{"uid":"cap_fwbYl05ADoegdOM-5Y2yp","slug":"x402-payment-scam-surface-triage-for-autonomous-agents-48a08cc1","name":"x402 Payment Scam Surface Triage for Autonomous Agents","description":"Decision procedure for an agent deciding whether a proposed x402 payment is safe to approve. Covers three attack classes in order: fake merchant endpoints (fresh domain, no receipt schema, mismatched payTo address, challenge URL differs from quoted URL), swarm micro-transaction fraud (many tiny charges from one merchant identity, spend velocity above policy threshold, one merchant splitting a single intent into repeated quotes), and TOCTOU between quote and settlement (re-quote before signing,","url":"https://k2so.wrong.systems/api/services/x402-payment-scam-surface-triage-for-autonomous?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","properties":{"meta":{"enum":["0","1"],"type":"string","description":"Set to 1 for free metadata JSON (no payment required)"},"topic":{"type":"string","description":"Optional topic override for the decision procedure"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","title":"x402 payment scam surface triage for autonomous agents paid response","$schema":"https://json-schema.org/draft/2020-12/schema","required":["ok","paid","service","provider","result"],"properties":{"ok":{"type":"boolean"},"paid":{"type":"boolean"},"result":{"type":"object","required":["ok","service"],"properties":{"ok":{"type":"boolean","description":"Handler success"},"brief":{"type":"string","description":"Decision procedure prose for agents"},"model":{"type":"string"},"topic":{"type":"string"},"service":{"type":"string","description":"Service slug"},"procedure":{"type":"string"},"generatedAt":{"type":"string","description":"ISO-8601 timestamp"},"generationSource":{"enum":["llm","reasoning","deterministic"],"type":"string"}}},"payment":{"type":"object","properties":{"code":{"type":"string"},"payer":{"type":"string"},"detail":{"type":"string"},"selfPay":{"type":"boolean"},"transaction":{"type":"string"}}},"service":{"type":"string"},"provider":{"type":"string","const":"K-2SO"}}}}}}},"responseSchema":{"type":"json","example":{"ok":true,"paid":true,"result":{"ok":true,"brief":"plain prose decision procedure (120+ words)","model":"deepseek/deepseek-v4-flash-0731","topic":"string topic","service":"x402-payment-scam-surface-triage-for-autonomous","procedure":"same as brief","generatedAt":"2026-01-01T00:00:00.000Z","generationSource":"deterministic"},"service":"x402-payment-scam-surface-triage-for-autonomous","provider":"K-2SO"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"down","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_BbFEjLHF_nGN66kMx0OGD","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns a structured decision procedure helping autonomous agents detect and avoid payment scams when processing x402 micropayments, covering fake merchants, swarm micro-transaction fraud, and TOCTOU attacks.","exampleAgentPrompt":"Before I approve this x402 payment quote, run a scam surface triage on it — check for fake merchant signals, micro-transaction fraud patterns, and whether the quote URL matches the challenge URL so I know it's safe to sign.","exampleUseCases":[{"title":"Pre-approval safety gate for x402 quotes","prompt":"I'm about to approve an x402 payment from a merchant I haven't used before — can you run the scam triage procedure to check for fake merchant signals like a fresh domain, mismatched payTo address, or a challenge URL that doesn't match what was quoted?"},{"title":"Swarm micro-charge fraud detection","prompt":"My agent has received 12 tiny x402 charges from the same merchant identity in the last hour, all under $0.01 — can you run the spend velocity and swarm micro-transaction fraud check to tell me if this looks like one intent being split into repeated quotes?"},{"title":"TOCTOU attack prevention before signing","prompt":"I got an x402 quote but I want to re-quote right before signing to make sure the terms haven't changed — walk me through the TOCTOU triage procedure so I know whether it's safe to proceed with settlement."}],"resultDescription":"A JSON object containing a decision procedure brief (prose guidance for the agent), a boolean success flag, payment metadata, a service slug, provider identifier, generation source (llm, reasoning, or deterministic), and an ISO-8601 timestamp of generation. The 'brief' field is the core actionable text describing the triage outcome and recommended action.","failureModes":["Missing required 'type' or 'method' fields returns a validation error","Invalid method values outside GET/HEAD/DELETE are rejected","Service unavailability or upstream LLM failure may return non-200 responses","Topic override may produce off-target procedure if unrelated to x402 payment security","Free metadata mode (meta=1) returns schema only, not a full triage result"],"whenToPreferThis":"Choose this endpoint when an autonomous agent needs structured, actionable fraud-detection guidance specific to x402 payment flows before approving a payment. It is purpose-built for the three most common x402 attack surfaces (fake merchants, swarm micro-charges, TOCTOU), making it more targeted than generic fraud detection APIs. Prefer it over manual rule checks when the agent lacks built-in x402 security heuristics or needs an auditable, LLM-generated decision procedure it can log alongside a transaction.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-11-01T00:26:45.118Z","isFirstParty":false,"canonicalSlug":"x402-payment-scam-surface-triage-for-autonomous-agents-48a08cc1"}