Signature headers reached the origin intact
AGENT-ID-003 · v1.0
Computed by Scovant Cloud — this check needs Scovant's own agent-identity fetch, which the open-source engine does not perform.
What it detects
The response to the signed request carried positive evidence that the Signature, Signature-Input and Signature-Agent headers reached the origin intact.
Why it matters
Verification at the origin is only possible if the headers survive every proxy and CDN hop; recorded as evidence when a site exposes it. Absence is never inferred.
How to fix
No action needed. This is recorded as evidence of a healthy posture: the Signature, Signature-Input and Signature-Agent headers reach your origin intact through every proxy and CDN hop. Keep exposing them unchanged, and verify they still survive the hop the next time you touch your CDN config.
Example
Access-Control-Expose-Headers: Signature, Signature-Input
References
Last reviewed: 2026-09-01 · rule v1.0