DEV Community

HAL GOBVAN
HAL GOBVAN

Posted on Originally published at epson-rpm-america-satisfy.trycloudflare.com

Building paid security.txt, rel-attribute, and security-headers APIs for AI agents (x402)

#ai #api #python #security

Three new sub-cent endpoints just shipped to the URL Metadata API (x402-paid on Base mainnet). Each costs $0.0005 USDC per call — five tenths of a USDC cent — and runs through the same pay-once-call-once x402 settlement the rest of the 35-route catalog uses. Here's what each one does and which agents should care.

1. GET /api/securitytxt?url=<URL> — RFC 9116 security.txt discovery

Probes /.well-known/security.txt and the legacy /security.txt path, parses the file per RFC 9116, and returns the structured fields:

  • Contact: (mailto, tel, https URLs)
  • Expires: classified as valid / expiring_soon / expired with days_until_expiry
  • Encryption:, Preferred-Languages:, Canonical:, Policy:, Acknowledgments:, Hiring:
  • A-F grade weighted on Contact presence + Expires validity + Encryption + Languages + Canonical + Policy

If no security.txt exists at either path, returns found: false with grade: "F" and a high-severity finding. Built for security-disclosure ingestion agents, vendor-risk agents that need to confirm a target's disclosure flow is monitored, and attack-surface monitoring agents that check if a vendor's disclosure channel is expired.

$ curl 'https://epson-rpm-america-satisfy.trycloudflare.com/api/securitytxt?url=https://example.com'   -H "X-Payment: <x402 payment-required envelope>"
{
  "found": true,
  "contact": ["mailto:security@example.com"],
  "expires_status": "valid",
  "days_until_expiry": 287,
  "grade": "A"
}
Enter fullscreen mode Exit fullscreen mode

2. GET /api/relattrs?url=<URL> — Outbound-link rel-attribute audit

Walks every <a href> on the page, classifies them as outbound (different origin) vs internal (same origin), counts the rel= attribute tokens (nofollow, sponsored, ugc, noopener, noreferrer, opener, me), and returns:

  • outbound.no_rel_pct, nofollow_pct, sponsored_pct, ugc_pct
  • Counts of target=_blank outbound links missing noopener / noreferrer (reverse-tabnabbing risk)
  • Findings for outbound_no_rel, outbound_missing_noopener, empty_href, javascript_href
  • A-F grade (D when >50% of outbound links have no rel attribute; A otherwise)
  • sample_outbound: first 5 outbound <a> with anchor text + rel + target

The Google link-scheme policy penalizes paid or promotional links missing rel="sponsored" or rel="nofollow". Built for affiliate-program compliance agents that need to verify every paid link in a publisher's article is properly tagged, UGC-platform safety agents that audit comment platforms, and SEO link-audit agents building link-graph signal maps.

3. GET /api/securityheaders?url=<URL> — Focused HTTP security headers audit

Distinct from /api/headers (which categorizes every response header into caching/CORS/security/content/server buckets), this endpoint audits only the security-relevant headers:

  • Strict-Transport-Security with parsed max-age + includeSubDomains + preload flags
  • X-Frame-Options with normalized value (DENY/SAMEORIGIN)
  • X-Content-Type-Options with nosniff check
  • Referrer-Policy classified by strictness (flags unsafe-url / no-referrer-when-downgrade as medium-severity)
  • Permissions-Policy with parsed feature count
  • Cross-Origin-Opener-Policy (COOP)
  • Cross-Origin-Resource-Policy (CORP)
  • Cross-Origin-Embedder-Policy (COEP)

Clickjacking protection is accepted from either X-Frame-Options OR Content-Security-Policy frame-ancestors (modern browsers prefer CSP, so a strict frame-ancestors is enough). Returns per-finding severity + A-F grade weighted by severity.

Built for frontend-security audit agents that need a focused HSTS/XFO/XCTO/COOP-grade signal, compliance agents verifying against SOC 2 / ISO 27001 baseline controls, and browser-extension safety review agents that need to assess the security posture of any URL before allowing navigation.

Try them

All three are live on the URL Metadata API x402 catalog:

GET /api/securitytxt?url=https://example.com       $0.0005 USDC
GET /api/relattrs?url=https://example.com          $0.0005 USDC
GET /api/securityheaders?url=https://example.com   $0.0005 USDC
Enter fullscreen mode Exit fullscreen mode

Discovery doc: /.well-known/x402 — lists all 35 paid routes + 1 free with tiered pricing. OpenAPI spec with x-payment-info extensions on every paid route at /openapi.json.

Settlement

  • Network: Base mainnet (eip155:8453)
  • Token: USDC (0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913)
  • Settlement address: 0xCa0a6c6Aa7A8F0D5893636CF166Ea2b44fb6500c
  • Facilitator: pay.openfacilitator.io

Use any x402-compatible client (the x402 Python SDK, the x402 fetch wrapper, or the CDP SDK) — all three endpoints advertise valid Bazaar extensions for CDP Bazaar discovery on first settle.

Top comments (0)