{"uid":"cap_dn7yhJgfBTtOybxlapUUP","slug":"halowerk-x402werk-replay-guard-duplicate-payment-detector-16eedb2b","name":"HALOWERK x402werk — Replay Guard (Duplicate Payment Detector)","description":"A stateful duplicate check for agents that settle x402 payments. Supply any of payment_id, payload_hash and nonce; each is hashed with SHA-256 before storage, so the service keeps fingerprints and timestamps and never the values themselves, never a payload, never an address. The answer states for every supplied identifier whether it was seen before, when it was first and last seen, how often, and whether the first sighting falls inside window_seconds. The recommendation is ablehnen only for a re","url":"https://x402.halowerk.com/guard/replay","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"nonce":{"type":"string","maxLength":512,"minLength":1,"description":"Nonce of the signed payment authorisation. Stored only as a SHA-256 fingerprint."},"record":{"type":"boolean","default":true,"description":"Whether this call is remembered. Set to false to check without writing, so repeated checks of the same payment do not report themselves as duplicates."},"payment_id":{"type":"string","maxLength":512,"minLength":1,"description":"Payment identifier of the x402 payment-identifier extension, or any identifier your client treats as unique per payment. Stored only as a SHA-256 fingerprint."},"payload_hash":{"type":"string","maxLength":512,"minLength":1,"description":"Hash of the request payload that was paid for. Stored only as a SHA-256 fingerprint of the value you send."},"window_seconds":{"type":"integer","default":3600,"maximum":86400,"minimum":1,"description":"How far back a sighting still counts as a duplicate for the recommendation. Fingerprints are kept for 24 hours regardless."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_oLzANFb5Y6jLdMiGUtT-D","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks whether an x402 payment nonce, payment ID, or payload hash has been seen before, returning a duplicate-detection recommendation to accept, reject, or review the payment.","exampleAgentPrompt":"Check whether the x402 payment nonce 'abc123xyz' and payment ID 'pay_9f8e7d' have been seen before within the last 300 seconds, and record this check — what's the recommendation: accept, reject, or review?","exampleUseCases":[{"title":"Replay attack guard for paid API","prompt":"Before I process this x402 payment, check if nonce 'n_deadbeef42' and payload hash 'sha256_aabbcc' have been seen in the last 600 seconds and record the sighting — should I accept or reject it?"},{"title":"Dry-run duplicate check without recording","prompt":"I want to check whether payment ID 'pay_00112233' with nonce 'n_ffeeddcc' is a duplicate within a 120-second window, but don't record this check — I'm just auditing without changing state."},{"title":"Fraud audit on suspicious payment","prompt":"How many times has the payload hash 'sha256_99887766' been seen, and when was it first recorded? Use a 3600-second window and do record this lookup so I have a full audit trail."}],"resultDescription":"Returns a JSON object with: a boolean is_duplicate flag, a boolean nonce_reused flag, a recommendation enum ('annehmen' = accept, 'ablehnen' = reject, 'pruefen' = review), the number of times the fingerprint has been seen (seen_count), the timestamp of first sighting (first_seen), age in milliseconds (age_ms), whether the sighting falls within the requested window (within_window), a duplicate_of object if a duplicate was found, evidence details, and a list of any unavailable_fields.","failureModes":["Missing required fingerprint fields (nonce, payment_id, or payload_hash) result in incomplete checks with those fields listed in unavailable_fields","Payment for the endpoint itself fails (x402 payment not included or rejected) — returns HTTP 402","window_seconds set too broadly may yield false positives for legitimate recurring payments","record=false prevents deduplication state from being updated, which may allow replays if all checks are dry-runs","Fingerprints are retained only 24 hours; checks on older payments will not find prior sightings"],"whenToPreferThis":"Use this endpoint when you are operating an x402-gated API and need to detect replay attacks or double-spend attempts in real time. It is specifically designed for the x402 payment protocol on Base Mainnet with USDC, making it the right choice when your payments carry x402 nonces or payment IDs. Prefer it over generic idempotency checks when you need a structured accept/reject/review recommendation with evidence and when you want fingerprint storage without exposing raw payment data.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T00:33:39.876Z","isFirstParty":false}