{"uid":"cap_UJ6r9mDvg3BErbhiT1U-W","slug":"x402-endpoint-attack-surface-check-1a3d8d04","name":"x402 Endpoint Attack Surface Check","description":"Check authorization binding, replay-window, paid-but-denied, catalog drift, and price-drain classes for a candidate x402 endpoint. Returns JSON. Price 0.25 USDC on Base via x402. Demo/preview: https://x402-endpoint-risk-corpus.mtree.workers.dev/demo/attack_surface_check. Contact: https://x402-endpoint-risk-corpus.mtree.workers.dev/contact.","url":"https://x402-endpoint-risk-corpus.mtree.workers.dev/v1/x402/attack_surface_check","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"type":"object","required":["url"],"properties":{"url":{"type":"string","format":"uri"},"method":{"enum":["GET","POST","PUT","PATCH","DELETE"],"type":"string"},"require_body_digest":{"type":"boolean"},"require_idempotency_key":{"type":"boolean"},"post_settlement_deterministic":{"type":"boolean"}}},"type":{"type":"string","const":"http"},"method":{"enum":["POST"],"type":"string"},"bodyType":{"enum":["json","form-data","text"],"type":"string"}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":{"request":{"input":{"body":{"url":"https://api.example.com/v1/payment-endpoint","method":"POST","require_body_digest":true,"require_idempotency_key":true,"post_settlement_deterministic":false},"type":"http","method":"POST","bodyType":"json"}},"response":{"ok":true,"url":"https://api.example.com/v1/payment-endpoint","domain":"api.example.com","method":"POST","dataset":{"bands":[{"n":868,"risk_band":"minimal"},{"n":44,"risk_band":"low"},{"n":5,"risk_band":"high"}],"total":917,"calls_30d":137356,"last_ingest":{"id":823,"ok":1,"ts":1781756270,"error":"","iso_ts":"2026-06-18T04:17:50.000Z","source":"coinbase-discovery","scanned":250,"upserted":250,"attempted":250},"dataset_fresh_at":"2026-06-18T04:18:28.000Z","revenue_30d_micro":3824397238},"provenance":{"source":"hosted D1 endpoint rows + x402 attack-class checklist","dataset":"x402-endpoint-risk-corpus","generated_at":"2026-06-18T05:05:41.000Z"},"dataset_fresh_at":"2026-06-05T23:55:20.000Z","attack_surface_band":"high","x402_attack_classes":[{"id":"authorization_binding","status":"pass","finding":"Caller reports body-digest binding.","mitigation":"Bind signature to method, canonical URL, body digest, asset, amount, network, and payTo."},{"id":"replay_window","status":"pass","finding":"Caller reports nonce/idempotency guard.","mitigation":"Use short validity windows, reject reused authorization nonces, and expose idempotency-key handling."},{"id":"paid_but_denied","status":"warn","finding":"Post-settlement handler may still deny paid callers.","mitigation":"After facilitator verification, return deterministic 2xx/4xx business output and log handler failures separately from payment failures."},{"id":"catalog_consistency","status":"warn","finding":"No discovery surface evidence in hosted corpus; agents cannot verify route/price drift cleanly.","mitigation":"Publish agent-card, OpenAPI, MCP, and .well-known/x402 with matching route/method/price metadata."},{"id":"price_anomaly","status":"pass","finding":"Price is inside normal micropayment range or absent.","mitigation":"Set per-call and daily caps before autopay; require human review for high-price endpoints."}],"attack_surface_score":100,"hosted_corpus_evidence":{"pay_to":"","fetched":{"x402":false,"origin":"https://api.example.com","openapi":false,"statuses":{"x402":{"ok":false,"status":530,"contentType":"text/plain; charset=UTF-8"},"openapi":{"ok":false,"status":530,"contentType":"text/plain; charset=UTF-8"},"agentCard":{"ok":false,"status":530,"contentType":"text/plain; charset=UTF-8"}},"agentCard":false},"calls_30d":0,"payers_30d":0,"price_micro":0,"catalog_risks":["missing_pay_to_in_catalog","missing_network_metadata","zero_or_missing_price","missing_agent_card","missing_openapi","missing_x402_discovery_alias","class_check_required_authorization_binding","class_check_replay_window","class_check_paid_but_denied"],"base_risk_band":"high","base_risk_score":80}}},"exampleRequest":{"url":"https://api.example.com/v1/payment-endpoint","method":"POST","require_body_digest":true,"require_idempotency_key":true,"post_settlement_deterministic":false},"tags":["x402"],"displayCostAmount":"0.25","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.25/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.25","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.25","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_SpKMYMuk7vcQdbmzUbqxp","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.25","costPer":"request","priority":0,"asset":null,"unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks a candidate x402 endpoint for authorization binding, replay-window, paid-but-denied, catalog drift, and price-drain risk classes, returning a structured JSON risk assessment.","exampleAgentPrompt":"Before my agent starts calling this x402 endpoint at https://api.example.com/v1/some-resource, can you run an attack surface check on it to flag any authorization binding, replay-window, paid-but-denied, catalog drift, or price-drain risks?","exampleUseCases":null,"resultDescription":"A JSON object containing risk classifications across five attack surface categories: authorization binding, replay-window, paid-but-denied, catalog drift, and price-drain. Each class includes a risk level and supporting evidence drawn from the x402 Bazaar-derived corpus.","failureModes":["Invalid or unreachable endpoint URL returns a 4xx error with a descriptive message","Endpoint not found in the corpus returns low-confidence or empty risk scores","Payment of 0.25 USDC not processed correctly results in 402 response blocking the check","Malformed request body returns a validation error","Corpus data stale for a given endpoint may result in outdated risk signals"],"whenToPreferThis":"Use this endpoint when an AI agent or developer needs to pre-screen a specific x402 endpoint for known payment-layer attack classes — particularly authorization binding failures, replay vulnerabilities, or price-drain patterns — before committing autonomous payments to it. Prefer this over general API security scanners when the target is specifically an x402 micropayment endpoint and corpus-backed evidence is needed.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T06:41:18.451Z","isFirstParty":false}