curl --request POST \
  --url https://api.iotools.cloud/v1/tool/http-header-analyzer \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "headersInput": "HTTP/1.1 200 OK\nDate: Fri, 20 Mar 2026 08:15:30 GMT\nContent-Type: text/html; charset=UTF-8\nContent-Length: 24580\nContent-Encoding: gzip\nCache-Control: max-age=3600, public\nETag: \"5f3b8c2d-6004\"\nVary: Accept-Encoding\nStrict-Transport-Security: max-age=31536000; includeSubDomains\nX-Content-Type-Options: nosniff\nX-Frame-Options: SAMEORIGIN\nReferrer-Policy: strict-origin-when-cross-origin\nServer: nginx/1.24.0\nX-Powered-By: Express\nSet-Cookie: sessionId=abc123; Path=/; HttpOnly\nSet-Cookie: theme=dark; Path=/"
}
'

{
  "tool": "http-header-analyzer",
  "tool_version": "1.0.1",
  "outputs": {
    "summary": [
      {
        "metric": "Status Line",
        "value": "HTTP/1.1 200 OK"
      },
      {
        "metric": "Total Headers",
        "value": "14"
      },
      {
        "metric": "Security Headers",
        "value": "4"
      },
      {
        "metric": "Caching Headers",
        "value": "3"
      },
      {
        "metric": "CORS Headers",
        "value": "0"
      },
      {
        "metric": "Content Headers",
        "value": "3"
      },
      {
        "metric": "Custom / Non-standard Headers",
        "value": "4"
      },
      {
        "metric": "Missing Common Security Headers",
        "value": "Content-Security-Policy, Permissions-Policy"
      }
    ],
    "headers": [
      {
        "header": "Date",
        "category": "Custom",
        "value": "Fri, 20 Mar 2026 08:15:30 GMT",
        "description": "Custom or non-standard header."
      },
      {
        "header": "Content-Type",
        "category": "Content",
        "value": "text/html; charset=UTF-8",
        "description": "The MIME type of the response body and its character encoding."
      },
      {
        "header": "Content-Length",
        "category": "Content",
        "value": "24580",
        "description": "The size of the response body, in bytes."
      },
      {
        "header": "Content-Encoding",
        "category": "Content",
        "value": "gzip",
        "description": "The compression algorithm applied to the response body."
      },
      {
        "header": "Cache-Control",
        "category": "Caching",
        "value": "max-age=3600, public",
        "description": "Directives controlling how, where, and for how long the response may be cached."
      },
      {
        "header": "ETag",
        "category": "Caching",
        "value": "\"5f3b8c2d-6004\"",
        "description": "A version identifier for the resource, used for conditional requests."
      },
      {
        "header": "Vary",
        "category": "Caching",
        "value": "Accept-Encoding",
        "description": "Lists request headers that affect which cached response variant is served."
      },
      {
        "header": "Strict-Transport-Security",
        "category": "Security",
        "value": "max-age=31536000; includeSubDomains",
        "description": "Forces HTTPS connections, preventing protocol downgrade and cookie hijacking."
      },
      {
        "header": "X-Content-Type-Options",
        "category": "Security",
        "value": "nosniff",
        "description": "Prevents MIME-type sniffing so the browser respects the declared Content-Type."
      },
      {
        "header": "X-Frame-Options",
        "category": "Security",
        "value": "SAMEORIGIN",
        "description": "Controls whether the page can be rendered in a frame or iframe (clickjacking protection)."
      },
      {
        "header": "Referrer-Policy",
        "category": "Security",
        "value": "strict-origin-when-cross-origin",
        "description": "Controls how much referrer information is sent with outgoing requests."
      },
      {
        "header": "Server",
        "category": "Custom",
        "value": "nginx/1.24.0",
        "description": "Custom or non-standard header."
      },
      {
        "header": "X-Powered-By",
        "category": "Custom",
        "value": "Express",
        "description": "Custom or non-standard header."
      },
      {
        "header": "Set-Cookie",
        "category": "Custom",
        "value": "sessionId=abc123; Path=/; HttpOnly, theme=dark; Path=/",
        "description": "Custom or non-standard header."
      }
    ],
    "jsonOutput": "{\n  \"statusLine\": \"HTTP/1.1 200 OK\",\n  \"headers\": [\n    {\n      \"name\": \"Date\",\n      \"values\": [\n        \"Fri, 20 Mar 2026 08:15:30 GMT\"\n      ]\n    },\n    {\n      \"name\": \"Content-Type\",\n      \"values\": [\n        \"text/html; charset=UTF-8\"\n      ]\n    },\n    {\n      \"name\": \"Content-Length\",\n      \"values\": [\n        \"24580\"\n      ]\n    },\n    {\n      \"name\": \"Content-Encoding\",\n      \"values\": [\n        \"gzip\"\n      ]\n    },\n    {\n      \"name\": \"Cache-Control\",\n      \"values\": [\n        \"max-age=3600, public\"\n      ]\n    },\n    {\n      \"name\": \"ETag\",\n      \"values\": [\n        \"\\\"5f3b8c2d-6004\\\"\"\n      ]\n    },\n    {\n      \"name\": \"Vary\",\n      \"values\": [\n        \"Accept-Encoding\"\n      ]\n    },\n    {\n      \"name\": \"Strict-Transport-Security\",\n      \"values\": [\n        \"max-age=31536000; includeSubDomains\"\n      ]\n    },\n    {\n      \"name\": \"X-Content-Type-Options\",\n      \"values\": [\n        \"nosniff\"\n      ]\n    },\n    {\n      \"name\": \"X-Frame-Options\",\n      \"values\": [\n        \"SAMEORIGIN\"\n      ]\n    },\n    {\n      \"name\": \"Referrer-Policy\",\n      \"values\": [\n        \"strict-origin-when-cross-origin\"\n      ]\n    },\n    {\n      \"name\": \"Server\",\n      \"values\": [\n        \"nginx/1.24.0\"\n      ]\n    },\n    {\n      \"name\": \"X-Powered-By\",\n      \"values\": [\n        \"Express\"\n      ]\n    },\n    {\n      \"name\": \"Set-Cookie\",\n      \"values\": [\n        \"sessionId=abc123; Path=/; HttpOnly\",\n        \"theme=dark; Path=/\"\n      ]\n    }\n  ],\n  \"analysis\": [\n    {\n      \"name\": \"Date\",\n      \"category\": \"custom\",\n      \"standard\": false,\n      \"description\": \"Custom or non-standard header.\"\n    },\n    {\n      \"name\": \"Content-Type\",\n      \"category\": \"content\",\n      \"standard\": true,\n      \"description\": \"The MIME type of the response body and its character encoding.\"\n    },\n    {\n      \"name\": \"Content-Length\",\n      \"category\": \"content\",\n      \"standard\": true,\n      \"description\": \"The size of the response body, in bytes.\"\n    },\n    {\n      \"name\": \"Content-Encoding\",\n      \"category\": \"content\",\n      \"standard\": true,\n      \"description\": \"The compression algorithm applied to the response body.\"\n    },\n    {\n      \"name\": \"Cache-Control\",\n      \"category\": \"caching\",\n      \"standard\": true,\n      \"description\": \"Directives controlling how, where, and for how long the response may be cached.\"\n    },\n    {\n      \"name\": \"ETag\",\n      \"category\": \"caching\",\n      \"standard\": true,\n      \"description\": \"A version identifier for the resource, used for conditional requests.\"\n    },\n    {\n      \"name\": \"Vary\",\n      \"category\": \"caching\",\n      \"standard\": true,\n      \"description\": \"Lists request headers that affect which cached response variant is served.\"\n    },\n    {\n      \"name\": \"Strict-Transport-Security\",\n      \"category\": \"security\",\n      \"standard\": true,\n      \"description\": \"Forces HTTPS connections, preventing protocol downgrade and cookie hijacking.\"\n    },\n    {\n      \"name\": \"X-Content-Type-Options\",\n      \"category\": \"security\",\n      \"standard\": true,\n      \"description\": \"Prevents MIME-type sniffing so the browser respects the declared Content-Type.\"\n    },\n    {\n      \"name\": \"X-Frame-Options\",\n      \"category\": \"security\",\n      \"standard\": true,\n      \"description\": \"Controls whether the page can be rendered in a frame or iframe (clickjacking protection).\"\n    },\n    {\n      \"name\": \"Referrer-Policy\",\n      \"category\": \"security\",\n      \"standard\": true,\n      \"description\": \"Controls how much referrer information is sent with outgoing requests.\"\n    },\n    {\n      \"name\": \"Server\",\n      \"category\": \"custom\",\n      \"standard\": false,\n      \"description\": \"Custom or non-standard header.\"\n    },\n    {\n      \"name\": \"X-Powered-By\",\n      \"category\": \"custom\",\n      \"standard\": false,\n      \"description\": \"Custom or non-standard header.\"\n    },\n    {\n      \"name\": \"Set-Cookie\",\n      \"category\": \"custom\",\n      \"standard\": false,\n      \"description\": \"Custom or non-standard header.\"\n    }\n  ],\n  \"summary\": {\n    \"totalHeaders\": 14,\n    \"categories\": {\n      \"security\": 4,\n      \"caching\": 3,\n      \"cors\": 0,\n      \"content\": 3,\n      \"custom\": 4\n    },\n    \"missingSecurityHeaders\": [\n      \"Content-Security-Policy\",\n      \"Permissions-Policy\"\n    ]\n  }\n}"
  },
  "credits_used": 3,
  "credits_remaining": null
}