curl --request POST \
  --url https://api.iotools.cloud/v1/tool/csp-resource-evaluator \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data @- <<EOF
{
  "cspHeader": "default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline'; img-src *",
  "pageOrigin": "",
  "checkType": "url",
  "resourceKind": "script",
  "resourceUrl": "https://cdn.example.com/app.js",
  "inlineContent": ""
}
EOF

{
  "tool": "csp-resource-evaluator",
  "tool_version": "1.0.2",
  "outputs": {
    "verdict": "Allowed",
    "directiveChecked": "script-src",
    "matchedSource": "https://cdn.example.com",
    "explanation": "Matches the host source https://cdn.example.com.",
    "requiredHash": "",
    "weaknesses": [
      {
        "directive": "style-src",
        "issue": "'unsafe-inline' allows any inline <style>/style attribute, usable for CSS-based data exfiltration",
        "severity": "Medium"
      },
      {
        "directive": "base-uri",
        "issue": "Not set — an injected <base> tag could hijack every relative URL on the page",
        "severity": "Medium"
      },
      {
        "directive": "frame-ancestors",
        "issue": "Not set — this policy alone does not mitigate clickjacking (pair with X-Frame-Options if needed)",
        "severity": "Low"
      }
    ]
  },
  "credits_used": 5,
  "credits_remaining": null
}