BYTETOOLS

MDN HTTP Observatory API

Free MDN HTTP Observatory API with no key: scan any site's security headers — CSP, HSTS, X-Frame-Options — and get a graded score with fixes. Tested.

No API key requiredCORS enabledHTTPSFree tier

Endpoint tested and returned HTTP 200 on 2026-08-20

What is the MDN HTTP Observatory API?

The MDN HTTP Observatory API is a free, key-free service that scans a website's HTTP security headers — Content Security Policy, HSTS, X-Frame-Options, cookies and more — returning a letter grade and specific remediation advice.

Originally built by Mozilla and now maintained under MDN, the Observatory is the standard reference for HTTP security header configuration. It checks around a dozen policies and grades the result from A+ to F.

Scans are triggered with a POST and take a few seconds while the site is fetched and analysed. The grade is genuinely actionable — each failed test comes with a description of what is missing and why it matters, which makes it useful in CI rather than just as a one-off check.

Quick facts

Base URL
https://observatory-api.mdn.mozilla.net/api/v2
Authentication
No API key required.
Rate limit
Scans are throttled per host; a recent scan is returned from cache rather than re-run.
Pricing
Free, provided by Mozilla/MDN.
CORS
Enabled — callable directly from browser JavaScript
Official docs
Read the docs

How to use the MDN HTTP Observatory API

Every request below was executed against the live API on 2026-08-20, and the response shown is the real body it returned — not an illustration.

1. Scan a site's security headers

POST https://observatory-api.mdn.mozilla.net/api/v2/scan?host=example.com

curl
curl -X POST 'https://observatory-api.mdn.mozilla.net/api/v2/scan?host=example.com'
JavaScript (fetch)
const res = await fetch("https://observatory-api.mdn.mozilla.net/api/v2/scan?host=example.com", {
  method: "POST",
});
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);
Python (requests)
import requests

res = requests.post("https://observatory-api.mdn.mozilla.net/api/v2/scan?host=example.com", timeout=20)
res.raise_for_status()
print(res.json())
Response — HTTP 200
{
  "id": 115723704,
  "details_url": "https://developer.mozilla.org/en-US/observatory/analyze?host=example.com",
  "algorithm_version": 5,
  "scanned_at": "2026-08-19T21:58:06.119Z",
  "error": null,
  "grade": "F",
  "score": 10,
  "status_code": 200,
  "tests_failed": 5,
  "tests_passed": 5,
  "tests_quantity": 10
}

Parameters

ParameterTypeRequiredDescription
scan?host=stringRequiredHostname to scan. Trigger with POST. host=example.com
(POST)methodRequiredScans are initiated with POST, not GET. POST

Response fields

idinteger
Scan identifier.
scanned_atstring
When the scan ran.
gradestring
Letter grade from A+ to F.
scoreinteger
Numeric score; 100 is the baseline, bonuses can exceed it.
tests_passed / tests_failedinteger
How many individual checks passed.
details_urlstring
Human-readable results page on MDN.
status_codeinteger
HTTP status returned by the scanned site.

What you can build with the MDN HTTP Observatory API

  • Audit your own site's security header configuration
  • Gate a deployment on maintaining a security grade
  • Compare header hygiene across a portfolio of sites
  • Teach web security with concrete graded feedback

Common errors and how to fix them

405 on GET

Scans must be initiated with POST.

Fix: Send a POST to /scan?host=example.com; GET alone will not start a scan.

Cached result returned

Recent scans are not re-run.

Fix: That is intentional throttling — wait before rescanning the same host.

Low grade despite HTTPS

The grade covers headers, not just TLS.

Fix: Content Security Policy is the heaviest weighted test and the most commonly missing.

MDN HTTP Observatory API — frequently asked questions

Is the HTTP Observatory API free?

Yes, free with no API key, provided by Mozilla and now maintained under MDN.

What does it actually check?

HTTP security headers — Content Security Policy, HSTS, X-Frame-Options, X-Content-Type-Options, referrer policy, cookie flags, subresource integrity and CORS configuration.

Why is my HTTPS site still getting a low grade?

The grade measures headers, not just TLS. Content Security Policy is the most heavily weighted test and the one most sites are missing entirely.

How do I trigger a scan?

POST to /api/v2/scan?host=example.com. A GET alone returns 405 — scans must be initiated with POST.

Tools that pair with this API

JSON Formatter

Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.

MDN HTTP Observatory is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-20; always check the official documentation before relying on this API in production, as terms and limits can change.