---
title: "MERCURY Cited Security-Headers Audit"
method: GET
path: "/buy/headers"
tags: ["cited-headers", "security-headers", "http-security", "header-audit", "hsts", "csp", "clickjacking", "vendor-risk", "attestation", "provenance", "verifiable-data-record", "agent-native", "keyless", "data-feed"]
---

# MERCURY Cited Security-Headers Audit

`GET /buy/headers`

## Request

- Base URL: `https://network.mercury-hq.com`
- URL: `https://network.mercury-hq.com/buy/headers`
- Auth: none declared
- TypeScript: <https://skmtc.dev/mercury-hq/apis/mercury-x402-storefront/docs/buy/headers/get.ts> (a function with typed inputs; its response is checked against the schema)

URL → a deterministic HTTP security-headers audit (HSTS, CSP, X-Frame, X-Content-Type, Referrer-Policy, Permissions-Policy + more) with a letter grade and concrete findings, wrapped in a signed, offline-verifiable provenance receipt. Keyless, no LLM, no signup.

## Query parameters

- `url` string, required: the page/endpoint to audit (http/https)

## Response `200`

Delivered after the x402 payment settles on Base mainnet.

- object
  - `ok` boolean, required: true on success; false on an honest failure (never charged for a stub)
  - `url` string, required: final URL after redirects
  - `status` integer: upstream HTTP status of the audited response
  - `text` string: canonical sorted-key JSON of `data` — the exact string the receipt signs over
  - `fetchedAt` string: ISO-8601 fetch time (provenance metadata)
  - `data` object: the deterministic security-headers verdict
    - `grade` 'A' | 'B' | 'C' | 'D' | 'E' | 'F'
    - `score` integer
    - `maxScore` integer
    - `percentage` integer
    - `passed` integer
    - `failed` integer
    - `checks` object[]
      - `header` string
      - `label` string
      - `present` boolean
      - `pass` boolean
      - `weight` integer
      - `value` string, nullable
      - `note` string
    - `findings` object[]
      - `header` string
      - `severity` 'high' | 'medium' | 'low'
      - `remediate` string
    - `serverBanner` string, nullable
    - `rubric` string
  - `error` string: present only when ok:false

## Other responses

- `402`: Payment Required — retry with an x402-signed payment (e.g. x402-fetch). Terms are in the challenge body (x402 v1).

---

[API](https://skmtc.dev/mercury-hq/apis/mercury-x402-storefront.md) - [All operations](https://skmtc.dev/mercury-hq/apis/mercury-x402-storefront/llms.txt) - [OpenAPI document](https://skmtc.dev/mercury-hq/apis/mercury-x402-storefront/revisions/211aa7db24ae?raw)