passlisted in Coinbasecounted above 0% of Other
0.01 USDC
per call, as the listing declares it on eip155:
- Validation state
- pass
- Uptime, 7 / 30 / 90 days
- 100% / 100% / 100%
- Calls, trailing 30 days
- 1
- Unique payers, trailing 30 days
- 1
- Last called
- 2026-10-09 18:11 UTC
- First observed by TOLLderived
- 2026-10-09
- Pricederived
- 0.01 USDC
- Networks
- 1
How big is this endpoint among the ones like it?
No trace is drawn of this endpoint’s own volume. Its counters have changed 1 time across 11 observations, and 3 changes are the fewest this site will draw a trace through, because two points and a guess are not a series. Every observation is in the JSON.
TOLL files tools grade headers under the "other" category: a POST endpoint on http-security-headers-grade.x402supply.com, listed in the Coinbase registry.
Per call, tools grade headers declares 0.01 USDC on Base.
The listing describes the request as a json body with the field url.
tools grade headers returns json; the example shows url, fixes, grade, score, status, cookies and 2 others.
tools grade headers answered the sweep of 2026-10-19 with a valid 402, as at every sweep since 2026-10-09.
tools grade headers is the only listed endpoint on http-security-headers-grade.x402supply.com.
In the trailing 30 days: one call, one payer.
tools grade headers was last called 4 days before the snapshot.
Closest in price to tools grade headers within the "other" category: horror story at horrorstoryapi.vercel.app and tools research at win.oneshotagent.com.
tools grade headers is priced above 55% of comparable listings in the "other" category.
The wallet paid by tools grade headers is the payee of 14 endpoints across 14 hosts.
The price of tools grade headers is declared by 1,086 other listings in the "other" category too.
the payment options, as of 2026-10-13 14:08 UTC · method · pinnable
| registry | network | asset | amount | scheme | pay to |
|---|---|---|---|---|---|
| Coinbase | eip155: | USDC | 0.01 USDC | exact | 0x07fFB5…b754EB |
the checks, as of 2026-10-19 11:05 UTC · method · pinnableendpoint answered HTTP 402
No named check failed.
Every sweep that observed this endpoint, newest first.
| observed, UTC | state | failed checks | sweep |
|---|---|---|---|
| 2026-10-19 11:05 UTC | pass | 0 | daily-2026-10-19 |
| 2026-10-18 19:34 UTC | pass | 0 | daily-2026-10-18 |
| 2026-10-16 08:54 UTC | pass | 0 | daily-2026-10-16 |
| 2026-10-15 10:51 UTC | pass | 0 | daily-2026-10-15 |
| 2026-10-14 08:41 UTC | pass | 0 | daily-2026-10-14 |
| 2026-10-13 13:34 UTC | pass | 0 | daily-2026-10-13 |
| 2026-10-12 10:59 UTC | pass | 0 | daily-2026-10-12 |
| 2026-10-11 09:40 UTC | pass | 0 | daily-2026-10-11 |
| 2026-10-10 17:50 UTC | pass | 0 | daily-2026-10-10 |
| 2026-10-09 22:59 UTC | pass | 0 | new-after-daily-2026-10-09 |
Presence in a registry, not liveness of the service (method). Newest first.
- listed in Coinbase
From the registry record, not validated by TOLL.the declared schema, as of 2026-10-09 18:11 UTC · method · live
The input and output block
{
"input": {
"body": {
"url": "https://example.com"
},
"type": "http",
"method": "POST",
"bodyType": "json"
},
"output": {
"type": "json",
"example": {
"url": "https://example.com",
"fixes": {
"referrer-policy": "Referrer-Policy: strict-origin-when-cross-origin",
"x-frame-options": "X-Frame-Options: DENY",
"permissions-policy": "Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()",
"x-content-type-options": "X-Content-Type-Options: nosniff",
"content-security-policy": "Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'",
"strict-transport-security": "Strict-Transport-Security: max-age=63072000; includeSubDomains; preload",
"cross-origin-opener-policy": "Cross-Origin-Opener-Policy: same-origin",
"cross-origin-embedder-policy": "Cross-Origin-Embedder-Policy: require-corp",
"cross-origin-resource-policy": "Cross-Origin-Resource-Policy: same-origin"
},
"grade": "F",
"score": 0,
"status": 200,
"cookies": [],
"missing": [
"strict-transport-security",
"content-security-policy",
"x-frame-options",
"x-content-type-options",
"referrer-policy",
"permissions-policy",
"cross-origin-opener-policy",
"cross-origin-embedder-policy",
"cross-origin-resource-policy"
],
"present": [],
"finalUrl": "https://example.com/",
"findings": [
{
"fix": "Strict-Transport-Security: max-age=63072000; includeSubDomains; preload",
"value": null,
"header": "strict-transport-security",
"points": 0,
"status": "fail",
"message": "HSTS header is missing.",
"maxPoints": 18
},
{
"fix": "Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'",
"value": null,
"header": "content-security-policy",
"points": 0,
"status": "fail",
"message": "Content-Security-Policy is missing.",
"maxPoints": 25
},
{
"fix": "X-Frame-Options: DENY",
"value": null,
"header": "x-frame-options",
"points": 0,
"status": "fail",
"message": "No X-Frame-Options or CSP frame-ancestors, so the page can be framed (clickjacking).",
"maxPoints": 10
},
{
"fix": "X-Content-Type-Options: nosniff",
"value": null,
"header": "x-content-type-options",
"points": 0,
"status": "fail",
"message": "X-Content-Type-Options is missing.",
"maxPoints": 10
},
{
"fix": "Referrer-Policy: strict-origin-when-cross-origin",
"value": null,
"header": "referrer-policy",
"points": 0,
"status": "fail",
"message": "Referrer-Policy is missing.",
"maxPoints": 10
},
{
"fix": "Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()",
"value": null,
"header": "permissions-policy",
"points": 0,
"status": "fail",
"message": "Permissions-Policy is missing.",
"maxPoints": 8
},
{
"fix": "Cross-Origin-Opener-Policy: same-origin",
"value": null,
"header": "cross-origin-opener-policy",
"points": 0,
"status": "fail",
"message": "Cross-Origin-Opener-Policy is missing.",
"maxPoints": 5
},
{
"fix": "Cross-Origin-Embedder-Policy: require-corp",
"value": null,
"header": "cross-origin-embedder-policy",
"points": 0,
"status": "fail",
"message": "Cross-Origin-Embedder-Policy is missing.",
"maxPoints": 4
},
{
"fix": "Cross-Origin-Resource-Policy: same-origin",
"value": null,
"header": "cross-origin-resource-policy",
"points": 0,
"status": "fail",
"message": "Cross-Origin-Resource-Policy is missing.",
"maxPoints": 4
}
],
"redirects": 0
}
}
}Cite this page
The pinned URL below renders this page from the snapshot of 2026-10-13 14:08 UTC and does not change; the live page does, every six hours. Data reuse is under CC BY 4.0 (terms).
Plain text
TOLL, "tools grade headers on http-security-headers-grade.x402supply.com", snapshot of 2026-10-13 14:08 UTC. https://tollindex.com/e/http-security-headers-grade-x402supply-com-tools-grade-headers-bebc8c/at/2026-10-13T14-08Z. Accessed [access date].
BibTeX
@misc{toll-e-http-security-headers-grade-x402supply-com-tools-grade-headers-bebc8c-2026-10-13T14-08Z,
author = {TOLL},
title = {tools grade headers on http-security-headers-grade.x402supply.com},
howpublished = {\url{https://tollindex.com/e/http-security-headers-grade-x402supply-com-tools-grade-headers-bebc8c/at/2026-10-13T14-08Z}},
year = {2026},
month = {10},
note = {Pinned view of the snapshot of 2026-10-13 14:08 UTC. Accessed [access date].}
}None yet. Anything submitted through the form below is published here with its outcome.