HTTP Security Headers Check

[
  {
    "error": "Payment required",
    "accepts": [
      {
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "tier": "standard",
          "version": "2",
          "merchant": "x402Atlas"
        },
        "payTo": "0x7f8043c400799643bcb62B41B84b297a8Ecb7b9c",
        "amount": "10000",
        "scheme": "exact",
        "network": "eip155:8453",
        "maxTimeoutSeconds": 300
      },
      {
        "asset": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
        "extra": {
          "name": "USD Coin",
          "tier": "standard",
          "version": "2",
          "merchant": "x402Atlas"
        },
        "payTo": "0x7f8043c400799643bcb62B41B84b297a8Ecb7b9c",
        "amount": "10000",
        "scheme": "exact",
        "network": "eip155:137",
        "maxTimeoutSeconds": 300
      },
      {
        "asset": "0xaf88d065e77c8cC2239327C5EDb3A432268e5831",
        "extra": {
          "name": "USD Coin",
          "tier": "standard",
          "version": "2",
          "merchant": "x402Atlas"
        },
        "payTo": "0x7f8043c400799643bcb62B41B84b297a8Ecb7b9c",
        "amount": "10000",
        "scheme": "exact",
        "network": "eip155:42161",
        "maxTimeoutSeconds": 300
      },
      {
        "asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
        "extra": {
          "tier": "standard",
          "feePayer": "D6ZhtNQ5nT9ZnTHUbqXZsTx5MH2rPFiBBggX4hY1WePM",
          "merchant": "x402Atlas"
        },
        "payTo": "ASt6xvRyQ7ntERsmcYVMdLqZvz1GEN8Fzexzq62tXrNQ",
        "amount": "10000",
        "scheme": "exact",
        "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
        "maxTimeoutSeconds": 300
      }
    ],
    "resource": {
      "url": "https://headers.use.x402atlas.com/",
      "tags": [
        "http",
        "headers",
        "security",
        "hsts",
        "csp",
        "x-frame-options",
        "posture"
      ],
      "mimeType": "application/json",
      "description": "Audit a URL's HTTP security headers over a single body-free (HEAD) request. Grades Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, flags information-leak headers (Server, X-Powered-By), and returns the parsed values plus advisory warnings. Clean JSON for security and pentest automation.",
      "serviceName": "HTTP Security Headers Check"
    },
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "type": "http",
            "method": "GET",
            "queryParams": {
              "url": "https://example.com/"
            }
          },
          "output": {
            "type": "json",
            "example": {
              "url": "https://example.com/",
              "headers": {
                "server": null,
                "x_powered_by": null,
                "referrer_policy": "strict-origin-when-cross-origin",
                "x_frame_options": "DENY",
                "permissions_policy": null,
                "x_content_type_options": "nosniff",
                "content_security_policy": "default-src 'self'",
                "strict_transport_security": {
                  "value": "max-age=31536000; includeSubDomains",
                  "max_age": 31536000,
                  "preload": false,
                  "include_subdomains": true
                }
              },
              "warnings": [
                "no Permissions-Policy header (powerful browser features are not restricted)"
              ],
              "queried_at": "2026-07-03T12:00:00Z",
              "status_code": 200
            }
          }
        },
        "tags": [
          "http",
          "headers",
          "security",
          "hsts",
          "csp",
          "x-frame-options",
          "posture"
        ],
        "schema": {
          "type": "object",
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "required": [
            "input"
          ],
          "properties": {
            "input": {
              "type": "object",
              "required": [
                "type",
                "method"
              ],
              "properties": {
                "type": {
                  "type": "string",
                  "const": "http"
                },
                "method": {
                  "enum": [
                    "GET"
                  ],
                  "type": "string"
                },
                "queryParams": {
                  "type": "object",
                  "required": [
                    "url"
                  ],
                  "properties": {
                    "url": {
                      "type": "string",
                      "format": "uri",
                      "description": "Absolute http/https URL to audit. Host must be a hostname (not an IP literal), not \"localhost\", and not under a reserved suffix (.local, .internal, .localdomain, .lan, .test). Non-default ports must be allowlisted. Redirects are not followed."
                    }
                  }
                }
              },
              "additionalProperties": false
            },
            "output": {
              "type": "object",
              "required": [
                "type"
              ],
              "properties": {
                "type": {
                  "type": "string"
                },
                "example": {
                  "type": "object",
                  "required": [
                    "url",
                    "status_code",
                    "queried_at",
                    "headers",
                    "warnings"
                  ],
                  "properties": {
                    "url": {
                      "type": "string",
                      "description": "The audited URL, exactly as given"
                    },
                    "headers": {
                      "type": "object",
                      "properties": {
                        "server": {
                          "type": [
                            "string",
                            "null"
                          ],
                          "description": "Server header value, if disclosed by the target"
                        },
                        "x_powered_by": {
                          "type": [
                            "string",
                            "null"
                          ],
                          "description": "X-Powered-By header value, if disclosed by the target"
                        },
                        "referrer_policy": {
                          "type": [
                            "string",
                            "null"
                          ]
                        },
                        "x_frame_options": {
                          "type": [
                            "string",
                            "null"
                          ]
                        },
                        "permissions_policy": {
                          "type": [
                            "string",
                            "null"
                          ]
                        },
                        "x_content_type_options": {
                          "type": [
                            "string",
                            "null"
                          ]
                        },
                        "content_security_policy": {
                          "type": [
                            "string",
                            "null"
                          ]
                        },
                        "strict_transport_security": {
                          "type": [
                            "object",
                            "null"
                          ],
                          "properties": {
                            "value": {
                              "type": "string",
                              "description": "Raw Strict-Transport-Security header value"
                            },
                            "max_age": {
                              "type": [
                                "integer",
                                "null"
                              ],
                              "description": "Parsed max-age in seconds; null if absent or unparseable"
                            },
                            "preload": {
                              "type": "boolean"
                            },
                            "include_subdomains": {
                              "type": "boolean"
                            }
                          }
                        }
                      },
                      "description": "Graded, normalized security headers. Each field is null when the header is absent from the response"
                    },
                    "warnings": {
                      "type": "array",
                      "items": {
                        "type": "string"
                      },
                      "description": "Human-readable posture advisories, e.g. missing or weak headers"
                    },
                    "queried_at": {
                      "type": "string",
                      "format": "date-time",
                      "description": "UTC timestamp the audit was performed"
                    },
                    "status_code": {
                      "type": "integer",
                      "description": "HTTP status code returned by the target for the HEAD request"
                    }
                  }
                }
              }
            }
          }
        },
        "category": "domain-intelligence"
      }
    },
    "x402Version": 2
  }
]