Security
CSP Header Builder API
GET request to /v1/csp-builder, returning text in the standard envelope.
GET
/v1/csp-builder2 credits / call Free tierAuthentication
Send your API key as a bearer token. Create one free in the dashboard.
Authorization: Bearer $TOOLSXPO_KEYParameters
Sent as query-string parameters. The values below are the examples used throughout this page.
| Name | Example value |
|---|---|
| defaultSrc | 'self' |
| scriptSrc | 'self' |
| styleSrc | 'self' |
| imgSrc | 'self' |
| connectSrc | 'self' |
| fontSrc | 'self' |
| frameAncestors | 'none' |
| baseUri | 'self' |
| formAction | 'self' |
| upgradeInsecure | false |
| blockMixed | false |
Example request
curl "https://api.toolsxpo.com/v1/csp-builder?defaultSrc='self'&scriptSrc='self'&styleSrc='self'&imgSrc='self'&connectSrc='self'&fontSrc='self'&frameAncestors='none'&baseUri='self'&formAction='self'&upgradeInsecure=false&blockMixed=false" \
-H "Authorization: Bearer $TOOLSXPO_KEY"Response
Every endpoint answers with the same envelope. The result is in data (text); meta.credits reports what the call cost.
{
"ok": true,
"data": { /* text */ },
"meta": { "credits": 2 }
}Errors
Failures use the same envelope with ok: false and a machine-readable code.
| Status | Code | Meaning |
|---|---|---|
| 400 | invalid_input | A parameter failed validation. `details` lists which. |
| 401 | unauthorized | Missing or invalid API key. |
| 402 | quota_exceeded | Out of credits on this workspace. |
| 404 | not_found | No such tool. |
| 429 | rate_limited | Too many requests. Retry after `Retry-After` seconds. |
| 503 | service_unavailable | Temporarily disabled by an administrator. |