{"uid":"cap_GCIt5-RDXXyd_Wkx4390n","slug":"agent-exec-url-attestation-7c2d09e4","name":"agent-exec URL Attestation","description":"Accountless, pay-per-use code execution for software agents: submit source code, get stdout, stderr and exit code back from an isolated, network-less sandbox. No account, no API key -- possession of valid payment is sufficient.","url":"https://agent-exec.448c.org/attest?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","required":["url"],"properties":{"url":{"type":"string","description":"An absolute http:// or https:// URL, at most 2048 UTF-8 bytes. Fetched from OUR vantage point; the body is never returned to you."}}},"responseSchema":{"type":"object","required":["attestation_id","url","observed_at","fetch_ok","fetch_code","http_status","body_sha256","body_bytes","body_truncated","content_type","final_url_after_redirects","redirects","detail","signature","signer_address"],"properties":{"url":{"type":"string","description":"The URL you asked us to fetch, exactly as sent."},"detail":{"type":["string","null"],"description":"Free-text detail on a non-OK fetch_code (e.g. the timeout budget, the unsafe redirect target). Null when fetch_ok is true."},"payment":{"type":"object","properties":{"asset":{"type":"string"},"payer":{"type":"string","description":"The paying wallet's address."},"amount":{"type":"string","description":"Atomic units of the settlement asset that were charged."},"network":{"type":"string"},"transaction":{"type":"string","description":"On-chain settlement transaction hash."}},"description":"Only present on POST /attest's 201, never on a GET /attest/{id} read."},"fetch_ok":{"type":"boolean","description":"Whether the fetch reached a real HTTP response, however unsuccessful. false means DNS/connect failure, timeout, or a redirect refused for SSRF safety -- see fetch_code."},"redirects":{"type":"integer","description":"How many redirects were followed before the final response (or the refusal)."},"signature":{"type":"string","description":"An EIP-191 personal-sign signature over attestation_id, url, final_url_after_redirects, observed_at, http_status, body_sha256, body_bytes, body_truncated, content_type, fetch_ok, fetch_code and redirects (domain \"agent-exec attestation v2\"), from signer_address. `detail` and `signer_address` are NOT part of the signed message. Verify with viem's verifyMessage({address: signer_address, message, signature}) -- see GET /attest/{id}'s description for the exact message and for handling an attestation signed under the prior v1 domain."},"body_bytes":{"type":"integer","description":"Bytes actually read off the wire, capped at 1048576 per fetch -- see body_truncated."},"fetch_code":{"enum":["ATTEST_FETCH_OK","ATTEST_FETCH_URL_REFUSED","ATTEST_FETCH_REDIRECT_UNSAFE","ATTEST_FETCH_TOO_MANY_REDIRECTS","ATTEST_FETCH_TIMEOUT","ATTEST_FETCH_CONNECT_FAILED"],"type":"string"},"body_sha256":{"type":["string","null"],"description":"sha256 of the fetched body, hex-encoded, or null if fetch_ok is false. The body itself is never returned or stored beyond this hash."},"http_status":{"type":["integer","null"],"description":"The HTTP status the final hop answered with, or null if fetch_ok is false."},"observed_at":{"type":"string","format":"date-time","description":"When the fetch completed, ISO 8601."},"content_type":{"type":["string","null"],"description":"The Content-Type header on the final response, or null if fetch_ok is false."},"attestation_id":{"type":"string","format":"uuid","description":"Pass as GET /attest/{id} to read this back, or hand it to a third party to verify."},"body_truncated":{"type":"boolean","description":"True if the body was larger than the per-fetch cap and body_sha256/body_bytes cover only the truncated prefix."},"signer_address":{"type":"string","description":"The address that signed this attestation. Also published at GET /health as attestSignerAddress, if you lost track of which address to verify against."},"final_url_after_redirects":{"type":["string","null"],"description":"The URL actually fetched after following redirects, or null if the fetch never reached one."}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.008","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.008/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.008","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.008","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_-gDhkZZm9z-EcnZ8iRP07","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.008","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Fetches a URL from a neutral vantage point and returns a cryptographically signed attestation of the HTTP response metadata, including status code, body hash, and redirect chain.","exampleAgentPrompt":"Can you fetch https://example.com/invoice/abc123 from a neutral server and give me a cryptographically signed attestation — including the HTTP status code, body hash, and any redirects — so I can prove what was there at this moment?","exampleUseCases":[{"title":"Prove a payment page was live","prompt":"I need a signed, tamper-proof attestation that https://checkout.mystore.com/order/9921 returned a 200 OK right now — include the body hash and final URL so I can attach it to the transaction record."},{"title":"Audit a file download URL","prompt":"Can you independently fetch https://releases.myapp.io/v2.1/installer.exe and give me a cryptographic attestation of its SHA-256 hash and byte count so I can verify nobody tampered with the file?"},{"title":"Verify a redirect chain destination","prompt":"Please attest where https://short.link/promo ultimately redirects — I need the signed record of the final URL and how many hops it took, so I can confirm it's pointing to the right landing page."}],"resultDescription":"Returns a signed attestation object containing: a unique attestation ID, the requested URL, the final URL after any redirects, the number of redirects followed, the HTTP status code, whether the fetch succeeded (fetch_ok), a fetch_code for failures, the SHA-256 hash of the response body, the body size in bytes, a truncation flag, the content type, the timestamp of observation, and an EIP-191 personal-sign signature over all key fields from a known signer address. On success (HTTP 201), also includes payment metadata (asset, payer address, amount, network, transaction hash).","failureModes":["DNS or TCP connection failure returns fetch_ok=false with a descriptive fetch_code","SSRF-safety refusal (e.g. private IP ranges or redirect to unsafe target) returns fetch_ok=false with detail explaining the refusal","Timeout budget exceeded returns fetch_ok=false with the timeout value in detail","Invalid or non-absolute URL in the request body returns a 4xx error before any fetch is attempted","Payment failure or insufficient funds returns HTTP 402 with payment requirements","Body larger than 1 MB is read but truncated; body_truncated=true is set in the response"],"whenToPreferThis":"Choose this endpoint when you need a neutral, third-party HTTP fetch with a cryptographically signed, on-chain-verifiable attestation of the response — particularly for proving what a URL returned at a specific moment in time without trusting the requester's own report. It is ideal for dispute resolution, audit trails, and smart-contract-adjacent workflows where tamper-proof provenance matters. Unlike simple uptime monitors, it produces EIP-191 signatures verifiable with viem, making it suitable for blockchain and Web3 contexts. It requires no account or API key — only a valid x402 USDC micropayment.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-11T00:31:36.084Z","isFirstParty":false,"canonicalSlug":"agent-exec-url-attestation-7c2d09e4"}