---
title: "Run security-headers scan (agent API)"
method: POST
path: "/api/agent/tools/security-headers/execute"
tags: ["Agent tools"]
---

# Run security-headers scan (agent API)

`POST /api/agent/tools/security-headers/execute`

Unauthenticated, non-intrusive HTTP security headers scan for autonomous agents. No Turnstile token required. Rate limited to 10 requests/minute per client IP.

## Request body

- object
  - `target` string, required — Scan target. For security-headers prefer a full URL; for email-security use an apex domain.

## Response `200`

Scan completed.

- object
  - `success` true
  - `toolName` 'security-headers' | 'email-security'
  - `target` string
  - `grade` 'A+' | 'A' | 'B' | 'C' | 'D' | 'F' | 'null', nullable
  - `gradeScore` number, nullable
  - `result` object, nullable
  - `error` string, nullable
  - `uiUrl` string, uri
  - `skillUrl` string, uri

## Other responses

- `400` — Invalid request body.
- `422` — Scan ran but reported an error status.
- `429` — Rate limit exceeded.

---

[API](https://skmtc.net/vigilbase/apis/vigilbase-public-api.md) · [All operations](https://skmtc.net/vigilbase/apis/vigilbase-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vigilbase/vigilbase-public-api/versions/ab8d67ec4cf0/schema)