HTTP headers + security analysis · Http Headers

import { wrapFetchWithPayment } from "@x402/fetch";
import { privateKeyToAccount } from "viem/accounts";

const account = privateKeyToAccount(process.env.PRIVATE_KEY);
const fetchWithPay = wrapFetchWithPayment(fetch, account);

const res = await fetchWithPay("https://agent402.tools/api/http-headers", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    "url": "https://example.com"
  }),
});
const data = await res.json();

curl -X POST \
  "https://agent402.tools/api/http-headers" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}' \
  -H "X-PAYMENT: <signed x402 payment>"

{
  "fetchedAt": "2026-06-19T22:00:00.000Z",
  "finalUrl": "https://example.com/",
  "headers": {
    "content-type": "text/html; charset=UTF-8",
    "server": "ECAcc (nyd/D17C)"
  },
  "httpVersion": null,
  "redirected": false,
  "security": {
    "findings": [
      {
        "header": "HSTS",
        "present": false,
        "value": null
      }
    ],
    "score": 0,
    "warnings": [
      "Server header leaks identity: ECAcc (nyd/D17C)"
    ]
  },
  "status": 200,
  "statusText": "OK",
  "url": "https://example.com/"
}