Api Endpoint

Security Header Diff

Compare a fixed list of ten security-relevant response headers across two releases and name the specific reverts. Reports a header removed, added or changed, and separately a reduced Strict-Transport-Security max-age, dropped includeSubDomains, a newly permitted unsafe-inline or unsafe-eval, and a Content-Security-Policy that moved from enforcing to report-only so it no longer blocks anything. Observable differences only, not an assessment of whether either configuration is adequate.

Open interactive test console

Offering

Provider: api.zfinia.com
Method: POST
Offering type: Api Endpoint
Transport type: http
Category: Security
Delivery: Not provided
Pricing model: Not provided
x402 version: 2

Endpoint context

URL: https://api.zfinia.com/x402/v1/security-header-diff
MIME type: application/json
First seen: 2026-10-16T01:50:38.788Z
Last seen: 2026-11-03T22:41:19.464Z
Tags: http headers, release gate, regression detection, web platform, developer tooling

Website

Payment pricing

x402 payment terms are the authoritative price for calling this endpoint.

Payment option 1: 0.11 USDC
Atomic price: 110000 · Network: eip155:8453 · Asset: USDC · Scheme: exact

Raw x402 terms

[
  {
    "scheme": "exact",
    "network": "eip155:8453",
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "amount": "110000",
    "payTo": "0x25e8245f07d5e4873987293dad666afbe56a9608"
  }
]

Observed health

Status: Reachable
Latest latency: 1008 ms
Average latency: 1008 ms
HTTP status: 400
Last checked: 2026-11-02T07:14:23.423Z
Reachability: 100% over 13 checks

Latency is measured to the first response headers. A reachable result does not verify response accuracy or merchant identity.

Input schema

{
  "body": {
    "after": {
      "Content-Security-Policy-Report-Only": "default-src 'self'; script-src 'self' 'unsafe-inline'",
      "Referrer-Policy": "no-referrer",
      "Strict-Transport-Security": "max-age=600",
      "X-Frame-Options": "SAMEORIGIN"
    },
    "after_name": "release-42",
    "before": {
      "Content-Security-Policy": "default-src 'self'; script-src 'self'",
      "Referrer-Policy": "no-referrer",
      "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
      "X-Content-Type-Options": "nosniff",
      "X-Frame-Options": "DENY"
    },
    "before_name": "release-41"
  },
  "bodyType": "json",
  "method": "POST",
  "type": "http"
}

Output schema

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "properties": {
    "input": {
      "additionalProperties": false,
      "properties": {
        "body": {
          "additionalProperties": false,
          "properties": {
            "after": {
              "type": "object"
            },
            "after_name": {
              "maxLength": 64,
              "type": "string"
            },
            "before": {
              "type": "object"
            },
            "before_name": {
              "maxLength": 64,
              "type": "string"
            }
          },
          "required": [
            "before",
            "after"
          ],
          "type": "object"
        },
        "bodyType": {
          "enum": [
            "json",
            "form-data",
            "text"
          ],
          "type": "string"
        },
        "method": {
          "enum": [
            "POST"
          ],
          "type": "string"
        },
        "type": {
          "const": "http",
          "type": "string"
        }
      },
      "required": [
        "type",
        "method",
        "bodyType",
        "body"
      ],
      "type": "object"
    },
    "output": {
      "properties": {
        "example": {
          "type": "object"
        },
        "type": {
          "type": "string"
        }
      },
      "required": [
        "type"
      ],
      "type": "object"
    }
  },
  "required": [
    "input"
  ],
  "type": "object"
}