Index onlineMerchant portal
Api Endpoint

HTTP Security Headers Check

Audit a URL's HTTP security headers over a single body-free (HEAD) request. Grades Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, flags information-leak headers (Server, X-Powered-By), and returns the parsed values plus advisory warnings. Clean JSON for security and pentest automation.

Open interactive test console

Offering

Provider
headers.use.x402atlas.com
Method
GET
Offering type
Api Endpoint
Transport type
http
Category
Security
Delivery
Not provided
Pricing model
Not provided
x402 version
2

Endpoint context

URL
https://headers.use.x402atlas.com/
MIME type
application/json
First seen
2026-10-16T01:50:06.715Z
Last seen
Tags
HTTP, headers, Security, hsts, csp, x-frame-options, posture

Website

Payment pricing

x402 payment terms are the authoritative price for calling this endpoint.

Payment option 1
0.01 USDC
Atomic price: 10000 · Network: eip155:8453 · Asset: USDC · Scheme: exact
Payment option 2
0.01 USDC
Atomic price: 10000 · Network: eip155:137 · Asset: USDC · Scheme: exact
Payment option 3
0.01 USDC
Atomic price: 10000 · Network: eip155:42161 · Asset: USDC · Scheme: exact
Payment option 4
0.01 USDC
Atomic price: 10000 · Network: solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp · Asset: USDC · Scheme: exact
Raw x402 terms
[
  {
    "scheme": "exact",
    "network": "eip155:8453",
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "amount": "10000",
    "payTo": "0x7f8043c400799643bcb62B41B84b297a8Ecb7b9c"
  },
  {
    "scheme": "exact",
    "network": "eip155:137",
    "asset": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
    "amount": "10000",
    "payTo": "0x7f8043c400799643bcb62B41B84b297a8Ecb7b9c"
  },
  {
    "scheme": "exact",
    "network": "eip155:42161",
    "asset": "0xaf88d065e77c8cC2239327C5EDb3A432268e5831",
    "amount": "10000",
    "payTo": "0x7f8043c400799643bcb62B41B84b297a8Ecb7b9c"
  },
  {
    "scheme": "exact",
    "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
    "asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
    "amount": "10000",
    "payTo": "3nXsChcZGke6xebDPmndNMCt8L3yi6xyN4Pd6q5cQrgv"
  }
]

Observed health

Status
Healthy
Latest latency
16 ms
Average latency
14 ms
HTTP status
402
Last checked
Reachability
100% over 12 checks

Latency is measured to the first response headers. A reachable result does not verify response accuracy or merchant identity.

Input schema

{
  "additionalProperties": false,
  "properties": {
    "method": {
      "enum": [
        "GET"
      ],
      "type": "string"
    },
    "queryParams": {
      "properties": {
        "url": {
          "description": "Absolute http/https URL to audit. Host must be a hostname (not an IP literal), not \"localhost\", and not under a reserved suffix (.local, .internal, .localdomain, .lan, .test). Non-default ports must be allowlisted. Redirects are not followed.",
          "format": "uri",
          "type": "string"
        }
      },
      "required": [
        "url"
      ],
      "type": "object"
    },
    "type": {
      "const": "http",
      "type": "string"
    }
  },
  "required": [
    "type",
    "method"
  ],
  "type": "object"
}

Output schema

{
  "properties": {
    "example": {
      "properties": {
        "headers": {
          "description": "Graded, normalized security headers. Each field is null when the header is absent from the response",
          "properties": {
            "content_security_policy": {
              "type": [
                "string",
                "null"
              ]
            },
            "permissions_policy": {
              "type": [
                "string",
                "null"
              ]
            },
            "referrer_policy": {
              "type": [
                "string",
                "null"
              ]
            },
            "server": {
              "description": "Server header value, if disclosed by the target",
              "type": [
                "string",
                "null"
              ]
            },
            "strict_transport_security": {
              "properties": {
                "include_subdomains": {
                  "type": "boolean"
                },
                "max_age": {
                  "description": "Parsed max-age in seconds; null if absent or unparseable",
                  "type": [
                    "integer",
                    "null"
                  ]
                },
                "preload": {
                  "type": "boolean"
                },
                "value": {
                  "description": "Raw Strict-Transport-Security header value",
                  "type": "string"
                }
              },
              "type": [
                "object",
                "null"
              ]
            },
            "x_content_type_options": {
              "type": [
                "string",
                "null"
              ]
            },
            "x_frame_options": {
              "type": [
                "string",
                "null"
              ]
            },
            "x_powered_by": {
              "description": "X-Powered-By header value, if disclosed by the target",
              "type": [
                "string",
                "null"
              ]
            }
          },
          "type": "object"
        },
        "queried_at": {
          "description": "UTC timestamp the audit was performed",
          "format": "date-time",
          "type": "string"
        },
        "status_code": {
          "description": "HTTP status code returned by the target for the HEAD request",
          "type": "integer"
        },
        "url": {
          "description": "The audited URL, exactly as given",
          "type": "string"
        },
        "warnings": {
          "description": "Human-readable posture advisories, e.g. missing or weak headers",
          "items": {
            "type": "string"
          },
          "type": "array"
        }
      },
      "required": [
        "url",
        "status_code",
        "queried_at",
        "headers",
        "warnings"
      ],
      "type": "object"
    },
    "type": {
      "type": "string"
    }
  },
  "required": [
    "type"
  ],
  "type": "object"
}