{"uid":"cap_K7IvjlGmqZVbmqCcVspPd","slug":"x402-preflight-audit-8481fd04","name":"x402 Preflight Audit","description":"Inspect and validate an x402 endpoint before an autonomous agent spends USDC.","url":"https://x402.chikocorp.com/api/x402/preflight/audit?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"type":"object","required":["resource_url"],"properties":{"method":{"enum":["GET","HEAD","POST"],"type":"string","default":"GET"},"resource_url":{"type":"string","pattern":"^https://","maxLength":2048,"description":"Public HTTPS x402 resource to inspect without payment credentials."},"max_price_usd":{"type":"number","maximum":1000000,"minimum":0},"expected_network":{"type":"string","pattern":"^[a-z0-9]+:[A-Za-z0-9._-]+$","maxLength":100}},"additionalProperties":false},"type":{"type":"string","const":"http"},"method":{"enum":["POST"],"type":"string"},"bodyType":{"enum":["json","form-data","text"],"type":"string"}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","required":["profile","decision","score","requestId","observedAt","expiresAt","resource","payment","cors","checks","issues","discovery","operational","evidence","claimBoundary"],"properties":{"cors":{"type":"object","required":["allowOrigin","allowMethods","allowHeaders","exposeHeaders","allowCredentials","browserAgentCompatible"],"properties":{"allowOrigin":{"type":["string","null"]},"allowHeaders":{"type":"array","items":{"type":"string"}},"allowMethods":{"type":"array","items":{"type":"string"}},"exposeHeaders":{"type":"array","items":{"type":"string"}},"allowCredentials":{"type":["boolean","null"]},"browserAgentCompatible":{"type":["boolean","null"]}},"additionalProperties":false},"score":{"type":"integer","maximum":100,"minimum":0},"checks":{"type":"array","items":{"type":"object","required":["id","status","severity","evidence"],"properties":{"id":{"type":"string","maxLength":120},"status":{"enum":["PASS","WARN","FAIL","UNKNOWN"],"type":"string"},"evidence":{"type":"string","maxLength":2000},"severity":{"enum":["critical","high","medium","low","info"],"type":"string"}},"additionalProperties":false},"maxItems":100},"issues":{"type":"array","items":{"type":"object","required":["code","severity","retryable","message","remediation"],"properties":{"code":{"type":"string","pattern":"^[A-Z0-9_]+$"},"message":{"type":"string","maxLength":2000},"severity":{"enum":["critical","high","medium","low","info"],"type":"string"},"retryable":{"type":"boolean"},"remediation":{"type":"string","maxLength":2000}},"additionalProperties":false},"maxItems":100},"payment":{"type":"object","required":["detected","challengeSource","x402Version","scheme","network","asset","amountAtomic","priceUsd","payTo","facilitator","maxTimeoutSeconds","bazaar"],"properties":{"asset":{"type":["string","null"]},"payTo":{"type":["string","null"]},"bazaar":{"type":"object","required":["found","valid","type","method","toolName","description","inputSchemaPresent","outputSchemaPresent","examplePresent"],"properties":{"type":{"type":["string","null"]},"found":{"type":"boolean"},"valid":{"type":["boolean","null"]},"method":{"type":["string","null"]},"toolName":{"type":["string","null"]},"description":{"type":["string","null"]},"examplePresent":{"type":"boolean"},"inputSchemaPresent":{"type":"boolean"},"outputSchemaPresent":{"type":"boolean"}},"additionalProperties":false},"scheme":{"type":["string","null"]},"network":{"type":["string","null"]},"detected":{"type":"boolean"},"priceUsd":{"type":["number","null"]},"facilitator":{"type":["string","null"]},"x402Version":{"type":["integer","null"]},"amountAtomic":{"type":["string","null"]},"challengeSource":{"enum":["header","body",null],"type":["string","null"]},"maxTimeoutSeconds":{"type":["integer","null"]}},"additionalProperties":false},"profile":{"enum":["inspect","audit"],"type":"string"},"decision":{"enum":["ALLOW","CAUTION","BLOCK","UNKNOWN"],"type":"string"},"evidence":{"type":"array","items":{"type":"object","required":["id","source","observation"],"properties":{"id":{"type":"string","maxLength":120},"source":{"type":"string","maxLength":500},"observation":{"type":"string","maxLength":2000}},"additionalProperties":false},"maxItems":100},"resource":{"type":"object","required":["url","method","finalUrl","statusCode","latencyMs"],"properties":{"url":{"type":"string","pattern":"^https?://"},"method":{"enum":["GET","HEAD","POST"],"type":"string"},"finalUrl":{"type":"string","pattern":"^https?://"},"latencyMs":{"type":"integer","minimum":0},"statusCode":{"type":["integer","null"]}},"additionalProperties":false},"discovery":{"type":"object","required":["openapi","llmsTxt","agentMetadata","x402Metadata"],"properties":{"llmsTxt":{"type":"object","required":["url","statusCode","contentType","present","valid","consistent"],"properties":{"url":{"type":"string"},"valid":{"type":["boolean","null"]},"present":{"type":"boolean"},"consistent":{"type":["boolean","null"]},"statusCode":{"type":["integer","null"]},"contentType":{"type":["string","null"]}},"additionalProperties":false},"openapi":{"type":"object","required":["url","statusCode","contentType","present","valid","consistent"],"properties":{"url":{"type":"string"},"valid":{"type":["boolean","null"]},"present":{"type":"boolean"},"consistent":{"type":["boolean","null"]},"statusCode":{"type":["integer","null"]},"contentType":{"type":["string","null"]}},"additionalProperties":false},"x402Metadata":{"type":"object","required":["url","statusCode","contentType","present","valid","consistent"],"properties":{"url":{"type":"string"},"valid":{"type":["boolean","null"]},"present":{"type":"boolean"},"consistent":{"type":["boolean","null"]},"statusCode":{"type":["integer","null"]},"contentType":{"type":["string","null"]}},"additionalProperties":false},"agentMetadata":{"type":"object","required":["url","statusCode","contentType","present","valid","consistent"],"properties":{"url":{"type":"string"},"valid":{"type":["boolean","null"]},"present":{"type":"boolean"},"consistent":{"type":["boolean","null"]},"statusCode":{"type":["integer","null"]},"contentType":{"type":["string","null"]}},"additionalProperties":false}},"additionalProperties":false},"expiresAt":{"type":"string","pattern":"^\\d{4}-\\d{2}-\\d{2}T"},"requestId":{"type":"string","pattern":"^req_[A-Za-z0-9_-]+$"},"observedAt":{"type":"string","pattern":"^\\d{4}-\\d{2}-\\d{2}T"},"operational":{"type":"object","required":["contentType","cacheControl","responseBytes","timeoutMs","redirectChain"],"properties":{"timeoutMs":{"type":"integer","minimum":1},"contentType":{"type":["string","null"]},"cacheControl":{"type":["string","null"]},"redirectChain":{"type":"array","items":{"type":"object","required":["from","to","statusCode"],"properties":{"to":{"type":"string","pattern":"^https?://"},"from":{"type":"string","pattern":"^https?://"},"statusCode":{"type":"integer","maximum":399,"minimum":300}},"additionalProperties":false},"maxItems":5},"responseBytes":{"type":"integer","minimum":0}},"additionalProperties":false},"claimBoundary":{"type":"object","required":["proves","doesNotProve"],"properties":{"proves":{"type":"array","items":{"type":"string"}},"doesNotProve":{"type":"array","items":{"type":"string"}}},"additionalProperties":false}},"additionalProperties":false}}}}},"responseSchema":{"type":"json","example":{"cors":{"allowOrigin":"*","allowHeaders":["CONTENT-TYPE","PAYMENT-SIGNATURE"],"allowMethods":["POST","OPTIONS"],"exposeHeaders":["PAYMENT-REQUIRED","PAYMENT-RESPONSE"],"allowCredentials":null,"browserAgentCompatible":true},"score":100,"checks":[{"id":"payment.network_matches_policy","status":"PASS","evidence":"Published network is eip155:8453.","severity":"info"}],"issues":[],"payment":{"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","payTo":"0x820a7bf90d944bb26bfD9b62Ab172Fc3A0829cB9","bazaar":{"type":"http","found":true,"valid":true,"method":"POST","toolName":null,"description":null,"examplePresent":true,"inputSchemaPresent":true,"outputSchemaPresent":true},"scheme":"exact","network":"eip155:8453","detected":true,"priceUsd":0.05,"facilitator":"https://facilitator.world.fun","x402Version":2,"amountAtomic":"50000","challengeSource":"header","maxTimeoutSeconds":300},"profile":"audit","decision":"ALLOW","evidence":[{"id":"resource.response","source":"https://example.com/api/resource","observation":"HTTP 402 in 210 ms; 0 response bytes."}],"resource":{"url":"https://example.com/api/resource","method":"GET","finalUrl":"https://example.com/api/resource","latencyMs":210,"statusCode":402},"discovery":{"llmsTxt":{"url":"https://example.com/llms.txt","valid":true,"present":true,"consistent":true,"statusCode":200,"contentType":"text/plain"},"openapi":{"url":"https://example.com/openapi.json","valid":true,"present":true,"consistent":true,"statusCode":200,"contentType":"application/json"},"x402Metadata":{"url":"https://example.com/.well-known/x402.json","valid":true,"present":true,"consistent":true,"statusCode":200,"contentType":"application/json"},"agentMetadata":{"url":"https://example.com/.well-known/agent.json","valid":true,"present":true,"consistent":true,"statusCode":200,"contentType":"application/json"}},"expiresAt":"2026-08-06T00:15:00.000Z","requestId":"req_example1234","observedAt":"2026-08-06T00:00:00.000Z","operational":{"timeoutMs":8000,"contentType":"application/json","cacheControl":"private, no-store","redirectChain":[],"responseBytes":0},"claimBoundary":{"proves":["The listed signals were observed without sending payment credentials."],"doesNotProve":["That a future payment will settle or deliver the advertised result."]}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.05","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"registry","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.05/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_TAgbOIJ-7wUgOsvTplrIg","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.05","costPer":"request","priority":0,"asset":null,"unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Inspects and validates an x402 payment-gated endpoint before an autonomous agent commits USDC, returning a trust score, payment details, CORS compliance, and per-check results.","exampleAgentPrompt":"Before my agent pays, audit the x402 endpoint at https://example.com/api/resource using a GET request and flag anything suspicious — especially if the price or network looks wrong.","exampleUseCases":[{"title":"Pre-payment safety check for autonomous agent","prompt":"Before my agent calls https://api.example.com/data using GET, run a preflight audit on that x402 endpoint and tell me the trust score and whether it's safe to proceed."},{"title":"Verify network and asset before USDC spend","prompt":"Check the x402 endpoint at https://payments.example.com/report — I want to confirm it's on eip155:8453 and the price is under $1 before my agent sends any USDC."},{"title":"CORS compliance audit for browser-based agent","prompt":"Audit https://tools.example.com/generate as a POST x402 endpoint and tell me if it's browser-agent compatible — I need to know if the CORS headers will block my frontend agent."}],"resultDescription":"Returns a structured audit report including: an integer trust score (0–100), a decision (ALLOW or WARN/DENY), detailed per-check results with PASS/WARN/FAIL/UNKNOWN status and evidence, payment metadata (asset address, payTo, price in USD, network, facilitator, x402 version), CORS header analysis with browser-agent compatibility flag, discovery metadata (llms.txt, openapi.json, x402.json, agent.json presence and validity), observed and expiry timestamps, and a list of issues flagged during inspection.","failureModes":["Resource URL is not a valid HTTPS URL — returns validation error","Target endpoint is not an x402 resource (no 402 response) — returns FAIL checks","Network timeout reaching the target endpoint — returns UNKNOWN status checks","max_price_usd mismatch causes score penalty or WARN decision","expected_network mismatch between policy and observed network — FAIL check","Malformed or missing payment headers on target — FAIL on payment checks","CORS headers absent or misconfigured — browserAgentCompatible=false"],"whenToPreferThis":"Use this endpoint whenever an autonomous agent is about to call an unknown or untrusted x402-gated resource and needs to verify legitimacy, confirm price and network, check CORS compatibility, and get a trust score before committing funds. Prefer this over calling the x402 endpoint directly when you want a read-only, no-payment inspection pass.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-10T18:32:44.311Z","isFirstParty":false,"canonicalSlug":"x402-preflight-audit-8481fd04"}