{ "openapi": "3.0.1", "info": { "title": "Security Response Header Regression Gate", "description": "Learn when a deploy, a CDN rule or a proxy change removes or weakens a security header on your production URLs. The Actor compares HSTS, CSP (each directive), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and the cross-origi", "version": "0.1", "x-build-id": "OURfH2PDV9DSn4MpD" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/kingii98~security-response-header-regression-gate/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-kingii98-security-response-header-regression-gate", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/kingii98~security-response-header-regression-gate/runs": { "post": { "operationId": "runs-sync-kingii98-security-response-header-regression-gate", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/kingii98~security-response-header-regression-gate/run-sync": { "post": { "operationId": "run-sync-kingii98-security-response-header-regression-gate", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "urls" ], "properties": { "urls": { "title": "URLs", "minItems": 1, "maxItems": 200, "type": "array", "description": "1 to 200 absolute http or https URLs. The Actor sends one GET request to each URL, follows up to 5 redirects, and reads the security headers of the final response. It does not crawl. If you leave this field empty, the Actor checks the three public demo URLs shown below.", "default": [ "https://github.com/", "https://www.mozilla.org/en-US/", "https://www.gov.uk/" ], "items": { "type": "string" } }, "required_headers": { "title": "Required header policy", "type": "object", "description": "Optional. Headers that must be present, with minimum values. Each key is one of the ten security headers. Each value is true (the header must be present) or an object of rules. All headers: \"allowed_values\". Strict-Transport-Security: \"min_max_age\", \"include_subdomains\", \"preload\". Content-Security-Policy: \"required_directives\" and \"forbidden_sources\" (for example {\"script-src\": [\"'unsafe-inline'\"]}). A violation is a policy_violation record with the severity high.", "default": {} }, "fail_on": { "title": "Fail on severity", "enum": [ "critical", "high", "medium", "low" ], "type": "string", "description": "The lowest severity that sets gate_pass to false. A regression at or above this severity also keeps its baseline value, so the gate stays failed until the header comes back or you reset the baseline.", "default": "high" }, "baseline_name": { "title": "Baseline name", "type": "string", "description": "Optional. The record key of the baseline in the named key-value store \"security-header-baseline\". If you leave it empty, the Actor uses one record for each URL set (\"urls-\" and a hash of the sorted URLs).", "default": "" }, "reset_baseline": { "title": "Reset the baseline", "type": "boolean", "description": "Write the current headers as the new baseline, and report no changes. Use it after you removed or changed a header on purpose.", "default": false }, "alert_webhook_url": { "title": "Alert webhook URL", "type": "string", "description": "Optional. One public HTTPS URL. The Actor sends one JSON POST when the run finds a regression. Private and reserved addresses are refused, and a redirect is not followed.", "default": "" }, "request_timeout_seconds": { "title": "Request timeout (seconds)", "minimum": 2, "maximum": 60, "type": "integer", "description": "Timeout for each request and for the webhook POST. One URL gets one request and one retry, so it takes at most 2 x this value + 5 seconds.", "default": 15 }, "concurrency": { "title": "Concurrency", "minimum": 1, "maximum": 20, "type": "integer", "description": "Maximum number of URLs requested at the same time.", "default": 10 }, "max_redirects": { "title": "Maximum redirects", "minimum": 0, "maximum": 10, "type": "integer", "description": "Maximum redirect hops for each request. The Actor checks each hop again against the private-address rules.", "default": 5 }, "max_run_seconds": { "title": "Maximum seconds for the whole run", "minimum": 30, "maximum": 3600, "type": "integer", "description": "Wall-clock deadline for the URL list and the confirmation requests. A URL that the run does not reach before this deadline gets the RUN_DEADLINE reason code and keeps its baseline. The run still succeeds.", "default": 240 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } }