{"slug":"saylorinnovations-com-api-audit-headers-c73f24","title":"HTTP security header audit for any URL","host":"saylorinnovations.com","method":"GET","resource":"https://saylorinnovations.com/api/audit/headers","category":"code","description":"HTTP security header audit for any URL - HSTS, CSP, clickjacking, referrer policy, cookies and a letter grade","price_listed":0.01,"price_asked":0.01,"state":"answering","state_label":"Answering","checks_7d":1,"answered_7d":1,"latency_ms_median":318,"reported_calls_30d":2,"reported_payers_30d":2,"networks":["eip155:8453","solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"],"badge":"unverified","paid_checks_7d":0,"paid_ok_7d":0,"example_input":{"method":"GET","queryParams":{"url":"https://saylorinnovations.com"},"type":"http"},"output_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"input":{"additionalProperties":false,"properties":{"method":{"enum":["GET","POST","PUT","PATCH","DELETE","HEAD"],"type":"string"},"queryParams":{"properties":{"url":{"description":"Public http(s) URL or bare domain to audit; private, loopback and link-local addresses are refused","examples":["https://example.com","github.com"],"maxLength":2000,"pattern":"^(https?://)?[A-Za-z0-9.-]+\\.[A-Za-z]{2,}.*$","type":"string"}},"required":["url"],"type":"object"},"type":{"const":"http","type":"string"}},"required":["type","method"],"type":"object"},"output":{"properties":{"example":{"properties":{"checked_at":{"description":"Time the check was run (UTC)","type":["string","null"]},"findings":{"description":"One entry per header or check","items":{"properties":{"detail":{"description":"What was observed","type":"string"},"fix":{"description":"Recommended header value or action, or null","type":["string","null"]},"header":{"description":"Header or check name","type":"string"},"status":{"description":"pass, warn, fail or info","type":"string"}},"type":"object"},"type":"array"},"grade":{"description":"Letter grade A to F","type":"string"},"http_status":{"description":"HTTP status code returned","type":["number","null"]},"https":{"description":"True when the final URL is HTTPS","type":"boolean"},"redirects":{"description":"Redirect chain followed","type":["number","null"]},"scope":{"description":"Scope the result covers","type":["string","null"]},"score":{"description":"Score from 0 to 100 (penalties per missing or weak header)","type":"number"},"summary":{"description":"Counts of failing, warning and passing checks","type":"object"},"url":{"description":"Final URL after redirects that was audited","type":"string"}},"required":["url","grade","score","findings"],"type":"object"},"type":{"const":"json","type":"string"}},"required":["type"],"type":"object"}},"required":["input"],"type":"object"},"history":[{"day":"2026-10-18","reachable":true,"status":402,"valid_402":true,"asked_usdc":0.01,"price_match":true,"latency_ms":318,"error":null}],"description_full":"HTTP security header audit for any URL - HSTS, CSP, clickjacking, referrer policy, cookies and a letter grade","last_updated":"2026-10-16T00:39:03.135Z","schemes":["exact"]}