{"id":"redirect-credential-check","title":"Redirect chain credential-leak check","description":"Walks a supplied HTTP redirect chain (up to 25 hops of status + Location) for an agent or HTTP client author and reports, per hop, which of the request's header names (Authorization, Cookie, Proxy-Authorization, API-key-like, Referer) are stripped or still forwarded, the method after the hop (301/302 POST to GET, 303, 307/308), whether the hop crosses origin, scheme, or registrable domain, an https to http downgrade, a loop, or the 20-redirect Fetch limit. Takes header NAMES only, never values. Does NOT perform any request, resolve DNS, or know your client's real behaviour beyond the Fetch Standard default (strip Authorization on a changed origin) and the strip list you declare.","roi":"A cross-site redirect that keeps a bearer token or cookie is a credential leak; check the chain before the client follows it.","audience":"developer","package":"infra-preflight-kit","channels":["x402","mcp"],"endpoint":{"method":"POST","url":"https://agents.writerslogic.com/api/v1/redirect-credential-check","path":"/api/v1/redirect-credential-check","contentType":"application/json"},"price":{"amount":"0.005","currency":"USDC","network":"base","perCall":true,"failedCallsCharged":false},"inputSchema":{"type":"object","additionalProperties":false,"required":["requestUrl","requestHeaderNames","hops"],"properties":{"requestUrl":{"type":"string","maxLength":2048,"description":"Initial absolute URL."},"method":{"type":"string","enum":["GET","HEAD","POST","PUT","PATCH","DELETE"],"description":"Initial request method. Default GET."},"requestHeaderNames":{"type":"array","maxItems":40,"items":{"type":"string","maxLength":100},"description":"Names of headers on the initial request. Never send values."},"hops":{"type":"array","minItems":1,"maxItems":25,"items":{"type":"object","required":["status","location"],"additionalProperties":false,"properties":{"status":{"type":"integer","enum":[301,302,303,307,308]},"location":{"type":"string","maxLength":2048,"description":"Location header value; relative references resolve against the previous URL."}}}},"clientStripsOnCrossOrigin":{"type":"array","maxItems":40,"items":{"type":"string","maxLength":100},"description":"Header names your client deletes on an origin change. Default: [\"authorization\"], the Fetch Standard rule."},"publicSuffixes":{"type":"array","maxItems":200,"items":{"type":"string","maxLength":100},"description":"Extra public suffixes for registrable-domain decisions."}}},"resultSchema":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"hops":{"type":"array","items":{"type":"object","properties":{"index":{"type":"integer"},"status":{"type":"integer"},"from":{"type":"string"},"to":{"type":"string"},"methodAfter":{"type":"string"},"sameOrigin":{"type":"boolean"},"sameRegistrableDomain":{"type":"boolean"},"schemeChange":{"type":"boolean"},"downgrade":{"type":"boolean"},"stripped":{"type":"array","items":{"type":"object","properties":{"header":{"type":"string"},"basis":{"type":"string"}}}},"forwarded":{"type":"array","items":{"type":"string"}},"leaks":{"type":"array","items":{"type":"object","properties":{"header":{"type":"string"},"reason":{"type":"string"}}}}}}},"finalUrl":{"description":"URL after the last hop, or null if a hop could not be resolved."},"redirectCount":{"type":"integer"},"crossesRegistrableDomain":{"type":"boolean"},"crossesScheme":{"type":"boolean"},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"outputSchema":{"type":"object","properties":{"data":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"hops":{"type":"array","items":{"type":"object","properties":{"index":{"type":"integer"},"status":{"type":"integer"},"from":{"type":"string"},"to":{"type":"string"},"methodAfter":{"type":"string"},"sameOrigin":{"type":"boolean"},"sameRegistrableDomain":{"type":"boolean"},"schemeChange":{"type":"boolean"},"downgrade":{"type":"boolean"},"stripped":{"type":"array","items":{"type":"object","properties":{"header":{"type":"string"},"basis":{"type":"string"}}}},"forwarded":{"type":"array","items":{"type":"string"}},"leaks":{"type":"array","items":{"type":"object","properties":{"header":{"type":"string"},"reason":{"type":"string"}}}}}}},"finalUrl":{"description":"URL after the last hop, or null if a hop could not be resolved."},"redirectCount":{"type":"integer"},"crossesRegistrableDomain":{"type":"boolean"},"crossesScheme":{"type":"boolean"},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]},"example":{"requestUrl":"https://api.example.com/v1/report","method":"POST","requestHeaderNames":["Authorization","Content-Type","X-Api-Key"],"hops":[{"status":307,"location":"https://cdn.example.net/report"}]},"openapiOperation":{"operationId":"redirect_credential_check","summary":"Redirect chain credential-leak check","description":"Walks a supplied HTTP redirect chain (up to 25 hops of status + Location) for an agent or HTTP client author and reports, per hop, which of the request's header names (Authorization, Cookie, Proxy-Authorization, API-key-like, Referer) are stripped or still forwarded, the method after the hop (301/302 POST to GET, 303, 307/308), whether the hop crosses origin, scheme, or registrable domain, an https to http downgrade, a loop, or the 20-redirect Fetch limit. Takes header NAMES only, never values. Does NOT perform any request, resolve DNS, or know your client's real behaviour beyond the Fetch Standard default (strip Authorization on a changed origin) and the strip list you declare.\n\nPrice: 0.005 USDC on Base (x402).","x-x402-price-usdc":"0.005","x-x402-amount":"5000","x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.005"}},"x-audience":"developer","x-sample-url":"https://agents.writerslogic.com/api/v1/samples/redirect-credential-check","security":[{"x402":[]},{"apiKey":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["requestUrl","requestHeaderNames","hops"],"properties":{"requestUrl":{"type":"string","maxLength":2048,"description":"Initial absolute URL."},"method":{"type":"string","enum":["GET","HEAD","POST","PUT","PATCH","DELETE"],"description":"Initial request method. Default GET."},"requestHeaderNames":{"type":"array","maxItems":40,"items":{"type":"string","maxLength":100},"description":"Names of headers on the initial request. Never send values."},"hops":{"type":"array","minItems":1,"maxItems":25,"items":{"type":"object","required":["status","location"],"additionalProperties":false,"properties":{"status":{"type":"integer","enum":[301,302,303,307,308]},"location":{"type":"string","maxLength":2048,"description":"Location header value; relative references resolve against the previous URL."}}}},"clientStripsOnCrossOrigin":{"type":"array","maxItems":40,"items":{"type":"string","maxLength":100},"description":"Header names your client deletes on an origin change. Default: [\"authorization\"], the Fetch Standard rule."},"publicSuffixes":{"type":"array","maxItems":200,"items":{"type":"string","maxLength":100},"description":"Extra public suffixes for registrable-domain decisions."}}},"example":{"requestUrl":"https://api.example.com/v1/report","method":"POST","requestHeaderNames":["Authorization","Content-Type","X-Api-Key"],"hops":[{"status":307,"location":"https://cdn.example.net/report"}]}}}},"responses":{"200":{"description":"Paid result with provenance","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"hops":{"type":"array","items":{"type":"object","properties":{"index":{"type":"integer"},"status":{"type":"integer"},"from":{"type":"string"},"to":{"type":"string"},"methodAfter":{"type":"string"},"sameOrigin":{"type":"boolean"},"sameRegistrableDomain":{"type":"boolean"},"schemeChange":{"type":"boolean"},"downgrade":{"type":"boolean"},"stripped":{"type":"array","items":{"type":"object","properties":{"header":{"type":"string"},"basis":{"type":"string"}}}},"forwarded":{"type":"array","items":{"type":"string"}},"leaks":{"type":"array","items":{"type":"object","properties":{"header":{"type":"string"},"reason":{"type":"string"}}}}}}},"finalUrl":{"description":"URL after the last hop, or null if a hop could not be resolved."},"redirectCount":{"type":"integer"},"crossesRegistrableDomain":{"type":"boolean"},"crossesScheme":{"type":"boolean"},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]}}}},"400":{"description":"Invalid request (no payment consumed)","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"401":{"description":"Invalid X-API-KEY","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"402":{"description":"Payment required or invalid","content":{"application/json":{"schema":{"type":"object","description":"x402 v2 PaymentRequired (also base64 in the PAYMENT-REQUIRED header)","properties":{"x402Version":{"type":"integer"},"error":{"type":"string"},"code":{"type":"string"},"resource":{"type":"object"},"accepts":{"type":"array","items":{"type":"object"}},"extensions":{"type":"object"}}}}}},"502":{"description":"Upstream failure; the payment is released or not settled","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}}}},"links":{"docs":"https://agents.writerslogic.com/docs/redirect-credential-check/","docsJson":"https://agents.writerslogic.com/docs/redirect-credential-check.json","sample":"https://agents.writerslogic.com/api/v1/samples/redirect-credential-check","openapi":"https://agents.writerslogic.com/openapi.json","catalog":"https://agents.writerslogic.com/api/v1/catalog","verifyProvenance":"https://agents.writerslogic.com/api/v1/verify-provenance","index":"https://agents.writerslogic.com/docs/index.json"}}