Overview

Mozilla's HTTP Observatory API scans websites and grades their HTTP security configuration, checking for headers like CSP, HSTS, X-Frame-Options, and more. It is completely free with no authentication required, making it an excellent tool for developers who want to audit and improve their site's security posture. The API powers the observatory.mozilla.org web interface.

Beginner Tip

Trigger a new scan with a POST request, then retrieve results with a GET request using the same hostname. Results are cached, so if you need a fresh scan, set the "rescan" flag to true in your POST body.

Available Data

The kind of data this API exposes, based on its documentation. We could not call the endpoint to confirm the exact field names.

Mozilla http scanner data via REST API

Example Response

Illustrative shape only — we were not able to call this endpoint (it requires credentials or exposes no public sample URL), so the fields below show the kind of data this API returns rather than a recorded response.

JSON Response · Illustrative
{
  "status": "success",
  "data": {
    "result": "Data from Mozilla http scanner",
    "description": "Mozilla observatory http scanner",
    "timestamp": "2025-01-15T10:00:00Z"
  }
}

Field Reference

grade Letter grade for the site's HTTP security (A+ to F).
score Numeric security score out of 100.
state Current scan state: PENDING, RUNNING, FINISHED, or FAILED.
tests_passed Number of individual security header tests that passed.
tests_failed Number of security header tests that failed.

Implementation Example

Calls a real endpoint of this API. Replace any placeholder credentials with your own key.

Request
const url = "https://github.com/mozilla/http-observatory/blob/master/httpobs/docs/";
const response = await fetch(url);
if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = await response.json();
console.log(data);

What Can You Build?

Note: These code examples are AI-generated and unverified. Always refer to the official API documentation for accurate usage.

Common Errors & Troubleshooting

Generated guidance based on this API's documentation, not observed by us. Treat it as a starting point and check against the provider's own error reference.

Scanner returns "pending" state The scan has been queued but not yet completed — results take a few seconds to generate.
Poll the GET endpoint every 2-3 seconds until the state changes from "PENDING" or "RUNNING" to "FINISHED".
Score lower than expected Missing or misconfigured HTTP security headers on the target site.
Review the "tests" object in the response — each failed test explains which header is missing and links to documentation.
Host not reachable error The scanned domain is not publicly accessible or is blocking Mozilla's scanner IPs.
Ensure the site is live and accessible from the public internet before submitting a scan.

Metadata Score Breakdown

Estimated from metadata — endpoint not independently tested

This score is estimated from observable metadata — HTTPS support, authentication model, declared CORS, and documentation reachability — because the API requires authentication or exposes no publicly testable endpoint. The five-signal breakdown is only shown for live-tested APIs.

Metadata estimate · endpoint not independently tested

Technical Specifications

Auth No Auth
HTTPS REQUIRED
CORS UNKNOWN
Category Security
Difficulty Beginner
Listing details not endpoint-verified

Related Tags

Similar APIs

View All →