{
  "x402Version": 2,
  "id": 34024,
  "slug": "34024",
  "resource": "https://api.zfinia.com/x402/v1/security-header-diff",
  "description": "Compare a fixed list of ten security-relevant response headers across two releases and name the specific reverts. Reports a header removed, added or changed, and separately a reduced Strict-Transport-Security max-age, dropped includeSubDomains, a newly permitted unsafe-inline or unsafe-eval, and a Content-Security-Policy that moved from enforcing to report-only so it no longer blocks anything. Observable differences only, not an assessment of whether either configuration is adequate.",
  "type": "http",
  "serviceName": "Security Header Diff",
  "resourceType": "Security",
  "accepts": [
    {
      "scheme": "exact",
      "network": "eip155:8453",
      "payTo": "0x25e8245f07d5e4873987293dad666afbe56a9608",
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "amount": "110000",
      "amountUsd": 0.11,
      "maxTimeoutSeconds": 60
    }
  ],
  "outputSchema": {
    "properties": {
      "example": {
        "type": "object"
      },
      "type": {
        "type": "string"
      }
    },
    "required": [
      "type"
    ],
    "type": "object"
  },
  "extensions": {
    "bazaar": {
      "info": {
        "input": {
          "body": {
            "after": {
              "Content-Security-Policy-Report-Only": "default-src 'self'; script-src 'self' 'unsafe-inline'",
              "Referrer-Policy": "no-referrer",
              "Strict-Transport-Security": "max-age=600",
              "X-Frame-Options": "SAMEORIGIN"
            },
            "after_name": "release-42",
            "before": {
              "Content-Security-Policy": "default-src 'self'; script-src 'self'",
              "Referrer-Policy": "no-referrer",
              "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
              "X-Content-Type-Options": "nosniff",
              "X-Frame-Options": "DENY"
            },
            "before_name": "release-41"
          },
          "bodyType": "json",
          "method": "POST",
          "type": "http"
        },
        "output": {
          "example": {
            "after_name": "release-42",
            "after_present_count": 4,
            "assumptions": [
              "The set of headers compared is fixed and declared, so a header outside it is not silently ignored: it is simply not part of this product.",
              "A reduced HSTS max-age, dropped subdomains, a newly permitted unsafe source and a policy moving to report-only are each named specifically, because those are the changes that revert a deliberate harde...",
              "Findings describe the headers supplied. This is not a security assessment and carries no judgement about whether a configuration is adequate."
            ],
            "before_name": "release-41",
            "before_present_count": 5,
            "changed_count": 5,
            "complete": true,
            "finding_count": 8,
            "findings": [
              {
                "code": "SECURITY_HEADER_CHANGED",
                "detail": "strict-transport-security changed from \"max-age=31536000; includeSubDomains\" to \"max-age=600\".",
                "header": "strict-transport-security"
              },
              {
                "code": "HSTS_MAX_AGE_REDUCED",
                "detail": "Strict-Transport-Security max-age fell from 31536000 to 600.",
                "header": "strict-transport-security"
              },
              {
                "code": "HSTS_SUBDOMAINS_DROPPED",
                "detail": "Strict-Transport-Security no longer includes subdomains.",
                "header": "strict-transport-security"
              }
            ],
            "findings_by_code": {
              "CSP_MOVED_TO_REPORT_ONLY": 1,
              "HSTS_MAX_AGE_REDUCED": 1,
              "HSTS_SUBDOMAINS_DROPPED": 1,
              "SECURITY_HEADER_ADDED": 1,
              "SECURITY_HEADER_CHANGED": 2,
              "SECURITY_HEADER_REMOVED": 2
            },
            "headers": [
              {
                "after": "max-age=600",
                "before": "max-age=31536000; includeSubDomains",
                "changed": true,
                "header": "strict-transport-security"
              },
              {
                "after": null,
                "before": "default-src 'self'; script-src 'self'",
                "changed": true,
                "header": "content-security-policy"
              },
              {
                "after": "default-src 'self'; script-src 'self' 'unsafe-inline'",
                "before": null,
                "changed": true,
                "header": "content-security-policy-report-only"
              }
            ],
            "limitations": [
              "Difference between the two header sets supplied. Whether either is appropriate for the site is not assessed.",
              "unchanged is true only when every compared header was identical."
            ],
            "limits": {
              "maxCookies": 100,
              "maxFindings": 500,
              "maxHeaders": 200,
              "maxHtmlBytes": 262144,
              "maxListed": 200,
              "maxPages": 50,
              "maxSitemapBytes": 1048576,
              "maxSitemapUrls": 10000
            },
            "not_examined": [],
            "observed_at": "2026-10-02T00:00:00.000Z",
            "passed": false,
            "request_id": "example-request",
            "service_id": "security_header_diff",
            "service_version": "1.0.0",
            "unchanged": false
          },
          "type": "json"
        }
      },
      "schema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "input": {
            "additionalProperties": false,
            "properties": {
              "body": {
                "additionalProperties": false,
                "properties": {
                  "after": {
                    "type": "object"
                  },
                  "after_name": {
                    "maxLength": 64,
                    "type": "string"
                  },
                  "before": {
                    "type": "object"
                  },
                  "before_name": {
                    "maxLength": 64,
                    "type": "string"
                  }
                },
                "required": [
                  "before",
                  "after"
                ],
                "type": "object"
              },
              "bodyType": {
                "enum": [
                  "json",
                  "form-data",
                  "text"
                ],
                "type": "string"
              },
              "method": {
                "enum": [
                  "POST"
                ],
                "type": "string"
              },
              "type": {
                "const": "http",
                "type": "string"
              }
            },
            "required": [
              "type",
              "method",
              "bodyType",
              "body"
            ],
            "type": "object"
          },
          "output": {
            "properties": {
              "example": {
                "type": "object"
              },
              "type": {
                "type": "string"
              }
            },
            "required": [
              "type"
            ],
            "type": "object"
          }
        },
        "required": [
          "input"
        ],
        "type": "object"
      }
    }
  },
  "tags": [
    "http headers",
    "release gate",
    "regression detection",
    "web platform",
    "developer tooling",
    "bazaar"
  ],
  "sourceHost": "api.zfinia.com",
  "lastUpdated": "2026-10-04T08:18:34.078Z",
  "quality": {
    "calls30d": 1,
    "uniquePayers30d": 1,
    "lastCalledAt": "2026-10-04T08:18:29.873Z"
  },
  "metadata": {
    "serviceName": "Security Header Diff",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "body": {
              "after": {
                "Content-Security-Policy-Report-Only": "default-src 'self'; script-src 'self' 'unsafe-inline'",
                "Referrer-Policy": "no-referrer",
                "Strict-Transport-Security": "max-age=600",
                "X-Frame-Options": "SAMEORIGIN"
              },
              "after_name": "release-42",
              "before": {
                "Content-Security-Policy": "default-src 'self'; script-src 'self'",
                "Referrer-Policy": "no-referrer",
                "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
                "X-Content-Type-Options": "nosniff",
                "X-Frame-Options": "DENY"
              },
              "before_name": "release-41"
            },
            "bodyType": "json",
            "method": "POST",
            "type": "http"
          },
          "output": {
            "example": {
              "after_name": "release-42",
              "after_present_count": 4,
              "assumptions": [
                "The set of headers compared is fixed and declared, so a header outside it is not silently ignored: it is simply not part of this product.",
                "A reduced HSTS max-age, dropped subdomains, a newly permitted unsafe source and a policy moving to report-only are each named specifically, because those are the changes that revert a deliberate harde...",
                "Findings describe the headers supplied. This is not a security assessment and carries no judgement about whether a configuration is adequate."
              ],
              "before_name": "release-41",
              "before_present_count": 5,
              "changed_count": 5,
              "complete": true,
              "finding_count": 8,
              "findings": [
                {
                  "code": "SECURITY_HEADER_CHANGED",
                  "detail": "strict-transport-security changed from \"max-age=31536000; includeSubDomains\" to \"max-age=600\".",
                  "header": "strict-transport-security"
                },
                {
                  "code": "HSTS_MAX_AGE_REDUCED",
                  "detail": "Strict-Transport-Security max-age fell from 31536000 to 600.",
                  "header": "strict-transport-security"
                },
                {
                  "code": "HSTS_SUBDOMAINS_DROPPED",
                  "detail": "Strict-Transport-Security no longer includes subdomains.",
                  "header": "strict-transport-security"
                }
              ],
              "findings_by_code": {
                "CSP_MOVED_TO_REPORT_ONLY": 1,
                "HSTS_MAX_AGE_REDUCED": 1,
                "HSTS_SUBDOMAINS_DROPPED": 1,
                "SECURITY_HEADER_ADDED": 1,
                "SECURITY_HEADER_CHANGED": 2,
                "SECURITY_HEADER_REMOVED": 2
              },
              "headers": [
                {
                  "after": "max-age=600",
                  "before": "max-age=31536000; includeSubDomains",
                  "changed": true,
                  "header": "strict-transport-security"
                },
                {
                  "after": null,
                  "before": "default-src 'self'; script-src 'self'",
                  "changed": true,
                  "header": "content-security-policy"
                },
                {
                  "after": "default-src 'self'; script-src 'self' 'unsafe-inline'",
                  "before": null,
                  "changed": true,
                  "header": "content-security-policy-report-only"
                }
              ],
              "limitations": [
                "Difference between the two header sets supplied. Whether either is appropriate for the site is not assessed.",
                "unchanged is true only when every compared header was identical."
              ],
              "limits": {
                "maxCookies": 100,
                "maxFindings": 500,
                "maxHeaders": 200,
                "maxHtmlBytes": 262144,
                "maxListed": 200,
                "maxPages": 50,
                "maxSitemapBytes": 1048576,
                "maxSitemapUrls": 10000
              },
              "not_examined": [],
              "observed_at": "2026-10-02T00:00:00.000Z",
              "passed": false,
              "request_id": "example-request",
              "service_id": "security_header_diff",
              "service_version": "1.0.0",
              "unchanged": false
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "body": {
                  "additionalProperties": false,
                  "properties": {
                    "after": {
                      "type": "object"
                    },
                    "after_name": {
                      "maxLength": 64,
                      "type": "string"
                    },
                    "before": {
                      "type": "object"
                    },
                    "before_name": {
                      "maxLength": 64,
                      "type": "string"
                    }
                  },
                  "required": [
                    "before",
                    "after"
                  ],
                  "type": "object"
                },
                "bodyType": {
                  "enum": [
                    "json",
                    "form-data",
                    "text"
                  ],
                  "type": "string"
                },
                "method": {
                  "enum": [
                    "POST"
                  ],
                  "type": "string"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method",
                "bodyType",
                "body"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    }
  },
  "liveness": {
    "reliability": null
  },
  "verified": false,
  "featured": false,
  "provider": {
    "host": "api.zfinia.com",
    "manifest_name": "api.zfinia.com",
    "source": "cdp-mirror",
    "source_manifest_url": "https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources",
    "submitted_at": "2026-10-14T01:15:01.050Z"
  },
  "exampleResponse": {
    "after_name": "release-42",
    "after_present_count": 4,
    "assumptions": [
      "The set of headers compared is fixed and declared, so a header outside it is not silently ignored: it is simply not part of this product.",
      "A reduced HSTS max-age, dropped subdomains, a newly permitted unsafe source and a policy moving to report-only are each named specifically, because those are the changes that revert a deliberate harde...",
      "Findings describe the headers supplied. This is not a security assessment and carries no judgement about whether a configuration is adequate."
    ],
    "before_name": "release-41",
    "before_present_count": 5,
    "changed_count": 5,
    "complete": true,
    "finding_count": 8,
    "findings": [
      {
        "code": "SECURITY_HEADER_CHANGED",
        "detail": "strict-transport-security changed from \"max-age=31536000; includeSubDomains\" to \"max-age=600\".",
        "header": "strict-transport-security"
      },
      {
        "code": "HSTS_MAX_AGE_REDUCED",
        "detail": "Strict-Transport-Security max-age fell from 31536000 to 600.",
        "header": "strict-transport-security"
      },
      {
        "code": "HSTS_SUBDOMAINS_DROPPED",
        "detail": "Strict-Transport-Security no longer includes subdomains.",
        "header": "strict-transport-security"
      }
    ],
    "findings_by_code": {
      "CSP_MOVED_TO_REPORT_ONLY": 1,
      "HSTS_MAX_AGE_REDUCED": 1,
      "HSTS_SUBDOMAINS_DROPPED": 1,
      "SECURITY_HEADER_ADDED": 1,
      "SECURITY_HEADER_CHANGED": 2,
      "SECURITY_HEADER_REMOVED": 2
    },
    "headers": [
      {
        "after": "max-age=600",
        "before": "max-age=31536000; includeSubDomains",
        "changed": true,
        "header": "strict-transport-security"
      },
      {
        "after": null,
        "before": "default-src 'self'; script-src 'self'",
        "changed": true,
        "header": "content-security-policy"
      },
      {
        "after": "default-src 'self'; script-src 'self' 'unsafe-inline'",
        "before": null,
        "changed": true,
        "header": "content-security-policy-report-only"
      }
    ],
    "limitations": [
      "Difference between the two header sets supplied. Whether either is appropriate for the site is not assessed.",
      "unchanged is true only when every compared header was identical."
    ],
    "limits": {
      "maxCookies": 100,
      "maxFindings": 500,
      "maxHeaders": 200,
      "maxHtmlBytes": 262144,
      "maxListed": 200,
      "maxPages": 50,
      "maxSitemapBytes": 1048576,
      "maxSitemapUrls": 10000
    },
    "not_examined": [],
    "observed_at": "2026-10-02T00:00:00.000Z",
    "passed": false,
    "request_id": "example-request",
    "service_id": "security_header_diff",
    "service_version": "1.0.0",
    "unchanged": false
  }
}