Overview
Mozilla's HTTP Observatory API scans websites and grades their HTTP security configuration, checking for headers like CSP, HSTS, X-Frame-Options, and more. It is completely free with no authentication required, making it an excellent tool for developers who want to audit and improve their site's security posture. The API powers the observatory.mozilla.org web interface.
Beginner Tip
Trigger a new scan with a POST request, then retrieve results with a GET request using the same hostname. Results are cached, so if you need a fresh scan, set the "rescan" flag to true in your POST body.
Available Data
The kind of data this API exposes, based on its documentation. We could not call the endpoint to confirm the exact field names.
Example Response
Illustrative shape only — we were not able to call this endpoint (it requires credentials or exposes no public sample URL), so the fields below show the kind of data this API returns rather than a recorded response.
{
"status": "success",
"data": {
"result": "Data from Mozilla http scanner",
"description": "Mozilla observatory http scanner",
"timestamp": "2025-01-15T10:00:00Z"
}
} Field Reference
grade Letter grade for the site's HTTP security (A+ to F). score Numeric security score out of 100. state Current scan state: PENDING, RUNNING, FINISHED, or FAILED. tests_passed Number of individual security header tests that passed. tests_failed Number of security header tests that failed. Implementation Example
Calls a real endpoint of this API. Replace any placeholder credentials with your own key.
const url = "https://github.com/mozilla/http-observatory/blob/master/httpobs/docs/";
const response = await fetch(url);
if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = await response.json();
console.log(data); What Can You Build?
Note: These code examples are AI-generated and unverified. Always refer to the official API documentation for accurate usage.
Common Errors & Troubleshooting
Generated guidance based on this API's documentation, not observed by us. Treat it as a starting point and check against the provider's own error reference.
Metadata Score Breakdown
Estimated from metadata — endpoint not independently tested
Metadata estimate · endpoint not independently tested
Technical Specifications
Related Tags
Similar APIs
View All →EmailRep
⭐ Beginner's PickEmailRep is a free API that evaluates the risk and reputation of an email address in seconds.
FilterLists
⭐ Beginner's PickFilterLists is a community-maintained directory API that catalogs hundreds of filter lists used by ad blockers and firewalls like uBlock Origin and Pi-hole.
Passwordinator
⭐ Beginner's PickThe Passwordinator API generates random passwords with customizable complexity, length, and character sets.
FingerprintJS Pro
FingerprintJS Pro is a browser fingerprinting API that identifies visitors with extreme accuracy, even in incognito mode.
HaveIBeenPwned
⭐ Beginner's PickHave I Been Pwned (HIBP) lets you check whether an email address or password has appeared in known data breaches.