analyze_headers
Read-onlyIdempotent
Check raw HTTP response headers from a deployment you already operate. Returns the same object as POST /v1/analyze. Unknown fields are ignored. A url field is not fetched. Nothing is stored. Nothing is for sale.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| platform | No | Platform whose config the caller can edit. A fix snippet is attached only for caddy, nginx, vercel, netlify, or nextjs. Any other declared platform, or an omitted platform, returns fix null. This server does not guess the platform from the Server header. | |
| config_text | No | Optional config text. Not copied into the response. When platform is caddy and this is non-empty, GLC-HSTS-MISSING includes config_header present or absent for one Caddy Strict-Transport-Security form with max-age greater than 0, GLC-CSP-MISSING includes config_header present or absent for one Caddy Content-Security-Policy form with a non-empty quoted value, GLC-NOSNIFF-MISSING includes config_header present or absent for one Caddy X-Content-Type-Options form set to nosniff, GLC-FRAME-MISSING includes config_header present or absent for one Caddy X-Frame-Options form set to DENY or SAMEORIGIN, GLC-REFERRER-MISSING includes config_header present or absent for one Caddy Referrer-Policy form with a non-empty value, and GLC-SERVER-VERSION-LEAK includes config_header present or absent only when that text deletes both Server and X-Powered-By. One deletion is absent. GLC-CORS-WILDCARD-CREDENTIALS includes config_header present or absent for one Caddy > replace of Access-Control-Allow-Origin whose replacement is non-empty and is not *. A line that sets that header without >, and a deletion, are absent. A Content-Security-Policy frame-ancestors line does not count as X-Frame-Options. When platform is nginx and this is non-empty, GLC-HSTS-MISSING includes config_header present or absent for one nginx add_header Strict-Transport-Security line with max-age greater than 0, GLC-CSP-MISSING includes config_header present or absent for one nginx add_header Content-Security-Policy line whose quoted value is non-empty after trim, and GLC-NOSNIFF-MISSING includes config_header present or absent for one nginx add_header X-Content-Type-Options line whose quoted value is nosniff. Any other value is absent. GLC-FRAME-MISSING includes config_header present or absent for one nginx add_header X-Frame-Options line whose quoted value is DENY or SAMEORIGIN. Any other value is absent. Content-Security-Policy-Report-Only does not count. A Content-Security-Policy frame-ancestors line does not count as X-Frame-Options. An empty quoted value, or a quoted value that is only spaces, is absent. A value that contains {, }, or $ is absent. GLC-REFERRER-MISSING includes config_header present or absent for one nginx add_header Referrer-Policy line whose quoted value is non-empty after trim. After trim, the accepted lines are add_header Referrer-Policy "<value>" always; and add_header Referrer-Policy "<value>";. The semicolon is required. An empty quoted value, or a quoted value that is only spaces, is absent. A value that contains {, }, or $ is absent. When platform is nginx, the version-leak field is present only for both lines server_tokens off; and proxy_hide_header X-Powered-By;. One of those lines is absent. The CORS field is present for one add_header Access-Control-Allow-Origin line whose quoted value is non-empty after trim and is not *. When platform is vercel, JSON headers entries are scanned for HSTS, CSP, nosniff, frame, referrer, and Access-Control-Allow-Origin using those same value rules, and the version-leak field is absent because vercel.json cannot delete Server or X-Powered-By. When platform is netlify, an indented Header: value line is scanned the same way, and the version-leak field is absent. When platform is nextjs, a headers() key and value pair is scanned the same way, and the version-leak field is present only when poweredByHeader is false. A value that contains {, }, or $ is absent. The Caddy scans still run only when platform is caddy. Other config text is not checked. Do not include secret values. | |
| headers_raw | Yes | Raw HTTP response headers from a deployment this agent already operates, including an optional status line, as curl -sI prints them. This server does not request a URL. | |
| paths_tested | No | Optional paths. Accepted and not checked. This server does not request them. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| notes | Yes | ||
| schema | Yes | ||
| checked | Yes | ||
| findings | Yes | ||
| platform | Yes | ||
| config_text | Yes | ||
| paths_tested_count | Yes | ||
| parsed_header_count | Yes |