LIVE

HTTP Headers

Read allowlisted HTTPS response headers for a hostname (HSTS, CSP, server, CORS). Use when you need live origin headers and must not guess. HEAD of https://{domain}/ on :443; GET if HEAD is 405/501. Redirects are not followed.

LIVE $0.005 USDC GET /v1/tools/headers

When to use

Try

Opens the live endpoint. Unpaid browser requests show the paywall; agents should send Accept: application/json.

/v1/tools/headers?domain=example.com

Full URL: https://api.fetchx402.com/v1/tools/headers?domain=example.com

Request

GET /v1/tools/headers · x402 V2 · USDC on Base · $0.005 USDC

x402 V2 curl

Expect HTTP 402 and a PAYMENT-REQUIRED header until you retry with PAYMENT-SIGNATURE.

curl -i -H "Accept: application/json" "https://api.fetchx402.com/v1/tools/headers?domain=example.com"

Cursor mcp.json

Intended config for @fetchx402/mcp. This is not npm @x402/fetch (a payment fetch wrapper).

{
  "mcpServers": {
    "fetchx402": {
      "args": [
        "-y",
        "@fetchx402/mcp"
      ],
      "command": "npx",
      "env": {
        "X402_PRIVATE_KEY": "0xYOUR_SPENDING_KEY"
      }
    }
  }
}

Query parameters

Name	Type	Required	Description
`domain`	string	required	Public fully-qualified domain name to fetch, such as example.com. We HEAD https://{domain}/ on :443 (GET if HEAD is 405/501). IPs, localhost, and internal/mDNS names are rejected. Redirects are not followed.

Success fields

Field	Type	Description
`domain`	string	Normalized FQDN that was fetched
`url`	string	HTTPS origin we requested (always / in v1)
`method`	string	HTTP method that produced the headers (HEAD or GET)
`status`	integer	HTTP status from the origin. 3xx still HTTP 200 from us
`peer_ip`	string	Connected peer IP after ConnectGuard
`headers`	object	Allowlisted response headers (lowercase names). Absent headers are null. Cookies and hop-by-hop headers are omitted.

Example

Frozen fixture. Not a live lookup.

{
  "domain": "example.com",
  "headers": {
    "access-control-allow-origin": null,
    "cache-control": "max-age=604800",
    "content-security-policy": null,
    "content-security-policy-report-only": null,
    "content-type": "text/html",
    "cross-origin-opener-policy": null,
    "cross-origin-resource-policy": null,
    "location": null,
    "permissions-policy": null,
    "referrer-policy": null,
    "server": "ECS (nyb/1D2A)",
    "strict-transport-security": "max-age=31536000",
    "www-authenticate": null,
    "x-content-type-options": null,
    "x-frame-options": null,
    "x-powered-by": null
  },
  "method": "HEAD",
  "peer_ip": "23.215.0.138",
  "status": 200,
  "url": "https://example.com/"
}

Payment

Unpaid requests return HTTP 402 with a base64 PAYMENT-REQUIRED header. Retry the same URL with PAYMENT-SIGNATURE. Settlement completes before the tool runs. Full handshake and shared payment errors: Payments.

Errors

HTTP	Code	When
400	`invalid_domain`	Domain is missing, malformed, an IP address, or a blocked/internal name
400	`blocked_address`	The domain resolved to a private, loopback, or metadata address
402	`payment_required`	Missing or invalid PAYMENT-SIGNATURE; decode the PAYMENT-REQUIRED header
404	`nxdomain`	The domain name does not exist
502	`connect_failed`	TCP connection to the host failed
502	`handshake_failed`	TLS handshake failed
502	`http_failed`	HTTPS request failed after connect
503	`overloaded`	Tool concurrency cap reached; retry shortly
504	`headers_timeout`	HTTPS header fetch timed out
409	`payment_in_progress`	The same authorization nonce is already being settled; retry shortly
429	`rate_limited`	Too many requests from this client
503	`settlement_uncertain`	Settlement is unconfirmed; retry with the same PAYMENT-SIGNATURE
503	`facilitator_unavailable`	Payment facilitator unavailable
503	`facilitator_misconfigured`	Payment facilitator is not configured
503	`facilitator_unauthorized`	Payment facilitator rejected credentials
503	`ledger_unavailable`	Payment ledger unavailable
503	`payment_unavailable`	Payment processing unavailable

Guarantees

Settlement finishes before the tool executes. Uncertain settlement fails closed (HTTP 503).
Lookups run on our nodes — no third-party data API wrappers.
Localhost, IP literals, and metadata hostnames are rejected.
Execution is timeout-bounded and concurrency-capped.