# WebSchutz CORS Policy Audit

> WebSchutz CORS Policy Audit is a paid API for AI agents from webschutz.halowerk.com, paid per call via x402, $0.001/call, status unknown (last checked 2026-10-21).

Passively audits a public URL or domain for accidental wildcard CORS misconfigurations and returns verdict, evidence, and remediation guidance

## Facts

- Endpoint: POST https://webschutz.halowerk.com/v1/cors-policy-audit?utm_source=zero.xyz
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/webschutz-cors-policy-audit-acf0864e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Et1YiKNCGjLF-0QglssZd

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability webschutz-cors-policy-audit-acf0864e -d '<json body>'
```

Example prompt: Can you do a passive CORS policy audit on https://api.example.com and tell me if it has any accidental wildcard CORS misconfiguration — I want the verdict, the exact evidence, and what I should do about it?

## When to prefer this

Choose this endpoint when you need a passive, non-intrusive, evidence-backed CORS misconfiguration check on a public URL without performing any login, payload injection, or active exploit. It is ideal for pre-launch security reviews, continuous monitoring pipelines comparing against a stored baseline, or vetting third-party API endpoints before integration. Prefer this over generic security scanners when you specifically need CORS wildcard detection with structured verdict and remediation guidance.

## Known failure modes

- Target URL is unreachable or returns a non-public response — audit cannot be completed
- Target domain resolves but server returns no CORS headers — observation reflects absence of policy
- Malformed or excessively long target URL exceeds 2048-character limit — request rejected with validation error
- Target behind authentication or firewall — passive check cannot retrieve headers
- Rate limit exceeded for the endpoint — request rejected

## How this service works

No accidental wildcard CORS audit fetches current public evidence from the supplied target and evaluates the documented criterion. It returns the observation, threshold, verdict, exact evidence source, limitations and a mode-specific action. The check is passive: no login attempt, payload injection, exploit, purchase, form submission or load test is performed.

## Output

Returns an observation describing detected CORS headers, a threshold defining what constitutes a violation, a pass/fail verdict, the exact evidence source (e.g. response header value), known limitations of the passive check, and a mode-specific recommended action. If a baseline or comparison URL was supplied, a change or drift assessment is also included.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "target": {
   "type": "string",
   "maxLength": 2048,
   "minLength": 3,
   "description": "Public HTTP(S) URL or domain to inspect. A bare domain is normalized to HTTPS."
  },
  "context": {
   "type": "object",
   "description": "Optional non-secret correlation labels returned unchanged only in the request lifecycle.",
   "maxProperties": 12,
   "additionalProperties": {
    "type": [
     "string",
     "number",
     "boolean",
     "null"
    ]
   }
  },
  "baseline": {
   "type": [
    "object",
    "null"
   ],
   "description": "Optional baseline returned by a previous snapshot call.",
   "additionalProperties": true
  },
  "compare_url": {
   "type": "string",
   "maxLength": 2048,
   "minLength": 3,
   "description": "Optional public comparison URL. Used by change and monitoring services."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/webschutz-cors-policy-audit-acf0864e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from webschutz.halowerk.com](https://www.zero.xyz/host/webschutz.halowerk.com/llms.txt)