# Sentinel Security Header Inspector

> Sentinel Security Header Inspector is a paid API for AI agents from sentinel.rootstuff.io, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-15).

Fetches response headers from a URL and reports on the presence and quality of HTTP security headers

## Facts

- Endpoint: GET https://sentinel.rootstuff.io/x402/headers
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sentinel-security-header-inspector-299aeac2
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_KyBH0nnaUviJFNAcFCGoB

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sentinel-security-header-inspector-299aeac2
```

Example prompt: Can you pull the response headers for https://example.com and tell me which security headers like Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options are missing or misconfigured?

## When to prefer this

Choose this endpoint when you need a quick, paid-per-call security header inspection of a specific URL without setting up your own HTTP client — especially useful in agent workflows that need to audit web properties, verify compliance, or report on header posture as part of a broader security check. Prefer over manual fetching when you want a structured report on security headers specifically, not just raw header values.

## Known failure modes

- Private or non-public hosts rejected — only public HTTP/HTTPS URLs are supported
- Target URL is unreachable or returns a network error — endpoint may return an error or empty header set
- URL is malformed or missing scheme — input validation failure
- Target returns a redirect that resolves to a non-public host — may be blocked
- Rate limiting if called excessively against the same host

## How this service works

Response headers and security-header report for a URL

## Output

Returns the full set of HTTP response headers received from the target URL, along with a security-focused report highlighting which security headers (e.g. Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) are present, absent, or misconfigured.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "description": "The http(s) URL to request. Public hosts only."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sentinel-security-header-inspector-299aeac2/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from sentinel.rootstuff.io](https://www.zero.xyz/host/sentinel.rootstuff.io/llms.txt)