> For the complete documentation index see https://domscan.net/llms.txt. Markdown versions of every docs page are available by appending .md to the page URL.

Source: https://domscan.net/ko/docs/products/security-headers

# 보안 헤더 API API 레퍼런스

HSTS, CSP, 프레임 보호 및 기타 HTTP 보안 헤더를 등급화합니다. 이 레퍼런스를 사용해 작업을 선택하고 문서화된 응답 계약을 통합하세요.

[제품 페이지 보기](https://domscan.net/ko/security-headers-api)

## 작업

GET `/v1/headers` [API 레퍼런스 보기](https://domscan.net/ko/docs/products/security-headers#getSecurityHeadersAudit)

## GET `/v1/headers`

작업: `getSecurityHeadersAudit`
크레딧 및 인증: 1
인증 필요

GET /v1/headers 크레딧: 1

#### 쿼리 매개변수

| 매개변수 | 유형 | 필수 |
| --- | --- | --- |
| url | string | 선택 사항 |
| domain | string | 선택 사항 |

#### 응답 필드

| 필드 | 유형 |
| --- | --- |
| `classification` | object |
| `classification.status` | string |
| `classification.reason` | string |
| `classification.evidence` | object |
| `classification.evidence.source` | string |
| `classification.evidence.method` | string |
| `classification.evidence.observed_at` | string |
| `classification.evidence.detail` | string |
| `classification.checked_at` | string |
| `url` | string |
| `domain` | string |
| `status` | string |
| `checked_at` | string |
| `final_url` | string \| null |
| `http_status` | integer \| null |
| `redirect_count` | integer \| null |
| `https` | boolean \| null |
| `score` | integer \| null |
| `grade` | string \| null |
| `summary` | object |
| `summary.passed` | integer |
| `summary.warned` | integer |
| `summary.failed` | integer |
| `summary.missing` | integer |
| `summary.not_applicable` | integer |
| `summary.hsts_preload_ready` | boolean |
| `summary.csp_strict` | boolean |
| `checks[]` | object[] |
| `checks[]` | object |
| `checks[].id` | string |
| `checks[].status` | string |
| `checks[].value` | string \| null |
| `checks[].detail_code` | string |
| `checks[].issues[]` | string[] |
| `checks[].weight` | integer |
| `checks[].classification` | object |
| `checks[].classification.status` | string |
| `checks[].classification.reason` | string |
| `checks[].classification.evidence` | object |
| `checks[].classification.evidence.source` | string |
| `checks[].classification.evidence.method` | string |
| `checks[].classification.evidence.observed_at` | string |
| `checks[].classification.evidence.detail` | string |
| `checks[].classification.checked_at` | string |
| `cookies[]` | object[] |
| `cookies[]` | object |
| `cookies[].name` | string |
| `cookies[].secure` | boolean |
| `cookies[].http_only` | boolean |
| `cookies[].same_site` | string \| null |
| `cookies[].issues[]` | string[] |
| `headers_raw` | object |
| `recommendations[]` | string[] |
| `fetch` | object |
| `fetch.checked_url` | string |
| `fetch.http_status` | integer \| null |
| `fetch.final_url` | string \| null |
| `fetch.via_proxy` | boolean \| null |
| `fetch.redirect_count` | integer \| null |
| `fetch.unknown_reason` | string \| null |
| `caveats[]` | string[] |
| `rubric_version` | string |

#### 예제 요청

```bash
curl -H "X-API-Key: $DOMSCAN_API_KEY" "https://domscan.net/v1/headers?url=https%3A%2F%2Fexample.com&domain=example.com"
```

```javascript
const response = await fetch("https://domscan.net/v1/headers?url=https%3A%2F%2Fexample.com&domain=example.com", {
  headers: { "X-API-Key": process.env.DOMSCAN_API_KEY },
});
const data = await response.json();
console.log(data);
```

```python
import os
import requests

response = requests.get(
    "https://domscan.net/v1/headers?url=https%3A%2F%2Fexample.com&domain=example.com",
    headers={"X-API-Key": os.environ["DOMSCAN_API_KEY"]},
)
print(response.json())
```

```go
package main

import (
	"fmt"
	"io"
	"net/http"
	"os"
)

func main() {
	req, err := http.NewRequest(http.MethodGet, "https://domscan.net/v1/headers?url=https%3A%2F%2Fexample.com&domain=example.com", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("X-API-Key", os.Getenv("DOMSCAN_API_KEY"))

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	data, err := io.ReadAll(resp.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(resp.Status, string(data))
}
```

```ruby
require "json"
require "net/http"

uri = URI("https://domscan.net/v1/headers?url=https%3A%2F%2Fexample.com&domain=example.com")
request = Net::HTTP::Get.new(uri)
request["X-API-Key"] = ENV.fetch("DOMSCAN_API_KEY")

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
  http.request(request)
end
puts JSON.pretty_generate(JSON.parse(response.body))
```

#### 예제 응답

```json
{
  "url": "https://example.com/",
  "domain": "example.com",
  "status": "ok",
  "checked_at": "2026-10-09T10:15:30.000Z",
  "final_url": "https://www.example.com/",
  "http_status": 200,
  "redirect_count": 1,
  "https": true,
  "score": 75,
  "grade": "C",
  "summary": {
    "passed": 6,
    "warned": 2,
    "failed": 0,
    "missing": 2,
    "not_applicable": 1,
    "hsts_preload_ready": false,
    "csp_strict": false
  },
  "checks": [
    {
      "id": "strict_transport_security",
      "status": "pass",
      "value": "max-age=31536000",
      "detail_code": "enabled",
      "issues": [
        "include_subdomains_missing",
        "preload_missing"
      ],
      "weight": 20
    },
    {
      "id": "content_security_policy",
      "status": "warn",
      "value": "default-src 'self'; script-src 'self' 'unsafe-inline'",
      "detail_code": "unsafe_inline",
      "issues": [
        "missing_object_src",
        "missing_base_uri",
        "unsafe_inline"
      ],
      "weight": 25
    },
    {
      "id": "clickjacking",
      "status": "pass",
      "value": "SAMEORIGIN",
      "detail_code": "x_frame_options_sameorigin",
      "issues": [],
      "weight": 10
    },
    {
      "id": "x_content_type_options",
      "status": "pass",
      "value": "nosniff",
      "detail_code": "nosniff",
      "issues": [],
      "weight": 10
    },
    {
      "id": "referrer_policy",
      "status": "pass",
      "value": "strict-origin-when-cross-origin",
      "detail_code": "strict_origin_when_cross_origin",
      "issues": [],
      "weight": 10
    },
    {
      "id": "permissions_policy",
      "status": "missing",
      "value": null,
      "detail_code": "header_missing",
      "issues": [],
      "weight": 5
    },
    {
      "id": "cross_origin_opener_policy",
      "status": "pass",
      "value": "same-origin",
      "detail_code": "same_origin",
      "issues": [],
      "weight": 5
    },
    {
      "id": "cross_origin_embedder_policy",
      "status": "not_applicable",
      "value": null,
      "detail_code": "not_set_informational",
      "issues": [],
      "weight": 0
    },
    {
      "id": "cross_origin_resource_policy",
      "status": "missing",
      "value": null,
      "detail_code": "header_missing",
      "issues": [],
      "weight": 5
    },
    {
      "id": "information_disclosure",
      "status": "warn",
      "value": "server: nginx/1.25.3",
      "detail_code": "version_disclosed",
      "issues": [
        "server_version_disclosed"
      ],
      "weight": 5
    },
    {
      "id": "cookies",
      "status": "pass",
      "value": "session",
      "detail_code": "all_flags_set",
      "issues": [],
      "weight": 5
    }
  ],
  "cookies": [
    {
      "name": "session",
      "secure": true,
      "http_only": true,
      "same_site": "lax",
      "issues": []
    }
  ],
  "headers_raw": {
    "strict-transport-security": "max-age=31536000",
    "content-security-policy": "default-src 'self'; script-src 'self' 'unsafe-inline'",
    "x-frame-options": "SAMEORIGIN",
    "x-content-type-options": "nosniff",
    "referrer-policy": "strict-origin-when-cross-origin",
    "cross-origin-opener-policy": "same-origin",
    "server": "nginx/1.25.3"
  },
  "recommendations": [
    "remove_csp_unsafe_inline",
    "add_csp_object_src_none",
    "add_csp_base_uri",
    "add_hsts_include_subdomains",
    "add_hsts_preload",
    "add_permissions_policy",
    "add_cross_origin_resource_policy",
    "hide_server_version"
  ],
  "fetch": {
    "checked_url": "https://example.com/",
    "http_status": 200,
    "final_url": "https://www.example.com/",
    "via_proxy": true,
    "redirect_count": 1,
    "unknown_reason": null
  },
  "caveats": [
    "set_cookie_visibility_limited",
    "meta_csp_not_evaluated"
  ],
  "rubric_version": "2026-10-09.1"
}
```

#### HTTP 상태 코드

- `200` 성공
- `400` 잘못된 요청
- `401` 인증되지 않음
- `402` 결제 필요
- `429` 요청 과다
- `502` 잘못된 게이트웨이

## 레퍼런스 리소스

[OpenAPI 3.0](https://domscan.net/v1/openapi.json)
[Postman](https://domscan.net/v1/postman.json)
[MCP](https://domscan.net/ko/mcp-domain-checker)