CSP header parser API

Input

A JSON body with content-type: application/json.

Example request

curl -i -X POST https://api.lookproof.dev/v1/http/csp-parse \
  -H 'content-type: application/json' \
  -d '{"header": "Content-Security-Policy: default-src '"'"'self'"'"'; script-src '"'"'self'"'"' '"'"'unsafe-inline'"'"' https://cdn.example.com; object-src '"'"'none'"'"'; base-uri '"'"'self'"'"'"}'

import asyncio
import os

from eth_account import Account
from x402 import x402Client
from x402.http.clients import x402HttpxClient
from x402.mechanisms.evm import EthAccountSigner
from x402.mechanisms.evm.exact import register_exact_evm_client


async def main() -> None:
    signer = EthAccountSigner(Account.from_key(os.environ["EVM_PRIVATE_KEY"]))
    client = register_exact_evm_client(x402Client(), signer, networks="eip155:8453")
    async with x402HttpxClient(client) as http:
        response = await http.post('https://api.lookproof.dev/v1/http/csp-parse', json={'header': "Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.example.com; object-src 'none'; base-uri 'self'"})
        response.raise_for_status()
        print(response.json())


asyncio.run(main())

import { wrapFetchWithPaymentFromConfig } from "@x402/fetch";
import { ExactEvmScheme } from "@x402/evm";
import { privateKeyToAccount } from "viem/accounts";

const account = privateKeyToAccount(process.env.EVM_PRIVATE_KEY);
const fetchWithPayment = wrapFetchWithPaymentFromConfig(fetch, {
  schemes: [{ network: "eip155:8453", client: new ExactEvmScheme(account) }],
});

const response = await fetchWithPayment("https://api.lookproof.dev/v1/http/csp-parse", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({"header": "Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.example.com; object-src 'none'; base-uri 'self'"}),
});
console.log(await response.json());

curl: unpaid request — returns 402 with the price (PAYMENT-REQUIRED). The Python and JavaScript clients pay it and send the request again. Only ordinary wallets (EOA) can pay; smart-contract wallets get a 402 without charge. See payments.

Example response

{
  "checked_at": "2026-10-24T12:00:00Z",
  "data": {
    "header_name": "content-security-policy",
    "notes": [
      "Only the pasted text is read; whether a site sends this header is not checked."
    ],
    "policies": [
      {
        "directives": [
          {
            "name": "default-src",
            "sources": [
              "'self'"
            ]
          },
          {
            "name": "script-src",
            "sources": [
              "'self'",
              "'unsafe-inline'",
              "https://cdn.example.com"
            ]
          },
          {
            "name": "object-src",
            "sources": [
              "'none'"
            ]
          },
          {
            "name": "base-uri",
            "sources": [
              "'self'"
            ]
          }
        ]
      }
    ],
    "report_only": false
  },
  "endpoint": "http.csp_parse",
  "findings": [
    {
      "code": "CSP_UNSAFE_INLINE",
      "evidence": {
        "count": 1,
        "items": [
          {
            "directive": "script-src",
            "policy": "1",
            "source": "'unsafe-inline'"
          }
        ]
      },
      "explanation": "The script-src directive (or default-src, when there is no script-src) allows 'unsafe-inline' without a nonce or hash, or allows 'unsafe-eval'. Injected inline scripts can then run, which removes most of the protection the policy gives against cross-site scripting.",
      "message": "The Content Security Policy allows inline or eval'd scripts.",
      "recommendation": "Move inline scripts to files or allow them with nonces or hashes, and drop 'unsafe-eval' once no code needs eval().",
      "severity": "info"
    }
  ],
  "meta": {
    "cache_hit": false,
    "duration_ms": 42,
    "fresh_until": "2026-10-24T12:05:00Z",
    "observed_at": "2026-10-24T12:00:00Z",
    "resolver": null,
    "source": "offline"
  },
  "request_id": "req_aaaaaaaaaaaaaaaaaaaaaaaaaa",
  "schema_version": "1.0",
  "status": "info"
}

Response fields

Fields in data

Status codes

Errors use the common error body. See errors.

Findings this endpoint can return