Graded headers & grade scale

Extraits de code

curl "https://api.oanor.com/secheaders-api/v1/meta" \
  -H "x-oanor-key: oanor_test_..."

await fetch("https://api.oanor.com/secheaders-api/v1/meta", {
  headers: { "x-oanor-key": "oanor_test_..." }
});

$ch = curl_init("https://api.oanor.com/secheaders-api/v1/meta");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["x-oanor-key: oanor_test_..."]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$out = curl_exec($ch);

import requests
requests.get(
    "https://api.oanor.com/secheaders-api/v1/meta",
    headers={"x-oanor-key": "oanor_test_..."}
)

Exemple de réponse

Une réponse réelle de ce endpoint, capturée lors du dernier contrôle de santé.

{
    "data": {
        "note": "Fetch any URL and analyse its HTTP response security headers, the way securityheaders.com and Mozilla Observatory do. /v1/analyze?url=https://example.com grades the site A+ to F from the protective headers it sets — Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy — listing which are present, which are missing (with remediation advice) and which response headers leak information (Server, X-Powered-By…). /v1/headers returns every raw response header. The request is made server-side and follows redirects; private/internal targets are refused (SSRF-guarded). Ideal for security audits, CI gates, attack-surface reviews and compliance checks. A security-header grader — distinct from the SSL/TLS certificate check (sslcheck), host reachability (hostcheck), the IANA HTTP status-code reference (http) and the on-page SEO audit (seo). No key, no cache.",
        "grades": [
            "A+",
            "A",
            "B",
            "C",
            "D",
            "F"
        ],
        "endpoints": [
            "/v1/analyze",
            "/v1/headers",
            "/v1/meta"
        ],
        "graded_headers": [
            {
                "header": "Strict-Transport-Security",
                "weight": 25
            },
            {
                "header": "Content-Security-Policy",
                "weight": 25
            },
            {
                "header": "X-Content-Type-Options",
                "weight": 12
            },
            {
                "header": "X-Frame-Options",
                "weight": 12
            },
            {
                "header": "Referrer-Policy",
                "weight": 12
            },
            {
                "header": "Permissions-Policy",
                "weight": 8
            },
            {
                "header": "Cross-Origin-Opener-Policy",
                "weight": 6
            }
        ],
        "information_leak_headers": [
            "server",
            "x-powered-by",
            "x-aspnet-version",
            "x-aspnetmvc-version"
        ]
    },
    "meta": {
        "timestamp": "2026-06-01T23:40:51.500Z",
        "request_id": "aedd7d5f-f98c-4cef-b8ef-bdfd86f24407"
    },
    "status": "ok",
    "message": "Meta retrieved",
    "success": true
}