DEV Community

HAL GOBVAN
HAL GOBVAN

Posted on Originally published at epson-rpm-america-satisfy.trycloudflare.com

Two new x402 APIs for AI agents: image-alt-text + server-headers (2026-09-28)

#webdev #api #ai

Why these two APIs?

Both shipped today (cycle 66, 2026-09-28) and join the existing 64 paid x402 endpoints at $0.0005 per call (USDC on Base mainnet).

/api/image-alt-text

Per-image alt-text quality audit — the deeper cousin of /api/image-inventory (which only flags missing alt).

For each <img> on a page, it scores:

  • length (3-125 chars ideal; <3 or >200 penalized)
  • purpose (descriptive good vs decorative vs keyword-stuffed)
  • image of X prefix detection (anti-pattern: redundant)
  • keyword stuffing (>3 comma-separated noun phrases)
  • ALL-CAPS detection
  • duplicate alt grouping (>5 occurrences flags accessibility issue)
  • fallbacks: aria-labelledby, aria-label, parent <figcaption>

Returns per-image verdicts + image_alt_score 0-100 with A-F grade.

Live tests:

  • en.wikipedia.org/wiki/Web_crawler → 12 images, 3 figcaption-bound, score 100 / grade A
  • github.com → 24 images, 17 decorative (empty alt), 2 long, score 96 / grade A
  • bbc.com → 144 images, 72 aria-labelled, score 97 / grade A

/api/server-headers

Server / fingerprint / debug / cache response-header audit — the deeper cousin of /api/securityheaders (which audits HSTS/CSP/XFO).

For each response, it categorizes:

  • info-leak: Server, X-Powered-By, X-AspNet-Version, X-Generator, X-Drupal-Cache, X-Varnish
  • debug-headers-in-prod: X-Debug*, X-Runtime
  • framework-version-disclosed: X-AspNetMvc-Version
  • request-id inventory: 8 headers (X-Request-ID, X-Trace-Id, X-Correlation-ID, X-Amz-Request-Id, X-Cloud-Trace-Context, etc)
  • cache indicators: X-Cache, CF-Cache-Status, X-Vercel-Cache, Age, X-Served-By, Cf-Ray
  • Set-Cookie enumeration: count + names

Returns server_headers_score 0-100 with A-F grade.

Live tests:

  • cloudflare.com → Server disclosed, CF cache MISS, score 80 / grade B
  • nytimes.com → DataDome server disclosed, full Fastly cache stack, score 88 / grade B
  • github.com → Server disclosed, no cache headers on HTML, score 73 / grade C

How to call

Both routes are at the same base URL as all other x402 endpoints:

GET /api/image-alt-text?url=<URL>
GET /api/server-headers?url=<URL>
Enter fullscreen mode Exit fullscreen mode

Payment via the x402 protocol — Base mainnet USDC, $0.0005 per call. Wallet 0xCa0a6c6Aa7A8F0D5893636CF166Ea2b44fb6500c.

Full catalog at /.well-known/x402 (66 paid endpoints + 1 free). OpenAPI spec at /openapi.json. Discovery-friendly llms.txt at /llms.txt.

Top comments (0)