MDN HTTP Observatory API
Free MDN HTTP Observatory API with no key: scan any site's security headers — CSP, HSTS, X-Frame-Options — and get a graded score with fixes. Tested.
Endpoint tested and returned HTTP 200 on 20 Aug 2026
What is the MDN HTTP Observatory API?
The MDN HTTP Observatory API is a free, key-free service that scans a website's HTTP security headers — Content Security Policy, HSTS, X-Frame-Options, cookies and more — returning a letter grade and specific remediation advice.
Originally built by Mozilla and now maintained under MDN, the Observatory is the standard reference for HTTP security header configuration. It checks around a dozen policies and grades the result from A+ to F.
Scans are triggered with a POST and take a few seconds while the site is fetched and analysed. The grade is genuinely actionable — each failed test comes with a description of what is missing and why it matters, which makes it useful in CI rather than just as a one-off check.
Quick facts
- Base URL
https://observatory-api.mdn.mozilla.net/api/v2- Authentication
- No API key required.
- Rate limit
- Scans are throttled per host; a recent scan is returned from cache rather than re-run.
- Pricing
- Free, provided by Mozilla/MDN.
- CORS
- Enabled — callable directly from browser JavaScript
- Official docs
- Read the docs
How to use the MDN HTTP Observatory API
Every request below was executed against the live API on 20 Aug 2026, and the response shown is the real body it returned — not an illustration.
1. Scan a site's security headers
POST https://observatory-api.mdn.mozilla.net/api/v2/scan?host=example.com
curl -X POST 'https://observatory-api.mdn.mozilla.net/api/v2/scan?host=example.com'const res = await fetch("https://observatory-api.mdn.mozilla.net/api/v2/scan?host=example.com", {
method: "POST",
});
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);import requests
res = requests.post("https://observatory-api.mdn.mozilla.net/api/v2/scan?host=example.com", timeout=20)
res.raise_for_status()
print(res.json()){
"id": 115723704,
"details_url": "https://developer.mozilla.org/en-US/observatory/analyze?host=example.com",
"algorithm_version": 5,
"scanned_at": "2026-08-19T21:58:06.119Z",
"error": null,
"grade": "F",
"score": 10,
"status_code": 200,
"tests_failed": 5,
"tests_passed": 5,
"tests_quantity": 10
}Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
scan?host= | string | Required | Hostname to scan. Trigger with POST. host=example.com |
(POST) | method | Required | Scans are initiated with POST, not GET. POST |
Response fields
idinteger- Scan identifier.
scanned_atstring- When the scan ran.
gradestring- Letter grade from A+ to F.
scoreinteger- Numeric score; 100 is the baseline, bonuses can exceed it.
tests_passed / tests_failedinteger- How many individual checks passed.
details_urlstring- Human-readable results page on MDN.
status_codeinteger- HTTP status returned by the scanned site.
What you can build with the MDN HTTP Observatory API
- Audit your own site's security header configuration
- Gate a deployment on maintaining a security grade
- Compare header hygiene across a portfolio of sites
- Teach web security with concrete graded feedback
Common errors and how to fix them
405 on GET
Scans must be initiated with POST.
Fix: Send a POST to /scan?host=example.com; GET alone will not start a scan.
Cached result returned
Recent scans are not re-run.
Fix: That is intentional throttling — wait before rescanning the same host.
Low grade despite HTTPS
The grade covers headers, not just TLS.
Fix: Content Security Policy is the heaviest weighted test and the most commonly missing.
MDN HTTP Observatory API — frequently asked questions
Is the HTTP Observatory API free?
Yes, free with no API key, provided by Mozilla and now maintained under MDN.
What does it actually check?
HTTP security headers — Content Security Policy, HSTS, X-Frame-Options, X-Content-Type-Options, referrer policy, cookie flags, subresource integrity and CORS configuration.
Why is my HTTPS site still getting a low grade?
The grade measures headers, not just TLS. Content Security Policy is the most heavily weighted test and the one most sites are missing entirely.
How do I trigger a scan?
POST to /api/v2/scan?host=example.com. A GET alone returns 405 — scans must be initiated with POST.
Tools that pair with this API
Alternatives to MDN HTTP Observatory API
If MDN HTTP Observatory does not fit, these security & auth apis cover similar ground. Every one was called before publishing, and each links to its own reference page with a working curl command and the response it returned.
| API | What it does | Auth | CORS | Last verified |
|---|---|---|---|---|
| Pwned Passwords | Free Have I Been Pwned password API with no key. Check if a password appears in known breaches using k-anonymity — the password never leaves your server. Tested. | No key | Yes | 19 Aug 2026 |
| Have I Been Pwned Breaches | Free Have I Been Pwned breach list API with no key: every catalogued data breach with date, affected accounts and compromised data types. Tested curl example. | No key | Yes | 19 Aug 2026 |
| NVD CVE | Free NIST National Vulnerability Database API: search CVEs by id, keyword, severity, CVSS score and date with full descriptions and references. Tested example. | No key | Yes | 19 Aug 2026 |
| CIRCL CVE Search | Free CIRCL CVE Search API with no key: query vulnerabilities by id, vendor or product, and pull the latest published CVEs. CORS enabled. Tested example. | No key | Yes | 19 Aug 2026 |
| Microsoft Security Response Center | Free Microsoft Security Response Center API with no key: monthly security update summaries and full CVRF documents with CVEs, affected products, KB articles and severities. | No key | No | 21 Aug 2026 |
| OpenPhish Community Feed | Free OpenPhish community feed with no key: a live plain-text list of active phishing URLs, refreshed continuously. One URL per line, ready for blocklists and enrichment. | No key | Yes | 21 Aug 2026 |
MDN HTTP Observatory is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 20 Aug 2026; always check the official documentation before relying on this API in production, as terms and limits can change.