api.zfinia.com

Name: api.zfinia.com
Price: 0.11 USDC
Availability: InStock

No description published for this endpoint.

OtherLiveeip155:8453Exactvia facilitator:thirdweb

https://api.zfinia.com/x402/v1/security-header-diff

Calls · 30d

1→ 0%

This endpoint's own trailing-30-day call count, as published by the upstream catalog and snapshotted daily. 31 snapshots so far.

$25.35

Verified settled volume

256 settlements proven x402 by their on-chain EIP-3009 marker.

$0.110

Listed price

As published in the catalog. Always read the live 402 before paying.

—

Calls · 30d

Upstream's own call count for this endpoint, not ours.

—

Unique payers · 30d

Never called

—

Upstream on-chain volume

Reported by the source catalog.

Paid to

0x25e8245f07d5e4873987293dad666afbe56a9608

The wallet the 402 directs payment to. Its whole payment record — every payer, every chain — is on the merchant page.

Asset 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913

Provider

The payTo wallet does not resolve to a registered ERC-8004 agent. That is not a verdict on the service — most of the catalog is unregistered.

Live 402 challenge

Captured by the enrichment pass, not read just now. Prices can change — always read the 402 the endpoint answers with.

{
  "error": "Payment required",
  "accepts": [
    {
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "extra": {
        "name": "USD Coin",
        "version": "2"
      },
      "payTo": "0x25e8245f07d5e4873987293dad666afbe56a9608",
      "amount": "110000",
      "scheme": "exact",
      "network": "eip155:8453",
      "maxTimeoutSeconds": 60
    }
  ],
  "resource": {
    "url": "https://api.zfinia.com/x402/v1/security-header-diff",
    "tags": [
      "http headers",
      "release gate",
      "regression detection",
      "web platform",
      "developer tooling"
    ],
    "mimeType": "application/json",
    "description": "Compare a fixed list of ten security-relevant response headers across two releases and name the specific reverts. Reports a header removed, added or changed, and separately a reduced Strict-Transport-Security max-age, dropped includeSubDomains, a newly permitted unsafe-inline or unsafe-eval, and a Content-Security-Policy that moved from enforcing to report-only so it no longer blocks anything. Observable differences only, not an assessment of whether either configuration is adequate.",
    "serviceName": "Security Header Diff"
  },
  "extensions": {
    "bazaar": {
      "info": {
        "input": {
          "body": {
            "after": {
              "Referrer-Policy": "no-referrer",
              "X-Frame-Options": "SAMEORIGIN",
              "Strict-Transport-Security": "max-age=600",
              "Content-Security-Policy-Report-Only": "default-src 'self'; script-src 'self' 'unsafe-inline'"
            },
            "before": {
              "Referrer-Policy": "no-referrer",
              "X-Frame-Options": "DENY",
              "X-Content-Type-Options": "nosniff",
              "Content-Security-Policy": "default-src 'self'; script-src 'self'",
              "Strict-Transport-Security": "max-age=31536000; includeSubDomains"
            },
            "after_name": "release-42",
            "before_name": "release-41"
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json"
        },
        "output": {
          "type": "json",
          "example": {
            "limits": {
              "maxPages": 50,
              "maxListed": 200,
              "maxCookies": 100,
              "maxHeaders": 200,
              "maxFindings": 500,
              "maxHtmlBytes": 262144,
              "maxSitemapUrls": 10000,
              "maxSitemapBytes": 1048576
            },
            "passed": false,
            "headers": [
              {
                "after": "max-age=600",
                "before": "max-age=31536000; includeSubDomains",
                "header": "strict-transport-security",
                "changed": true
              },
              {
                "after": null,
                "before": "default-src 'self'; script-src 'self'",
                "header": "content-security-policy",
                "changed": true
              },
              {
                "after": "default-src 'self'; script-src 'self' 'unsafe-inline'",
                "before": null,
                "header": "content-security-policy-report-only",
                "changed": true
              }
            ],
            "complete": true,
            "findings": [
              {
                "code": "SECURITY_HEADER_CHANGED",
                "detail": "strict-transport-security changed from \"max-age=31536000; includeSubDomains\" to \"max-age=600\".",
                "header": "strict-transport-security"
              },
              {
                "code": "HSTS_MAX_AGE_REDUCED",
                "detail": "Strict-Transport-Security max-age fell from 31536000 to 600.",
                "header": "strict-transport-security"
              },
              {
                "code": "HSTS_SUBDOMAINS_DROPPED",
                "detail": "Strict-Transport-Security no longer includes subdomains.",
                "header": "strict-transport-security"
              }
            ],
            "unchanged": false,
            "after_name": "release-42",
            "request_id": "example-request",
            "service_id": "security_header_diff",
            "assumptions": [
              "The set of headers compared is fixed and declared, so a header outside it is not silently ignored: it is simply not part of this product.",
              "A reduced HSTS max-age, dropped subdomains, a newly permitted unsafe source and a policy moving to report-only are each named specifically, because those are the changes that revert a deliberate harde...",
              "Findings describe the headers supplied. This is not a security assessment and carries no judgement about whether a configuration is adequate."
            ],
            "before_name": "release-41",
            "limitations": [
              "Difference between the two header sets supplied. Whether either is appropriate for the site is not assessed.",
              "unchanged is true only when every compared header was identical."
            ],
            "observed_at": "2026-10-02T00:00:00.000Z",
            "not_examined": [],
            "changed_count": 5,
            "finding_count": 8,
            "service_version": "1.0.0",
            "findings_by_code": {
              "HSTS_MAX_AGE_REDUCED": 1,
              "SECURITY_HEADER_ADDED": 1,
              "HSTS_SUBDOMAINS_DROPPED": 1,
              "SECURITY_HEADER_CHANGED": 2,
              "SECURITY_HEADER_REMOVED": 2,
              "CSP_MOVED_TO_REPORT_ONLY": 1
            },
            "after_present_count": 4,
            "before_present_count": 5
          }
        }
      },
      "schema": {
        "type": "object",
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "required": [
          "input"
        ],
        "properties": {
          "input": {
            "type": "object",
            "required": [
              "type",
              "method",
              "bodyType",
              "body"
            ],
            "properties": {
              "body": {
                "type": "object",
                "required": [
                  "before",
                  "after"
                ],
                "properties": {
                  "after": {
                    "type": "object"
                  },
                  "before": {
                    "type": "object"
                  },
                  "after_name": {
                    "type": "string",
                    "maxLength": 64
                  },
                  "before_name": {
                    "type": "string",
                    "maxLength": 64
                  }
                },
                "additionalProperties": false
              },
              "type": {
                "type": "string",
                "const": "http"
              },
              "method": {
                "enum": [
                  "POST"
                ],
                "type": "string"
              },
              "bodyType": {
                "enum": [
                  "json",
                  "form-data",
                  "text"
                ],
                "type": "string"
              }
            },
            "additionalProperties": false
          },
          "output": {
            "type": "object",
            "required": [
              "type"
            ],
            "properties": {
              "type": {
                "type": "string"
              },
              "example": {
                "type": "object"
              }
            }
          }
        }
      }
    }
  },
  "x402Version": 2
}

Accepts

The payment requirements as published to the catalog. Read the live 402 before paying — a price here is a claim, not a quote.

0.11USDC≈ $0.11 USD

on Base · exact scheme

Pay 0.11 USDC on Base to 0x25e8…a9608. The signed payment is good for 1 minute.

Paid to: 0x25e8…a9608
USD Coin contract: 0x8335…02913
Payment window: 1 minute
As published: 110000 smallest units
Returns: application/json

The catalog’s raw entry

[
  {
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "extra": {
      "name": "USD Coin",
      "version": "2"
    },
    "payTo": "0x25e8245f07d5e4873987293dad666afbe56a9608",
    "scheme": "exact",
    "network": "eip155:8453",
    "mimeType": "application/json",
    "resource": "https://api.zfinia.com/x402/v1/security-header-diff",
    "description": "",
    "maxAmountRequired": "110000",
    "maxTimeoutSeconds": 60
  }
]

Provenance

Seen in the source catalog: 2026-10-04 08:18Z
Last indexed by Roundhouse: 2026-10-26 05:16Z
Last enriched (probe, favicon, geo): 2026-10-07 16:16Z
x402 version: 1
Max timeout: 60s
Liveness probe: HTTP 402

Report

Hand this page to an agent

Copy the prompt and paste it into Claude, an MCP client or your own agent — it will vet this service and call it over the free read API. No key, no account.

GET api.roundhouseai.io/v0/endpoints

This endpoint's own trailing-30-day call count, as published by the upstream catalog and snapshotted daily. 31 snapshots so far. Verified volume counts only settlements with an on-chain EIP-3009 marker.

Open skill.md

Show the prompt

Using Roundhouse, look up the x402 service api.zfinia.com and tell me whether it is
worth paying: what a call costs, whether the endpoint answered when last probed, and what
its payment record actually shows.

curl -s 'https://api.roundhouseai.io/v0/endpoints?q=api.zfinia.com'
curl -s 'https://api.roundhouseai.io/v0/merchants/<the payTo wallet returned above>'

Then call it: read the price from the live 402 at https://api.zfinia.com/x402/v1/security-header-diff, never from
a cached figure, and pay with an x402 client.

The /v0 API needs an API key (`authorization: Bearer rh_live_…`) on everything except
/v0/unified* and /v0/endpoints. Either pay over x402 (mint a personal key for $0.01 at
GET https://api.roundhouseai.io/v0/test/x402), or ask me for an organization key, which I create at
https://roundhouseai.io/dashboard/connections. If you have neither, ask before going further.

If you do not have Roundhouse tools or skills installed, read
https://roundhouseai.io/skill.md first — it is the whole procedure.