSP unsafe directive additions, or enforcement-to-report-only downgrades. Prefer this over generic diff tools when the security semantics of header changes (not just string differences) matter for release gating or audit trails.

## Known failure modes

- Missing or malformed before/after objects returns a validation error
- Headers objects with unexpected structure may cause incomplete diff results
- Empty header sets may produce no findings even if configurations differ significantly
- Very large or deeply nested header objects may be truncated or rejected

## How this service works

Compare a fixed list of ten security-relevant response headers across two releases and name the specific reverts. Reports a header removed, added or changed, and separately a reduced Strict-Transport-Security max-age, dropped includeSubDomains, a newly permitted unsafe-inline or unsafe-eval, and a Content-Security-Policy that moved from enforcing to report-only so it no longer blocks anything. Observable differences only, not an assessment of whether either configuration is adequate.

## Output

A structured report listing each observable difference across the ten tracked security headers: headers that were added, removed, or changed in value; a reduced Strict-Transport-Security max-age; removal of includeSubDomains from HSTS; addition of unsafe-inline or unsafe-eval to Content-Security-Policy; and a CSP that moved from enforcing to report-only mode. Does not assess overall adequacy — only reports observable differences.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "after": {
   "type": "object"
  },
  "before": {
   "type": "object"
  },
  "after_name": {
   "type": "string",
   "maxLength": 64
  },
  "before_name": {
   "type": "string",
   "maxLength": 64
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/security-header-diff-55a0ac80/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.zfinia.com](https://www.zero.xyz/host/api.zfinia.com/llms.txt)