# Tinstop Domain Security Audit API

> Tinstop Domain Security Audit API is a paid API for AI agents from tinstop.com, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-15).

Audits a domain's security posture including DNS, SSL/TLS, HTTP security headers, SPF/DKIM/DMARC email authentication, and Google PageSpeed via a pay-per-call x402 API

## Facts

- Endpoint: POST https://tinstop.com/v1/domain/security
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/tinstop-domain-security-audit-api-e5b6fbff
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_e3-B0yx6W3PcAHNaV4K79

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability tinstop-domain-security-audit-api-e5b6fbff -d '<json body>'
```

Example prompt: Can you run a full security audit on stripe.com — I want to see the DNS setup, SSL cert status, HTTP security headers, SPF/DKIM/DMARC email authentication, and PageSpeed score?

## When to prefer this

Choose this endpoint when you need a comprehensive, multi-dimensional domain security audit in a single call without managing API keys or subscriptions. It is ideal for agents that need to assess SSL, DNS, email authentication (SPF/DKIM/DMARC), HTTP security headers, and PageSpeed all at once for a given domain. Prefer it for pay-per-use autonomous agent workflows using x402/USDC on Base, where account-free, programmatic payment is required.

## Known failure modes

- Domain does not exist or is unreachable — returns error or empty results for DNS/SSL checks
- Domain provided with http/https prefix instead of bare domain — may cause lookup failure
- SSL certificate expired or missing — reported in output as a finding rather than an API error
- Payment via x402/USDC fails — request not processed
- Rate limiting or network timeout during PageSpeed or DNS resolution — partial results possible

## How this service works

Tinstop is a machine-payable Website Intelligence API for domain security and performance audits: DNS, SSL/TLS, HTTP security headers, SPF/DKIM/DMARC email authentication, and Google PageSpeed. Pay per call with x402 using USDC on Base. No accounts or API keys.

## Output

Returns a structured JSON object containing DNS record details, SSL/TLS certificate validity and configuration, HTTP security header presence and values (e.g. HSTS, CSP, X-Frame-Options), SPF/DKIM/DMARC email authentication records, and Google PageSpeed performance metrics for the queried domain.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "domain": {
   "type": "string",
   "description": "Domain name (e.g. 'example.com'). No http/https prefix."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "object",
 "title": "Response Domain Security V1 Domain Security Post",
 "additionalProperties": true
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/tinstop-domain-security-audit-api-e5b6fbff/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from tinstop.com](https://www.zero.xyz/host/tinstop.com/llms.txt)