{ "x402Version": 2, "id": 26528, "slug": "26528", "resource": "https://headers.use.x402atlas.com/", "description": "Audit a URL's HTTP security headers over a single body-free (HEAD) request. Grades Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, flags information-leak headers (Server, X-Powered-By), and returns the parsed values plus advisory warnings. Clean JSON for security and pentest automation.", "type": "http", "serviceName": "HTTP Security Headers Check", "resourceType": "Agent Service", "accepts": [ { "scheme": "exact", "network": "eip155:8453", "payTo": "0x7f8043c400799643bcb62B41B84b297a8Ecb7b9c", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "amount": "10000", "amountUsd": 0.01, "maxTimeoutSeconds": 300 }, { "scheme": "exact", "network": "eip155:137", "payTo": "0x7f8043c400799643bcb62B41B84b297a8Ecb7b9c", "asset": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359", "amount": "10000", "amountUsd": 0.01, "maxTimeoutSeconds": 300 }, { "scheme": "exact", "network": "eip155:42161", "payTo": "0x7f8043c400799643bcb62B41B84b297a8Ecb7b9c", "asset": "0xaf88d065e77c8cC2239327C5EDb3A432268e5831", "amount": "10000", "amountUsd": 0.01, "maxTimeoutSeconds": 300 }, { "scheme": "exact", "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp", "payTo": "ASt6xvRyQ7ntERsmcYVMdLqZvz1GEN8Fzexzq62tXrNQ", "asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v", "amount": "10000", "amountUsd": 0.01, "maxTimeoutSeconds": 300 } ], "outputSchema": { "properties": { "example": { "properties": { "headers": { "description": "Graded, normalized security headers. Each field is null when the header is absent from the response", "properties": { "content_security_policy": { "type": [ "string", "null" ] }, "permissions_policy": { "type": [ "string", "null" ] }, "referrer_policy": { "type": [ "string", "null" ] }, "server": { "description": "Server header value, if disclosed by the target", "type": [ "string", "null" ] }, "strict_transport_security": { "properties": { "include_subdomains": { "type": "boolean" }, "max_age": { "description": "Parsed max-age in seconds; null if absent or unparseable", "type": [ "integer", "null" ] }, "preload": { "type": "boolean" }, "value": { "description": "Raw Strict-Transport-Security header value", "type": "string" } }, "type": [ "object", "null" ] }, "x_content_type_options": { "type": [ "string", "null" ] }, "x_frame_options": { "type": [ "string", "null" ] }, "x_powered_by": { "description": "X-Powered-By header value, if disclosed by the target", "type": [ "string", "null" ] } }, "type": "object" }, "queried_at": { "description": "UTC timestamp the audit was performed", "format": "date-time", "type": "string" }, "status_code": { "description": "HTTP status code returned by the target for the HEAD request", "type": "integer" }, "url": { "description": "The audited URL, exactly as given", "type": "string" }, "warnings": { "description": "Human-readable posture advisories, e.g. missing or weak headers", "items": { "type": "string" }, "type": "array" } }, "required": [ "url", "status_code", "queried_at", "headers", "warnings" ], "type": "object" }, "type": { "type": "string" } }, "required": [ "type" ], "type": "object" }, "extensions": { "bazaar": { "category": "domain-intelligence", "info": { "input": { "method": "GET", "queryParams": { "url": "https://example.com/" }, "type": "http" }, "output": { "example": { "headers": { "content_security_policy": "default-src 'self'", "permissions_policy": null, "referrer_policy": "strict-origin-when-cross-origin", "server": null, "strict_transport_security": { "include_subdomains": true, "max_age": 31536000, "preload": false, "value": "max-age=31536000; includeSubDomains" }, "x_content_type_options": "nosniff", "x_frame_options": "DENY", "x_powered_by": null }, "queried_at": "2026-07-03T12:00:00Z", "status_code": 200, "url": "https://example.com/", "warnings": [ "no Permissions-Policy header (powerful browser features are not restricted)" ] }, "type": "json" } }, "schema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "properties": { "input": { "additionalProperties": false, "properties": { "method": { "enum": [ "GET" ], "type": "string" }, "queryParams": { "properties": { "url": { "description": "Absolute http/https URL to audit. Host must be a hostname (not an IP literal), not \"localhost\", and not under a reserved suffix (.local, .internal, .localdomain, .lan, .test). Non-default ports must be allowlisted. Redirects are not followed.", "format": "uri", "type": "string" } }, "required": [ "url" ], "type": "object" }, "type": { "const": "http", "type": "string" } }, "required": [ "type", "method" ], "type": "object" }, "output": { "properties": { "example": { "properties": { "headers": { "description": "Graded, normalized security headers. Each field is null when the header is absent from the response", "properties": { "content_security_policy": { "type": [ "string", "null" ] }, "permissions_policy": { "type": [ "string", "null" ] }, "referrer_policy": { "type": [ "string", "null" ] }, "server": { "description": "Server header value, if disclosed by the target", "type": [ "string", "null" ] }, "strict_transport_security": { "properties": { "include_subdomains": { "type": "boolean" }, "max_age": { "description": "Parsed max-age in seconds; null if absent or unparseable", "type": [ "integer", "null" ] }, "preload": { "type": "boolean" }, "value": { "description": "Raw Strict-Transport-Security header value", "type": "string" } }, "type": [ "object", "null" ] }, "x_content_type_options": { "type": [ "string", "null" ] }, "x_frame_options": { "type": [ "string", "null" ] }, "x_powered_by": { "description": "X-Powered-By header value, if disclosed by the target", "type": [ "string", "null" ] } }, "type": "object" }, "queried_at": { "description": "UTC timestamp the audit was performed", "format": "date-time", "type": "string" }, "status_code": { "description": "HTTP status code returned by the target for the HEAD request", "type": "integer" }, "url": { "description": "The audited URL, exactly as given", "type": "string" }, "warnings": { "description": "Human-readable posture advisories, e.g. missing or weak headers", "items": { "type": "string" }, "type": "array" } }, "required": [ "url", "status_code", "queried_at", "headers", "warnings" ], "type": "object" }, "type": { "type": "string" } }, "required": [ "type" ], "type": "object" } }, "required": [ "input" ], "type": "object" }, "tags": [ "http", "headers", "security", "hsts", "csp", "x-frame-options", "posture" ] } }, "tags": [ "http", "headers", "security", "hsts", "csp", "bazaar" ], "sourceHost": "headers.use.x402atlas.com", "lastUpdated": "2026-10-12T04:06:51.464Z", "quality": { "calls30d": 26, "uniquePayers30d": 12, "lastCalledAt": "2026-10-12T04:06:51.326Z" }, "metadata": { "serviceName": "HTTP Security Headers Check", "extensions": { "bazaar": { "category": "domain-intelligence", "info": { "input": { "method": "GET", "queryParams": { "url": "https://example.com/" }, "type": "http" }, "output": { "example": { "headers": { "content_security_policy": "default-src 'self'", "permissions_policy": null, "referrer_policy": "strict-origin-when-cross-origin", "server": null, "strict_transport_security": { "include_subdomains": true, "max_age": 31536000, "preload": false, "value": "max-age=31536000; includeSubDomains" }, "x_content_type_options": "nosniff", "x_frame_options": "DENY", "x_powered_by": null }, "queried_at": "2026-07-03T12:00:00Z", "status_code": 200, "url": "https://example.com/", "warnings": [ "no Permissions-Policy header (powerful browser features are not restricted)" ] }, "type": "json" } }, "schema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "properties": { "input": { "additionalProperties": false, "properties": { "method": { "enum": [ "GET" ], "type": "string" }, "queryParams": { "properties": { "url": { "description": "Absolute http/https URL to audit. Host must be a hostname (not an IP literal), not \"localhost\", and not under a reserved suffix (.local, .internal, .localdomain, .lan, .test). Non-default ports must be allowlisted. Redirects are not followed.", "format": "uri", "type": "string" } }, "required": [ "url" ], "type": "object" }, "type": { "const": "http", "type": "string" } }, "required": [ "type", "method" ], "type": "object" }, "output": { "properties": { "example": { "properties": { "headers": { "description": "Graded, normalized security headers. Each field is null when the header is absent from the response", "properties": { "content_security_policy": { "type": [ "string", "null" ] }, "permissions_policy": { "type": [ "string", "null" ] }, "referrer_policy": { "type": [ "string", "null" ] }, "server": { "description": "Server header value, if disclosed by the target", "type": [ "string", "null" ] }, "strict_transport_security": { "properties": { "include_subdomains": { "type": "boolean" }, "max_age": { "description": "Parsed max-age in seconds; null if absent or unparseable", "type": [ "integer", "null" ] }, "preload": { "type": "boolean" }, "value": { "description": "Raw Strict-Transport-Security header value", "type": "string" } }, "type": [ "object", "null" ] }, "x_content_type_options": { "type": [ "string", "null" ] }, "x_frame_options": { "type": [ "string", "null" ] }, "x_powered_by": { "description": "X-Powered-By header value, if disclosed by the target", "type": [ "string", "null" ] } }, "type": "object" }, "queried_at": { "description": "UTC timestamp the audit was performed", "format": "date-time", "type": "string" }, "status_code": { "description": "HTTP status code returned by the target for the HEAD request", "type": "integer" }, "url": { "description": "The audited URL, exactly as given", "type": "string" }, "warnings": { "description": "Human-readable posture advisories, e.g. missing or weak headers", "items": { "type": "string" }, "type": "array" } }, "required": [ "url", "status_code", "queried_at", "headers", "warnings" ], "type": "object" }, "type": { "type": "string" } }, "required": [ "type" ], "type": "object" } }, "required": [ "input" ], "type": "object" }, "tags": [ "http", "headers", "security", "hsts", "csp", "x-frame-options", "posture" ] } } }, "liveness": { "reliability": null }, "verified": false, "featured": false, "provider": { "host": "headers.use.x402atlas.com", "manifest_name": "headers.use.x402atlas.com", "source": "cdp-mirror", "source_manifest_url": "https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources", "submitted_at": "2026-10-14T01:15:01.050Z" }, "exampleResponse": { "headers": { "content_security_policy": "default-src 'self'", "permissions_policy": null, "referrer_policy": "strict-origin-when-cross-origin", "server": null, "strict_transport_security": { "include_subdomains": true, "max_age": 31536000, "preload": false, "value": "max-age=31536000; includeSubDomains" }, "x_content_type_options": "nosniff", "x_frame_options": "DENY", "x_powered_by": null }, "queried_at": "2026-07-03T12:00:00Z", "status_code": 200, "url": "https://example.com/", "warnings": [ "no Permissions-Policy header (powerful browser features are not restricted)" ] } }