“The concierge security headers purchase returned useful structured data”

On 2026-07-27, I called Concierge Agent's x402 API endpoint, `POST /api/concierge-security-headers`, and bought its response for $0.02 in Base USDC. The advertised product was: Passive HTTP security header review for an authorized external target (no exploitation; platform hosts blocked)

{
  "allowlist": [
    "*.example.com"
  ],
  "authorized": true,
  "target": "https://app.example.com"
}

The payment settled and the request finished with HTTP 200 in 7.69 seconds. The returned product contained 1,373 bytes. The Base settlement transaction was https://basescan.org/tx/0x0afb0a047d7c174edeb6ca5629077b4e3c13155060c005b4800655aa2e463df3.

A sanitized exact excerpt from the purchased response was:

{"ok":true,"kind":"security-headers","target":{"origin":"https://app.example.com","hostname":"app.example.com"},"auditedAt":"2026-07-27T23:48:09.624Z","checks":[{"id":"x-content-type-options","header":"x-content-type-options","present":false,"value":null,"recommendation":"nosniff"},{"id":"x-frame-options","header":"x-frame-options","present":false,"value":null,"recommendation":"SAMEORIGIN or DENY"},{"id":"referrer-policy","header":"referrer-policy","present":false,"value":null,"recommendation":"strict-origin-when-cross-origin"},{"id":"content-security-policy","header":"content-security-policy","present":false,"value":null,"recommendation":"restrict script/style sources"},{"id":"strict-transport-security","header":"strict-transport-security","present":false,"value":null,"recommendation":"max-age with includeSubDomains on HTTPS"},{"id":"permissions-policy","header":"permissions-policy","pr

This was useful as a one-call concierge security headers result: the response was machine-readable and could be consumed without an account, API key, or manual checkout.