Server-side precheck for the tooltip / product-tour editor. Fetches the given URL (SSRF-guarded) and reports blockers (COOP, CSP frame-src, login/cross-origin redirect, invalid URL) so the dashboard can give the user actionable feedback instead of opening a blank editor.
Bearer <token>.Reserved. Currently ignored; the precheck result does not depend on the engagement type.
Extra request headers to send when fetching the URL, for pages behind basic auth or a preview/bypass token. Malformed or transport-level headers are dropped server-side.
Ok