APIs › Agent & Developer Utilities › HTTP Header Audit

HTTP Header Audit

Audits a supplied header set for security posture, caching correctness and content-type consistency, citing the relevant specification for each finding.

POST /v1/developer/http-header-audit $0.01 per call

Specification

Endpoint

POST /v1/developer/http-header-audit

Price

$0.01 per call · tier standard_data

Payment

x402 on X Layer (chain 196) · settled in USDG or USDT0 · scheme exact

Data source

Deterministic local computation on caller-supplied input

Timeout

15 seconds

Max request

2 MB

Version

1.0.0

Calling it

The first call returns a 402 with the payment challenge. Retry with a signed authorisation in the X-PAYMENT header — see the payment guide for the exact shape.

curl -i -X POST "https://api.dana-edu.pp.ua/v1/developer/http-header-audit" \
  -H "content-type: application/json" \
  -d '{ ... }'

Response

Real output, captured by running this endpoint at build time — not written by hand. Volatile fields such as timestamps are elided. Captured 2026-07-30.

{
  "security_score": 11,
  "grade": "F",
  "present_security_headers": [],
  "counts_by_severity": {
    "high": 2,
    "medium": 3,
    "low": 3,
    "info": 0
  },
  "findings": [
    {
      "header": "strict-transport-security",
      "severity": "high",
      "category": "security",
      "reference": "RFC 6797",
      "message": "Absent. Without HSTS a first request can be downgraded to HTTP and intercepted. Add: Strict-Transport-Security: max-age=31536000; includeSubDomains"
    },
    {
      "header": "content-security-policy",
      "severity": "high",
      "category": "security",
      "reference": "CSP Level 3",
      "message": "Absent. CSP is the main defence against injected script execution. Add a policy starting from default-src 'self'."
    },
    {
      "header": "x-content-type-options",
      "severity": "medium",
      "category": "security",
      "reference": "Fetch Standard",
      "message": "Absent. Browsers may MIME-sniff and execute a response as script. Add: X-Content-Type-Options: nosniff"
    },
    {
      "header": "referrer-policy",
      "severity": "medium",
      "category": "security",
      "reference": "Referrer Policy",
      "message": "Absent. Full URLs may leak to third parties in the Referer header. Add: Referrer-Policy: strict-origin-when-cross-origin"
    },
    {
      "header": "x-frame-options",
      "severity": "medium",
      "category": "security",
      "reference": "RFC 7034",
      "message": "Absent, and no CSP frame-ancestors found. The page can be framed for clickjacking. Add: X-Frame-Options: DENY, or CSP frame-ancestors 'none'."
    },
    {
      "header": "permissions-policy",
      "severity": "low",
      "category": "security",
      "reference": "Permissions Policy",
      "message": "Absent. Powerful features are not restricted. Add: Permissions-Policy: geolocation=(), microphone=(), camera=()"
    },
    {
      "header": "cross-origin-opener-policy",
      "severity": "low",
      "category": "security",
      "reference": "HTML Standard",
      "message": "Absent. Cross-origin windows keep a reference to this one. Add: Cross-Origin-Opener-Policy: same-origin"
    },
  … truncated for display

Trimmed for display. The full body is returned by the endpoint and described by its schema.

Every response is wrapped in the same envelope: data plus warnings, sources, confidence, informational_only and a measured processing_ms. See the envelope reference.

Related endpoints