{"data":{"status":"fail","hops":[{"index":0,"status":307,"from":"https://api.example.com/v1/report","to":"https://cdn.example.net/report","methodAfter":"POST","sameOrigin":false,"sameRegistrableDomain":false,"schemeChange":false,"downgrade":false,"stripped":[{"header":"Authorization","basis":"Fetch Standard: Authorization is deleted when the origin changes"}],"forwarded":["Content-Type","X-Api-Key"],"leaks":[{"header":"X-Api-Key","reason":"forwarded to a different registrable domain (example.net)"}]}],"finalUrl":"https://cdn.example.net/report","redirectCount":1,"crossesRegistrableDomain":true,"crossesScheme":false,"witnesses":[{"ruleId":"credential-cross-site","detail":"X-Api-Key forwarded to a different registrable domain (example.net).","index":0,"path":"hops[0]","expected":"header removed before leaving the site","actual":{"header":"X-Api-Key","from":"https://api.example.com/v1/report","to":"https://cdn.example.net/report"}}],"versions":{"engine":"redirect-credential-check 1","fetchStandard":"https://fetch.spec.whatwg.org/#http-redirect-fetch, Living Standard last updated 2026-10-19, fetched 2026-11-04","rfc9110":"https://www.rfc-editor.org/rfc/rfc9110.html section 15.4, fetched 2026-11-04","urlParser":"WHATWG URL Living Standard, last updated 2026-10-19, fetched 2026-11-04; UTS #46 via the runtime URL parser","publicSuffixSubset":"https://publicsuffix.org/list/public_suffix_list.dat 2026-10-31_14-17-28_UTC commit 73f8cc7 (subset), fetched 2026-11-04"},"limits":["Fetch deletes only Authorization on an origin change; every other credential-like header you list is reported forwarded unless clientStripsOnCrossOrigin says your client removes it.","Cookies attached by a cookie jar are not request headers here; pass Cookie only if your client sets it manually.","Registrable domains use a public-suffix subset plus publicSuffixes; an unrecognized multi-label suffix makes equal-looking domains status unknown.","Header values, bodies and the real client implementation are not seen."],"deterministic":true},"_provenance":{"version":"writerslogic-provenance/1","issuer":"did:web:agents.writerslogic.com","verify":{"endpoint":"POST /api/v1/verify-provenance","did":"did:web:agents.writerslogic.com"},"manifest":{"format":"application/json","instance_id":"xmp:iid:c24fd8f5-7739-41cb-907c-6d77ad0c00ab","claim_generator_info":[{"name":"WritersLogic x402 Agent Hub","version":"2.0.0"}],"title":"Redirect chain credential-leak check","assertions":[{"label":"c2pa.actions.v2","data":{"actions":[{"action":"c2pa.created","when":"2026-11-06T01:30:30.957Z","softwareAgent":{"name":"writerslogic-agent-hub/redirect-credential-check","version":"2.0.0"},"digitalSourceType":"http://cv.iptc.org/newscodes/digitalsourcetype/algorithmicMedia","parameters":{"endpoint":"POST /api/v1/redirect-credential-check","inputDigest":{"alg":"sha256","hash":"141bc095ecd80819104c9ba32b38a01c8d702da3ddec8f4fdbfafc5180293c97","canonicalization":"JCS"}}}]}},{"label":"c2pa.hash.data","data":{"alg":"sha256","hash":"4c7dae10e282b3899d9c14e12401241c5b3334e691a25919d1040b14f5c46cec","name":"jcs-canonical-json(data)"}}]},"credential":{"@context":["https://www.w3.org/ns/credentials/v2"],"id":"urn:uuid:0c80fa28-2dc9-4f13-8a6b-755884d48269","type":["VerifiableCredential","AgentOutputCredential"],"issuer":"did:web:agents.writerslogic.com","validFrom":"2026-11-06T01:30:30.957Z","credentialSubject":{"id":"urn:sha256:4c7dae10e282b3899d9c14e12401241c5b3334e691a25919d1040b14f5c46cec","agent":"redirect-credential-check","endpoint":"POST /api/v1/redirect-credential-check","outputDigest":{"alg":"sha256","value":"4c7dae10e282b3899d9c14e12401241c5b3334e691a25919d1040b14f5c46cec","canonicalization":"JCS"},"inputDigest":{"alg":"sha256","value":"141bc095ecd80819104c9ba32b38a01c8d702da3ddec8f4fdbfafc5180293c97","canonicalization":"JCS"},"manifestDigest":{"alg":"sha256","value":"e4a7537f861023e8639496834db69d8828cbdf58899cf6b5b293cd5b0b976b9b","canonicalization":"JCS"},"ingredients":[],"payment":{"scheme":"api-key","network":"eip155:8453","payer":"sample"}},"proof":{"type":"DataIntegrityProof","cryptosuite":"eddsa-jcs-2022","created":"2026-11-06T01:30:30.957Z","verificationMethod":"did:web:agents.writerslogic.com#key-1","proofPurpose":"assertionMethod","proofValue":"z3N5RumUPCRJuUero3iWYKEmd4e5rDpFvJJ17d1BL8MummLUBiwAN8rSvfF8v4SmxPUJ9svfc7966W4sRux8MwyV6"}},"ethSignature":{"type":"EIP-191","signer":"did:pkh:eip155:8453:0x3DBd42560cA7a7E448A2c7DfC9E785526189411f","address":"0x3DBd42560cA7a7E448A2c7DfC9E785526189411f","message":"writerslogic-provenance:326972259e9e26095c45a05505b4cd2efe1b3ba0a6a22a9fc964d0b7e903124b","signature":"0x31c7596b32d5c15c718ccd481f635aad913a162ca74d45c5e7ff36d442fd2cdc076fffcb5b09eaacda778b80cf4124b1febcedf12bc6c3506e75c1012c2d47781c"}}}