curl --request POST \
  --url https://api.iotools.cloud/v1/tool/security-headers-checker \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data @- <<EOF
{
  "headersInput": "Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; report-to csp-endpoint\nStrict-Transport-Security: max-age=31536000; includeSubDomains; preload\nX-Frame-Options: DENY\nX-Content-Type-Options: nosniff\nReferrer-Policy: strict-origin-when-cross-origin\nPermissions-Policy: camera=(), microphone=(), geolocation=(), payment=()\nCross-Origin-Opener-Policy: same-origin\nCross-Origin-Embedder-Policy: require-corp"
}
EOF

{
  "tool": "security-headers-checker",
  "tool_version": "1.0.1",
  "outputs": {
    "gradeSummary": [
      {
        "metric": "Grade",
        "value": "A+"
      },
      {
        "metric": "Score",
        "value": "98 / 100"
      },
      {
        "metric": "Headers Present",
        "value": "8 / 8"
      },
      {
        "metric": "Headers Missing",
        "value": "None"
      }
    ],
    "headerResults": [
      {
        "header": "Content-Security-Policy",
        "status": "Good",
        "weight": "25",
        "value": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; report-to csp-endpoint",
        "notes": "CSP reporting is configured"
      },
      {
        "header": "Strict-Transport-Security",
        "status": "Good",
        "weight": "20",
        "value": "max-age=31536000; includeSubDomains; preload",
        "notes": "max-age is 1 year(s); includeSubDomains is set; Eligible for HSTS preload list (hstspreload.org)"
      },
      {
        "header": "X-Frame-Options",
        "status": "Good",
        "weight": "10",
        "value": "DENY",
        "notes": "DENY — page cannot be framed by any site"
      },
      {
        "header": "X-Content-Type-Options",
        "status": "Good",
        "weight": "10",
        "value": "nosniff",
        "notes": "Correctly set to nosniff"
      },
      {
        "header": "Referrer-Policy",
        "status": "Good",
        "weight": "10",
        "value": "strict-origin-when-cross-origin",
        "notes": "\"strict-origin-when-cross-origin\" provides good privacy protection"
      },
      {
        "header": "Permissions-Policy",
        "status": "Warning",
        "weight": "10",
        "value": "camera=(), microphone=(), geolocation=(), payment=()",
        "notes": "camera is disabled; microphone is disabled; geolocation is disabled; payment is disabled; Consider restricting: usb, magnetometer, gyroscope, accelerometer"
      },
      {
        "header": "Cross-Origin-Opener-Policy",
        "status": "Good",
        "weight": "8",
        "value": "same-origin",
        "notes": "same-origin — strongest isolation"
      },
      {
        "header": "Cross-Origin-Embedder-Policy",
        "status": "Good",
        "weight": "7",
        "value": "require-corp",
        "notes": "require-corp — strongest protection, enables cross-origin isolation"
      }
    ]
  },
  "credits_used": 3,
  "credits_remaining": null
}