# StatePulse Security Headers Checker

> StatePulse Security Headers Checker is a paid API for AI agents from statepulse-api.hahavoid0.workers.dev, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-15).

Analyzes a URL's HTTP security headers and returns a security score with presence/absence of each header

## Facts

- Endpoint: POST https://statepulse-api.hahavoid0.workers.dev/network/security-headers
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/statepulse-security-headers-checker-1544527c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_UKxPiZIMh5f-6DAd1AQeL

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability statepulse-security-headers-checker-1544527c -d '<json body>'
```

Example prompt: Can you check the security headers on https://example.com and tell me which ones are missing and what the overall security score is?

## When to prefer this

Use this endpoint when you need a quick, pay-per-call HTTP security header audit for any public URL without managing API keys. Ideal for agents doing automated security posture checks, compliance validation, or pre-deployment audits. Prefer this over manual header inspection tools when you need a structured score and per-header breakdown in JSON format.

## Known failure modes

- Invalid or unreachable URL returns an error or low-confidence result
- Non-HTTPS URLs may show limited header data
- Payment failure via x402 prevents the call from completing
- Timeout if the target server is slow to respond
- Unsupported URL schemes return supported:false

## How this service works

Fetches target URL headers to score configurations (HSTS, CSP, X-Frame-Options).

## Output

Returns a JSON object with the target URL, a breakdown of individual security headers (e.g. Content-Security-Policy, Strict-Transport-Security) marked as present or absent, an integer security score out of 100, a supported flag, and a confidence level string.

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "result": {
   "url": "https://google.com",
   "headers": {
    "Content_Security_Policy": false,
    "Strict_Transport_Security": true
   },
   "security_score": 60
  },
  "supported": true,
  "confidence": "high"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/statepulse-security-headers-checker-1544527c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from statepulse-api.hahavoid0.workers.dev](https://www.zero.xyz/host/statepulse-api.hahavoid0.workers.dev/llms.txt)