How much does a http-headers call cost?

$0.002 per call, paid in USDC on Base via x402, with no account and no API key.

What does http-headers return?

A JSON object with 10 top-level fields: url, source_url, final_url, redirect_count, http_status, headers, security, security_grade, missing_security_headers and fetched_at. The example on this page is illustrative, not a recorded call.

What happens when a http-headers call fails?

The tool answers with a typed JSON error from the errors table. Payment is settled only after the tool has produced its result; a call that fails inside the tool is never settled. A 503 upstream_unavailable can follow a settled call; the x402 payments guide covers it, 429, 402 and an uncertain 500.

catalogue / tools / Fetch & extract / HTTP Headers API

HTTP Headers API

Returns the response headers, final status, redirect chain and a security-header grade for a URL, without downloading the body.

Endpoint: POST /v1/http-headers
Price: $0.002 per call
Family: Fetch & extract
Docs: /docs/http-headers

01When to use it

It needs a hardened HTTP client -- an agent that fetches the URL itself can walk a redirect into a private address -- and the security grade is a deterministic, documented rubric it would otherwise have to build and maintain.

When not to use it

The destination needs more than 8 s to answer: the call ends with upstream_timeout (424).
The destination is on a private or local network: the network guard refuses it with blocked_target (403).

02Parameters

Field	Type	Required	Description
url	string	yes	Absolute http(s) URL to request, up to 2048 characters; up to five redirects are followed and every hop goes through the SSRF guard.
method	string	no	HTTP method for the request, HEAD by default; GET is for servers that mishandle HEAD, and its body is still never read. One of: "HEAD", "GET". Default: "HEAD".

03Limits

Limit	Value
Size cap	64 KB (65,536 bytes)
Timeout	8 s

04Example

The published example of http-headers, verbatim: the request body and the response it returns.

Request

POST /v1/http-headers
content-type: application/json
payment-signature: <base64 x402 payload>

{
  "url": "https://example.com/",
  "method": "HEAD"
}

Response

200 OK
payment-response: <base64 settlement receipt>

{
  "url": "https://example.com/",
  "source_url": "https://example.com/",
  "final_url": "https://example.com/",
  "redirect_count": 0,
  "http_status": 200,
  "headers": {
    "content-security-policy": "default-src 'self'",
    "content-type": "text/html; charset=utf-8",
    "cross-origin-opener-policy": "same-origin",
    "cross-origin-resource-policy": "same-origin",
    "permissions-policy": "geolocation=()",
    "referrer-policy": "strict-origin-when-cross-origin",
    "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
    "x-content-type-options": "nosniff",
    "x-frame-options": "DENY"
  },
  "security": {
    "hsts": {
      "present": true,
      "max_age": 63072000,
      "include_subdomains": true,
      "preload": true
    },
    "csp_present": true,
    "x_content_type_options": "nosniff",
    "x_frame_options": "DENY",
    "referrer_policy": "strict-origin-when-cross-origin",
    "permissions_policy": "geolocation=()",
    "cross_origin_opener_policy": "same-origin",
    "cross_origin_resource_policy": "same-origin"
  },
  "security_grade": "A",
  "missing_security_headers": [],
  "fetched_at": "2026-08-26T18:00:00.000Z"
}

This example is illustrative: it shows the exact shape the handler returns, but it was not produced by a reproducible call, because the real answer depends on live network data that changes over time.

Response field	Type	In the example
url	string	"https://example.com/"
source_url	string	"https://example.com/"
final_url	string	"https://example.com/"
redirect_count	number	0
http_status	number	200
headers	object	an object with content-security-policy, content-type, cross-origin-opener-policy, cross-origin-resource-policy, permissions-policy, referrer-policy, strict-transport-security, x-content-type-options and x-frame-options
security	object	an object with hsts, csp_present, x_content_type_options, x_frame_options, referrer_policy, permissions_policy, cross_origin_opener_policy and cross_origin_resource_policy
security_grade	string	"A"
missing_security_headers	array	0 items
fetched_at	string	"2026-08-26T18:00:00.000Z"

05Call it from code

JavaScript

// http-headers: $0.002 per call, paid in USD Coin on eip155:8453 via x402
// Install: npm install @x402/fetch@2 @x402/evm@2 viem@2
// Save as client.mjs (ES module, Node 18+), export EVM_PRIVATE_KEY with the paying wallet's key in your shell, then run: node client.mjs
// The wrapper reads the 402 (payment-required), signs and retries with payment-signature.
import { wrapFetchWithPayment, x402Client, decodePaymentResponseHeader } from '@x402/fetch'
import { ExactEvmScheme } from '@x402/evm/exact/client'
import { privateKeyToAccount } from 'viem/accounts'

const account = privateKeyToAccount(process.env.EVM_PRIVATE_KEY)
const client = new x402Client().register('eip155:8453', new ExactEvmScheme(account))
const fetchWithPayment = wrapFetchWithPayment(fetch, client)

const body = {
  "url": "https://example.com/",
  "method": "HEAD"
}

const res = await fetchWithPayment('https://grist.tools/v1/http-headers', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify(body),
})
console.log(res.status, await res.json())
const settle = res.headers.get('payment-response')
if (settle) console.log(decodePaymentResponseHeader(settle).transaction)

Python

# http-headers: $0.002 per call, paid in USD Coin on eip155:8453 via x402
# Install: pip install "x402[requests,evm]>=2.24,<3"
# The session reads the 402 (payment-required), signs and retries with payment-signature.
import os
from eth_account import Account
from x402 import x402ClientSync
from x402.http import decode_payment_response_header
from x402.http.clients.requests import x402_requests
from x402.mechanisms.evm.exact import register_exact_evm_client
from x402.mechanisms.evm.signers import EthAccountSigner

account = Account.from_key(os.environ["EVM_PRIVATE_KEY"])
client = x402ClientSync()
register_exact_evm_client(client, EthAccountSigner(account), networks="eip155:8453")
session = x402_requests(client)

payload = {
    "url": "https://example.com/",
    "method": "HEAD"
}

res = session.post("https://grist.tools/v1/http-headers", json=payload)
print(res.status_code, res.json())
settle = res.headers.get("payment-response")
if settle:
    print(decode_payment_response_header(settle).transaction)

curl

# http-headers: $0.002 per call, paid in USD Coin on eip155:8453 via x402
# 1. Unpaid call: HTTP 402, the requirements in the payment-required header (base64 JSON) and in the body.
curl -i -X POST 'https://grist.tools/v1/http-headers' -H 'content-type: application/json' -d '{"url":"https://example.com/","method":"HEAD"}'

# 2. Same call with the signed payment (an EIP-3009 authorization, EIP-712 signed: it cannot be
#    typed by hand). x-payment is accepted as the v1 alternative. HTTP 200 carries payment-response.
curl -i -X POST 'https://grist.tools/v1/http-headers' -H 'content-type: application/json' -H 'payment-signature: <base64 x402 payload>' -d '{"url":"https://example.com/","method":"HEAD"}'

06Errors

Code	HTTP	For this service
invalid_input	400	The body does not match the schema; its fields are url and method.
blocked_target	403
unreachable_target	424
upstream_timeout	424
internal	500

Input that is rejected before the tool runs (malformed JSON, schema mismatch, body over the size limit) is never charged.

When each code is raised, and what it means for payment: /docs/http-headers.

07Questions

How much does a http-headers call cost?: $0.002 per call, paid in USDC on Base via x402, with no account and no API key.
What does http-headers return?: A JSON object with 10 top-level fields: url, source_url, final_url, redirect_count, http_status, headers, security, security_grade, missing_security_headers and fetched_at. The example on this page is illustrative, not a recorded call.
What happens when a http-headers call fails?: The tool answers with a typed JSON error from the errors table. Payment is settled only after the tool has produced its result; a call that fails inside the tool is never settled. A 503 upstream_unavailable can follow a settled call; the x402 payments guide covers it, 429, 402 and an uncertain 500.