A browser receives a status code, a set of headers and a body, then hides almost all of it. When a page feels slow, when a link moves through three domains, or when a security scanner reports a missing header, the evidence sits in the response. The HTTP check endpoint returns it in one request: status, redirect chain, protocol version, time to first byte, compression and security headers.
The usual first call is the site root:
curl "https://api2.globus.studio/v2/http-check?url=https%3A%2F%2Fglobus.studio%2F"The redirect chain, hop by hop
A redirect is cheap in a browser and expensive for a visitor on a slow connection. Each hop adds a round trip before the first byte of HTML arrives. The endpoint follows up to five hops and returns every step with its status code, so a chain from http to www to a locale prefix is visible as three requests.
Two problems appear in that list. A redirect loop is refused at the limit and reported as an issue. A redirect to a private or reserved address is also refused: the endpoint only contacts public hosts on ports 80 and 443, and it applies the same rule at every hop.
Security headers as structured data
HSTS is the header most often present and least often correct. The endpoint parses max-age, includeSubDomains and preload separately, and flags a max-age below six months, which is the point where browsers and audits stop treating the setting as long-lived.
Content-Security-Policy is reported as a flag, and the response also records whether frame-ancestors appears in it. That directive replaces X-Frame-Options for modern browsers, and a page that has CSP without it is still framable. X-Content-Type-Options is checked for the exact value nosniff, because the header can be present with any text.
The issues array collects the readable findings: no HSTS, a short max-age, no CSP, no nosniff, no frame protection, uncompressed HTML, a final status above 399, or a chain longer than five hops.
Timing and compression
ttfb_ms is the time to first byte measured by the HTTP client, and total_ms covers the full exchange. The difference between the two is the time spent receiving the body, which grows with an uncompressed page.
The endpoint asks for compression and decodes the response, so size_bytes is the readable size and compression comes from the response header. A large HTML page served without gzip or brotli is a concrete performance item, and the issue list names it.
Reading the protocol version
http_version reports what the server actually negotiated. A site behind a CDN usually answers over HTTP/2 or HTTP/3. A server that still answers over HTTP/1.1 on the same hostname is worth a look, because the difference is often a proxy configuration that also disables compression or caching.
Every header is also returned in the raw map, including the ones without a dedicated check. A cache-control: no-store on a marketing page, a missing vary header when the response depends on language, and a content-type without a charset are all visible there, and none of them needs a second endpoint.
Limits
The body limit is 256 KB, which is enough for headers and a status check. Answers are cached for ten minutes, and the rate limit is 30 requests per minute, the tier for endpoints that make an outbound request.
The endpoint does not scan ports, does not follow links found in the page, and does not try other methods. It sends one GET per hop and reports what came back.
The catalogue page has the parameter table and a live example: HTTP check API.