passabsent from every registry#7 by calls of 15 on this host
0.16 USDC
per call, as the listing declares it on eip155:
Compare with anotherEvery figure as JSONCite this page
the price, as of 2026-10-04 21:22 UTC · method
- Validation state
- pass
- Uptime, 7 / 30 / 90 days
- — / 50% / 50%
- Calls, trailing 30 days
- 1
- Unique payers, trailing 30 days
- 1
- Last called
- 2026-10-04 08:13 UTC
- First observed by TOLLderived
- 2026-10-04
- Pricederived
- 0.16 USDC
- Networks
- 1
How big is this endpoint among the ones like it?
No trace is drawn of this endpoint’s own volume. Its counters have changed 1 time across 2 observations, and 3 changes are the fewest this site will draw a trace through, because two points and a guess are not a series. Every observation is in the JSON.
csp structural audit is one of 15 listed endpoints on api.zfinia.com, tied 7th by calls with 9 others among them.
csp structural audit takes a json body with the fields policy and report_only.
A response from csp structural audit, as declared, includes limits, passed, complete, findings, directives, request_id and 2 others.
csp structural audit drew a single call from a single payer in the trailing 30 days.
The last call to csp structural audit came 9 days before the snapshot, 2026-10-04.
On Base, csp structural audit asks 0.16 USDC per call.
It accounts for 4% of the calls counted across the host.
TOLL files csp structural audit under the "other" category: a POST endpoint on api.zfinia.com, listed in neither registry at the last pull.
csp structural audit answered the sweep of 2026-10-04 with a valid 402, passing 1 of 2 sweeps since 2026-10-04.
Closest in price to csp structural audit within the "other" category: intelligence address at api.arkm.com and services vulnerability audit at www.cultos.dev.
csp structural audit is near the top of prices in the "other" category; 97% of comparable listings are cheaper.
The wallet paid by csp structural audit is the payee of 179 endpoints across 5 hosts.
The seller's tags on csp structural audit are content security policy, http headers, web platform and developer tooling.
csp structural audit was missing from the Coinbase registry at the pull of 2026-10-05, confirmed at the pull of 2026-10-05; that is registry presence, not liveness.
Where the sentences above compare this endpoint with others, the comparison is against the index as it stands now, live; the figures above are final.
the payment options, as of 2026-10-04 21:22 UTC · method
| registry | network | asset | amount | scheme | pay to |
|---|---|---|---|---|---|
| Coinbase | eip155: | USDC | 0.16 USDC | exact | 0x25e824…6a9608 |
the checks, as of 2026-10-04 13:47 UTC · methodendpoint answered HTTP 402
No named check failed.
Every sweep that observed this endpoint, newest first.
| observed, UTC | state | failed checks | sweep |
|---|---|---|---|
| 2026-10-04 13:47 UTC | pass | 0 | daily-2026-10-04 |
| 2026-10-04 12:46 UTC | fail | 1 | new-after-daily-2026-10-04 |
Presence in a registry, not liveness of the service (method). Newest first.
- absence from Coinbase confirmed, rule v1
- absent from Coinbase at this pull
- listed in Coinbase
From the registry record, not validated by TOLL.the declared schema, as of 2026-10-04 08:13 UTC · method
The input and output block
{
"input": {
"body": {
"policy": "default-src 'self'; script-src 'self' 'unsafe-inline' data:; style-src 'self'; connect-src *; style-src 'unsafe-inline'; frame-ancestors 'none' https://partner.test; report-uri /csp",
"report_only": false
},
"type": "http",
"method": "POST",
"bodyType": "json"
},
"output": {
"type": "json",
"example": {
"limits": {
"maxPages": 50,
"maxListed": 200,
"maxCookies": 100,
"maxHeaders": 200,
"maxFindings": 500,
"maxHtmlBytes": 262144,
"maxSitemapUrls": 10000,
"maxSitemapBytes": 1048576
},
"passed": false,
"complete": false,
"findings": [
{
"code": "DIRECTIVE_REPEATED",
"detail": "style-src appears more than once, and only the first occurrence takes effect.",
"directive": "style-src"
},
{
"code": "REQUIRED_DIRECTIVE_ABSENT",
"detail": "base-uri is absent and does not fall back to default-src.",
"directive": "base-uri"
},
{
"code": "UNSAFE_INLINE_SOURCE",
"detail": "script-src permits unsafe-inline with no nonce or hash alongside it.",
"directive": "script-src"
}
],
"directives": [
{
"none": false,
"sources": [
"'self'"
],
"has_hash": false,
"wildcard": false,
"directive": "default-src",
"has_nonce": false,
"unsafe_eval": false,
"source_count": 1,
"unsafe_inline": false,
"scheme_sources": [],
"strict_dynamic": false
},
{
"none": false,
"sources": [
"'self'",
"'unsafe-inline'",
"data:"
],
"has_hash": false,
"wildcard": false,
"directive": "script-src",
"has_nonce": false,
"unsafe_eval": false,
"source_count": 3,
"unsafe_inline": true,
"scheme_sources": [
"data:"
],
"strict_dynamic": false
},
{
"none": false,
"sources": [
"'self'"
],
"has_hash": false,
"wildcard": false,
"directive": "style-src",
"has_nonce": false,
"unsafe_eval": false,
"source_count": 1,
"unsafe_inline": false,
"scheme_sources": [],
"strict_dynamic": false
}
],
"request_id": "example-request",
"service_id": "csp_structural_audit",
"assumptions": [
"A fetch directive falls back to default-src and is reported as covered. base-uri and frame-ancestors do not fall back, which is why a policy with default-src still needs them stated.",
"unsafe-inline alongside a nonce or hash is reported differently from unsafe-inline alone, because browsers supporting nonces ignore it and the combination is a deliberate fallback for older ones.",
"A repeated directive is reported because only the first occurrence takes effect."
],
"limitations": [
"Structure of the policy supplied. Whether it is sufficient for a given application, and whether the application works under it, are outside this. Not a security assessment or a compliance determinatio...",
"structurally_strict means nothing in the policy widens it in the ways named and every required directive is covered. It is not a judgement that the policy is adequate."
],
"observed_at": "2026-10-02T00:00:00.000Z",
"report_only": false,
"not_examined": [
"DIRECTIVE_FALLS_BACK: object-src is absent and falls back to default-src, so it is covered.",
"REPORT_URI_WITHOUT_REPORT_TO: report-uri is present without report-to; report-uri is deprecated and some browsers only honour report-to."
],
"finding_count": 6,
"directive_count": 6,
"directive_names": [
"connect-src",
"default-src",
"frame-ancestors"
],
"has_default_src": true,
"service_version": "1.0.0",
"findings_by_code": {
"WILDCARD_SOURCE": 1,
"DIRECTIVE_REPEATED": 1,
"UNSAFE_INLINE_SOURCE": 1,
"NONE_WITH_OTHER_SOURCES": 1,
"REQUIRED_DIRECTIVE_ABSENT": 1,
"DATA_SCHEME_IN_SCRIPT_CONTEXT": 1
},
"structurally_strict": false
}
}
}Cite this page
This endpoint is delisted: the page is frozen at its last observation and its live URL is the stable one. Data reuse is under CC BY 4.0 (terms).
Plain text
TOLL, "csp structural audit on api.zfinia.com". https://tollindex.com/e/api-zfinia-com-x402-v1-csp-structural-audit-b98c53. Accessed [access date].
BibTeX
@misc{toll-e-api-zfinia-com-x402-v1-csp-structural-audit-b98c53-2026-10-13,
author = {TOLL},
title = {csp structural audit on api.zfinia.com},
howpublished = {\url{https://tollindex.com/e/api-zfinia-com-x402-v1-csp-structural-audit-b98c53}},
year = {2026},
month = {10},
note = {Frozen at its last observation, 2026-10-13 14:08 UTC. Accessed [access date].}
}None yet. Anything submitted through the form below is published here with its outcome.