{
  "x402Version": 2,
  "id": 887,
  "slug": "887",
  "resource": "https://headers.use.x402atlas.com/",
  "description": "Audit a URL's HTTP security headers over a single body-free (HEAD) request. Grades Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, flags information-leak headers (Server, X-Powered-By), and returns the parsed values plus advisory warnings. Clean JSON for security and pentest automation.",
  "type": "http",
  "accepts": [
    {
      "scheme": "exact",
      "network": "eip155:8453",
      "payTo": "0x7f8043c400799643bcb62B41B84b297a8Ecb7b9c",
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "amount": "10000",
      "maxTimeoutSeconds": 300
    },
    {
      "scheme": "exact",
      "network": "eip155:137",
      "payTo": "0x7f8043c400799643bcb62B41B84b297a8Ecb7b9c",
      "asset": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
      "amount": "10000",
      "maxTimeoutSeconds": 300
    },
    {
      "scheme": "exact",
      "network": "eip155:42161",
      "payTo": "0x7f8043c400799643bcb62B41B84b297a8Ecb7b9c",
      "asset": "0xaf88d065e77c8cC2239327C5EDb3A432268e5831",
      "amount": "10000",
      "maxTimeoutSeconds": 300
    },
    {
      "scheme": "exact",
      "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
      "payTo": "ASt6xvRyQ7ntERsmcYVMdLqZvz1GEN8Fzexzq62tXrNQ",
      "asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
      "amount": "10000",
      "maxTimeoutSeconds": 300
    }
  ],
  "outputSchema": {
    "bazaar": {
      "category": "domain-intelligence",
      "info": {
        "input": {
          "method": "GET",
          "queryParams": {
            "url": "https://example.com/"
          },
          "type": "http"
        },
        "output": {
          "example": {
            "headers": {
              "content_security_policy": "default-src 'self'",
              "permissions_policy": null,
              "referrer_policy": "strict-origin-when-cross-origin",
              "server": null,
              "strict_transport_security": {
                "include_subdomains": true,
                "max_age": 31536000,
                "preload": false,
                "value": "max-age=31536000; includeSubDomains"
              },
              "x_content_type_options": "nosniff",
              "x_frame_options": "DENY",
              "x_powered_by": null
            },
            "queried_at": "2026-07-03T12:00:00Z",
            "status_code": 200,
            "url": "https://example.com/",
            "warnings": [
              "no Permissions-Policy header (powerful browser features are not restricted)"
            ]
          },
          "type": "json"
        }
      },
      "schema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "input": {
            "additionalProperties": false,
            "properties": {
              "method": {
                "enum": [
                  "GET"
                ],
                "type": "string"
              },
              "queryParams": {
                "properties": {
                  "url": {
                    "description": "Absolute http/https URL to audit. Host must be a hostname (not an IP literal), not \"localhost\", and not under a reserved suffix (.local, .internal, .localdomain, .lan, .test). Non-default ports must be allowlisted. Redirects are not followed.",
                    "format": "uri",
                    "type": "string"
                  }
                },
                "required": [
                  "url"
                ],
                "type": "object"
              },
              "type": {
                "const": "http",
                "type": "string"
              }
            },
            "required": [
              "type",
              "method"
            ],
            "type": "object"
          },
          "output": {
            "properties": {
              "example": {
                "properties": {
                  "headers": {
                    "description": "Graded, normalized security headers. Each field is null when the header is absent from the response",
                    "properties": {
                      "content_security_policy": {
                        "type": [
                          "string",
                          "null"
                        ]
                      },
                      "permissions_policy": {
                        "type": [
                          "string",
                          "null"
                        ]
                      },
                      "referrer_policy": {
                        "type": [
                          "string",
                          "null"
                        ]
                      },
                      "server": {
                        "description": "Server header value, if disclosed by the target",
                        "type": [
                          "string",
                          "null"
                        ]
                      },
                      "strict_transport_security": {
                        "properties": {
                          "include_subdomains": {
                            "type": "boolean"
                          },
                          "max_age": {
                            "description": "Parsed max-age in seconds; null if absent or unparseable",
                            "type": [
                              "integer",
                              "null"
                            ]
                          },
                          "preload": {
                            "type": "boolean"
                          },
                          "value": {
                            "description": "Raw Strict-Transport-Security header value",
                            "type": "string"
                          }
                        },
                        "type": [
                          "object",
                          "null"
                        ]
                      },
                      "x_content_type_options": {
                        "type": [
                          "string",
                          "null"
                        ]
                      },
                      "x_frame_options": {
                        "type": [
                          "string",
                          "null"
                        ]
                      },
                      "x_powered_by": {
                        "description": "X-Powered-By header value, if disclosed by the target",
                        "type": [
                          "string",
                          "null"
                        ]
                      }
                    },
                    "type": "object"
                  },
                  "queried_at": {
                    "description": "UTC timestamp the audit was performed",
                    "format": "date-time",
                    "type": "string"
                  },
                  "status_code": {
                    "description": "HTTP status code returned by the target for the HEAD request",
                    "type": "integer"
                  },
                  "url": {
                    "description": "The audited URL, exactly as given",
                    "type": "string"
                  },
                  "warnings": {
                    "description": "Human-readable posture advisories, e.g. missing or weak headers",
                    "items": {
                      "type": "string"
                    },
                    "type": "array"
                  }
                },
                "required": [
                  "url",
                  "status_code",
                  "queried_at",
                  "headers",
                  "warnings"
                ],
                "type": "object"
              },
              "type": {
                "type": "string"
              }
            },
            "required": [
              "type"
            ],
            "type": "object"
          }
        },
        "required": [
          "input"
        ],
        "type": "object"
      },
      "tags": [
        "http",
        "headers",
        "security",
        "hsts",
        "csp",
        "x-frame-options",
        "posture"
      ]
    }
  },
  "tags": [
    "bazaar"
  ],
  "sourceHost": "headers.use.x402atlas.com",
  "lastUpdated": "2026-09-18T07:51:44.746Z",
  "quality": {
    "calls30d": 18,
    "uniquePayers30d": 10,
    "lastCalledAt": "2026-09-18T07:51:44.616Z"
  },
  "liveness": {},
  "verified": false,
  "featured": false,
  "provider": {
    "host": "headers.use.x402atlas.com",
    "manifest_name": "headers.use.x402atlas.com",
    "source": "cdp-mirror",
    "source_manifest_url": "https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources",
    "submitted_at": "2026-09-18T22:00:31.484Z"
  }
}