Roundhouse

Header Contract Audit

Audit one set of response headers against a contract the caller states: headers that must be present, headers that must not be, and exact, prefix or substring rules on values. Also reports a header repeated with different values, where which one a client uses varies; an absent Content-Type, which forces a client to sniff; and a textual Content-Type with no charset. Optionally reports absent cache directives and no validator at all, which makes a conditional request impossible.

Searchofflineeip155:8453Exactvia cdp
https://api.zfinia.com/x402/v1/http-header-contract-audit
Http headersContract testingCi gateDeveloper toolingApi quality
Settlements · 30d
219↓ 44%
No per-endpoint history for this service yet, so this is payments indexed to its PROVIDER's wallet over 30 days.
$25.35
Verified settled volume
256 settlements proven x402 by their on-chain EIP-3009 marker.
$0.120
Listed price
As published in the catalog. Always read the live 402 before paying.
1
Calls · 30d
Upstream's own call count for this endpoint, not ours.
1
Unique payers · 30d
Last called 2026-10-04 08:16Z
—
Upstream on-chain volume
Reported by the source catalog.
Paid to
0x25e8245f07d5e4873987293dad666afbe56a9608

The wallet the 402 directs payment to. Its whole payment record — every payer, every chain — is on the merchant page.

Asset 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913

Provider

The payTo wallet does not resolve to a registered ERC-8004 agent. That is not a verdict on the service — most of the catalog is unregistered.

Accepts

The payment requirements as published to the catalog. Read the live 402 before paying — a price here is a claim, not a quote.

0.12USDC≈ $0.12 USD
on Base · exact scheme

Pay 0.12 USDC on Base to 0x25e8…a9608. The signed payment is good for 1 minute.

Paid to
0x25e8…a9608
USD Coin contract
0x8335…02913
Payment window
1 minute
As published
120000 smallest units
The catalog’s raw entry
[
  {
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "extra": {
      "name": "USD Coin",
      "version": "2"
    },
    "payTo": "0x25e8245f07d5e4873987293dad666afbe56a9608",
    "amount": "120000",
    "scheme": "exact",
    "network": "eip155:8453",
    "maxTimeoutSeconds": 60
  }
]

Extensions

{
  "bazaar": {
    "info": {
      "input": {
        "body": {
          "status": 200,
          "headers": {
            "Vary": [
              "Accept-Encoding",
              "Origin"
            ],
            "Server": "example-edge/2.1",
            "Content-Type": "application/json",
            "X-Request-Id": [
              "a1",
              "b2"
            ]
          },
          "contract": {
            "values": {
              "Content-Type": {
                "starts_with": "application/json"
              },
              "X-Frame-Options": "DENY"
            },
            "required": [
              "Cache-Control",
              "Content-Type"
            ],
            "forbidden": [
              "Server",
              "X-Powered-By"
            ],
            "require_cache_directives": true
          }
        },
        "type": "http",
        "method": "POST",
        "bodyType": "json"
      },
      "output": {
        "type": "json",
        "example": {
          "limits": {
            "maxPages": 50,
            "maxListed": 200,
            "maxCookies": 100,
            "maxHeaders": 200,
            "maxFindings": 500,
            "maxHtmlBytes": 262144,
            "maxSitemapUrls": 10000,
            "maxSitemapBytes": 1048576
          },
          "passed": false,
          "status": 200,
          "checked": {
            "values": 2,
            "required": 2,
            "forbidden": 2,
            "cache_directives": true
          },
          "complete": true,
          "findings": [
            {
              "code": "REQUIRED_HEADER_ABSENT",
              "detail": "cache-control is required and absent.",
              "header": "cache-control"
            },
            {
              "code": "FORBIDDEN_HEADER_PRESENT",
              "detail": "server is present and the contract forbids it.",
              "header": "server"
            },
            {
              "code": "REQUIRED_HEADER_ABSENT",
              "detail": "x-frame-options is constrained by a value rule and absent.",
              "header": "x-frame-options"
            }
          ],
          "conformant": false,
          "request_id": "example-request",
          "service_id": "http_header_contract_audit",
          "assumptions": [
            "Header names are compared case-insensitively, as HTTP defines them, and a repeated header is read from an array or a comma-joined string because clients differ.",
            "A header legitimately repeated, such as Set-Cookie, Link or Vary, is not reported as ambiguous.",
            "Every finding describes the headers supplied. This is not a security assessment or a compliance determination."
          ],
          "limitations": [
            "Observable facts about the headers supplied. Whether the origin always sends them, and whether an intermediary alters them, are outside this.",
            "conformant is true only when every declared rule was evaluated and none failed."
          ],
          "observed_at": "2026-10-02T00:00:00.000Z",
          "header_count": 4,
          "header_names": [
            "content-type",
            "server",
            "vary"
          ],
          "not_examined": [],
          "finding_count": 7,
          "service_version": "1.0.0",
          "findings_by_code": {
            "NO_VALIDATOR": 1,
            "CACHE_CONTROL_ABSENT": 1,
            "CHARSET_NOT_DECLARED": 1,
            "REQUIRED_HEADER_ABSENT": 2,
            "FORBIDDEN_HEADER_PRESENT": 1,
            "HEADER_REPEATED_WITH_DIFFERENT_VALUES": 1
          }
        }
      }
    },
    "schema": {
      "type": "object",
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "required": [
        "input"
      ],
      "properties": {
        "input": {
          "type": "object",
          "required": [
            "type",
            "method",
            "bodyType",
            "body"
          ],
          "properties": {
            "body": {
              "type": "object",
              "required": [
                "headers"
              ],
              "properties": {
                "status": {
                  "type": "integer"
                },
                "headers": {
                  "type": "object"
                },
                "contract": {
                  "type": "object",
                  "properties": {
                    "values": {
                      "type": "object"
                    },
                    "required": {
                      "type": "array",
                      "items": {
                        "type": "string",
                        "maxLength": 128
                      },
                      "maxItems": 100,
                      "minItems": 1
                    },
                    "forbidden": {
                      "type": "array",
                      "items": {
                        "type": "string",
                        "maxLength": 128
                      },
                      "maxItems": 100,
                      "minItems": 1
                    },
                    "require_cache_directives": {
                      "type": "boolean"
                    }
                  },
                  "additionalProperties": false
                }
              },
              "additionalProperties": false
            },
            "type": {
              "type": "string",
              "const": "http"
            },
            "method": {
              "enum": [
                "POST"
              ],
              "type": "string"
            },
            "bodyType": {
              "enum": [
                "json",
                "form-data",
                "text"
              ],
              "type": "string"
            }
          },
          "additionalProperties": false
        },
        "output": {
          "type": "object",
          "required": [
            "type"
          ],
          "properties": {
            "type": {
              "type": "string"
            },
            "example": {
              "type": "object"
            }
          }
        }
      }
    }
  }
}

Provenance

Seen in the source catalog
2026-10-04 08:16Z
Last indexed by Roundhouse
2026-10-05 00:20Z
Last enriched (probe, favicon, geo)
2026-10-05 10:45Z
x402 version
2
Max timeout
60s
Liveness probe
HTTP 0
Report

Hand this page to an agent

Copy the prompt and paste it into Claude, an MCP client or your own agent — it will vet this service and call it over the free read API. No key, no account.

GET api.roundhouseai.io/v0/endpoints

No per-endpoint history for this service yet, so this is payments indexed to its PROVIDER's wallet over 30 days. Verified volume counts only settlements with an on-chain EIP-3009 marker.

Open skill.md
Show the prompt
Using Roundhouse, look up the x402 service Header Contract Audit and tell me whether it is
worth paying: what a call costs, whether the endpoint answered when last probed, and what
its payment record actually shows.

curl -s 'https://api.roundhouseai.io/v0/endpoints?q=Header%20Contract%20Audit'
curl -s 'https://api.roundhouseai.io/v0/merchants/<the payTo wallet returned above>'

Then call it: read the price from the live 402 at https://api.zfinia.com/x402/v1/http-header-contract-audit, never from
a cached figure, and pay with an x402 client.

The /v0 API needs an API key (`authorization: Bearer rh_live_…`) on everything except
/v0/unified* and /v0/endpoints. Either pay over x402 (mint a personal key for $0.01 at
GET https://api.roundhouseai.io/v0/test/x402), or ask me for an organization key, which I create at
https://roundhouseai.io/dashboard/connections. If you have neither, ask before going further.

If you do not have Roundhouse tools or skills installed, read
https://roundhouseai.io/skill.md first — it is the whole procedure.