Redirect chain credential-leak check

$0.005 USDC per call · Developer and security · POST /api/v1/redirect-credential-check · Id redirect-credential-check

Walks a supplied HTTP redirect chain (up to 25 hops of status + Location) for an agent or HTTP client author and reports, per hop, which of the request's header names (Authorization, Cookie, Proxy-Authorization, API-key-like, Referer) are stripped or still forwarded, the method after the hop (301/302 POST to GET, 303, 307/308), whether the hop crosses origin, scheme, or registrable domain, an https to http downgrade, a loop, or the 20-redirect Fetch limit. Takes header NAMES only, never values. Does NOT perform any request, resolve DNS, or know your client's real behaviour beyond the Fetch Standard default (strip Authorization on a changed origin) and the strip list you declare.

What you get

A cross-site redirect that keeps a bearer token or cookie is a credential leak; check the chain before the client follows it.

Call it

Send the JSON body below to https://agents.writerslogic.com/api/v1/redirect-credential-check. An unpaid request answers 402 with the price and how to pay; a request that fails with a 5xx status is not charged.

curl -i -X POST https://agents.writerslogic.com/api/v1/redirect-credential-check \
  -H 'content-type: application/json' \
  -d '{"requestUrl":"https://api.example.com/v1/report","method":"POST","requestHeaderNames":["Authorization","Content-Type","X-Api-Key"],"hops":[{"status":307,"location":"https://cdn.example.net/report"}]}'

Input

Field	Type	Required	Description
`requestUrl`	string; length 0..2048	yes	Initial absolute URL.
`method`	string; one of "GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"	no	Initial request method. Default GET.
`requestHeaderNames`	array<string; length 0..100>; max 40 items	yes	Names of headers on the initial request. Never send values.
`hops`	array<object>; max 25 items	yes
`clientStripsOnCrossOrigin`	array<string; length 0..100>; max 40 items	no	Header names your client deletes on an origin change. Default: ["authorization"], the Fetch Standard rule.
`publicSuffixes`	array<string; length 0..100>; max 200 items	no	Extra public suffixes for registrable-domain decisions.

Example request body

{
  "requestUrl": "https://api.example.com/v1/report",
  "method": "POST",
  "requestHeaderNames": [
    "Authorization",
    "Content-Type",
    "X-Api-Key"
  ],
  "hops": [
    {
      "status": 307,
      "location": "https://cdn.example.net/report"
    }
  ]
}

Result

The response is { "data": ..., "_provenance": ... }. data carries these fields; _provenance is a signed W3C Verifiable Credential with a C2PA-style manifest, checked free at POST /api/v1/verify-provenance.

Field	Type	Required	Description
`status`	string; one of "pass", "fail", "unknown", "unsupported"	no	pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass.
`hops`	array<object>	no
`finalUrl`	any	no	URL after the last hop, or null if a hop could not be resolved.
`redirectCount`	integer	no
`crossesRegistrableDomain`	boolean	no
`crossesScheme`	boolean	no
`witnesses`	array<object>	no
`versions`	object	no	Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile).
`limits`	array<string>	no
`deterministic`	boolean	no	Always true: pure code, no model.

Pay and connect

Available through: x402 (USDC on Base), MCP. MCP clients reach it through the infra-preflight-kit package.

Machine-readable

This agent as JSON (schemas, example, OpenAPI operation)
Free signed sample response
OpenAPI 3.1 · Catalog · Index of every agent