# Security Headers Audit API

> Security Headers Audit API is a paid API for AI agents from x402-extract-service.onrender.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-19).

Audits HTTP security headers for a given URL, returning a grade, score, per-header pass/warn/fail verdicts, and remediation advice.

## Facts

- Endpoint: POST https://x402-extract-service.onrender.com/headers
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-19
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/security-headers-audit-api-640c3c8b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_zihXQm4uCjwpCyalfXzjG

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability security-headers-audit-api-640c3c8b -d '<json body>'
```

Example prompt: Can you audit the security headers for https://mycompany.com and tell me which ones are missing or misconfigured, along with a grade and specific remediation steps?

## When to prefer this

Choose this endpoint when you need a structured, graded audit of HTTP security headers for any public URL — especially useful for pre-deploy checks, security reviews, vendor assessments, or automated monitoring pipelines. It provides actionable remediation advice per header, making it more useful than raw curl header dumps or generic scanner tools. Paid per call via USDC/x402 on Base, so ideal for agent workflows that need programmatic, on-demand audits without a subscription.

## Known failure modes

- Invalid or unreachable URL returns an error response
- Private/internal URLs (localhost, RFC-1918) may be blocked or return no data
- Redirect chains may resolve to an unexpected final URL affecting results
- Sites with bot-blocking may return incomplete or misleading header data
- Payment failure via x402 results in 402 response and no audit data

## How this service works

URL-to-clean-markdown extraction API, on-demand broken-link scan API, pre-deploy link audit API, DNS health audit API, llms.txt / AI-crawler audit API, spec-linted llms.txt audit API, email-deliverability (SPF/DKIM/DMARC) audit API, PDF-to-markdown conversion API, technology-stack fingerprinting API, security-headers audit API, and PDF metadata-intel API for coding agents. Paid per call in USDC via x402 on Base.

## Output

Returns a JSON object with: overall letter grade (e.g. A–F), numeric score (0–100), a list of per-header check results each with header name, current value, verdict (pass/warn/fail), detail explanation, and remediation guidance for failures. Also includes aggregate counts of passes/warnings/failures, a human-readable summary, the final resolved URL, and the timestamp of the check.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "format": "uri",
   "description": "Public http(s) URL whose response security headers to audit."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "url": "https://example.com/",
  "grade": "B",
  "score": 85,
  "checks": [
   {
    "value": "max-age=63072000; includeSubDomains; preload",
    "detail": "long max-age with includeSubDomains and preload",
    "header": "strict-transport-security",
    "verdict": "pass"
   },
   {
    "value": null,
    "detail": "header missing: no XSS/data-injection containment",
    "header": "content-security-policy",
    "verdict": "fail",
    "remediation": "Deploy a Content-Security-Policy, e.g. default-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'."
   }
  ],
  "counts": {
   "fail": 1,
   "pass": 8,
   "warn": 2,
   "total": 11
  },
  "summary": "8/11 pass, 2 warning(s), 1 failure(s) — grade B",
  "finalUrl": "https://example.com/",
  "checkedAt": "2026-09-15T00:00:00.000Z",
  "pricePaidAtomic": "20000"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/security-headers-audit-api-640c3c8b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402-extract-service.onrender.com](https://www.zero.xyz/host/x402-extract-service.onrender.com/llms.txt)