HTTP headers + redirect chain as paid API endpoints — building security-audit tools for AI agents

Why AI agents need cheap header/redirect inspection

Two of the most common building blocks for autonomous agents are security-audit checks and link-safety validation. Both boil down to "what did this URL actually return and where did it end up?" Until recently that meant either self-hosting a headless browser (expensive, slow, easy to fingerprint-block) or relying on free APIs that rate-limit hard.

The x402 micropayments standard on Base mainnet solves this elegantly: the agent pays per call in USDC (no subscription, no signup, no API key) and gets the response immediately. We're shipping two new sub-cent endpoints to fill specific gaps.

/api/headers — $0.0005 USDC per call

Returns every HTTP response header for any URL, plus a categorized security audit:

• caching: Cache-Control, Expires, ETag, Vary
• cors: Access-Control-Allow-Origin/Methods/Headers/Credentials/Max-Age
• security: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
• content: Content-Type, Content-Length, Content-Encoding
• server_info: Server, X-Powered-By, X-Generator, Via

Plus an A-F security grade based on presence of CSP + HSTS + XFO + XCTO + Referrer-Policy. Example:

{
  "url": "https://example.com",
  "status_code": 200,
  "headers": {"Content-Type": "text/html; charset=UTF-8", "Server": "ECS (sec/9744)"},
  "security_grade": "D",
  "security_headers_present": 1,
  "categories": {"caching": [], "cors": [], "security": ["x-content-type-options"], "content": ["Content-Type"], "server_info": ["Server"]}
}

Built for QA agents auditing site headers, compliance agents verifying security policies, and SEO agents validating technical health.

/api/redirects — $0.0005 USDC per call

Returns the full HTTP redirect chain for any URL: every hop, status code, Location header, redirect type (permanent 301/308 vs temporary 302/303/307), response time, plus a final destination check and domain-change flag for link-safety:

{
  "url": "https://bit.ly/example",
  "final_url": "https://example.com/landing",
  "hop_count": 2,
  "classification": "short_chain",
  "domain_changed": true,
  "chain": [
    {"step": 0, "url": "https://bit.ly/example", "status_code": 301, "location": "https://example.com/landing", "redirect_type": "permanent"},
    {"step": 1, "url": "https://example.com/landing", "status_code": 200, "redirect_type": "final"}
  ]
}

Use cases: shortlink safety (is the shortened URL actually pointing where it says?), tracking-link auditing (did the domain change between click and destination?), affiliate-link verification, URL preview validation.

Full catalog now at 17 paid routes

These two new endpoints join the existing 15: extract, summarize, keywords, og, robots, links, feed, markdown, headings, canonical, sitemap, tech, hash, schema, emails. Pricing tiers from $0.0005 to $0.005 USDC per call. Discovery: /.well-known/x402, full OpenAPI spec at /openapi.json, all settling USDC to 0xCa0a6c6Aa7A8F0D5893636CF166Ea2b44fb6500c on Base mainnet via pay.openfacilitator.io.

For autonomous AI agents, this means 17 production-grade URL parsing tools with per-call pricing — no API keys, no subscriptions, no rate limits beyond per-wallet pay-as-you-go. Built the boring infrastructure so you can focus on the agent logic.