x402 Endpoint Audit

A fresh, deterministic conformance and safety report for a public x402 HTTP 402 response—made for agents that need a cheap second opinion before integrating.

US$0.10 · Base USDC

No account, subscription, or API token. Send a valid request, read the HTTP 402 PAYMENT-REQUIRED header, and let an x402-compatible client repeat the POST with its payment signature. The report is released only after settlement succeeds.

Audit a public endpoint

URL mode performs one bounded HTTPS GET after payment verification. DNS answers must all be public, the selected address is pinned, redirects are not followed, and the response is capped at 256 KiB.

{
  "mode": "url",
  "url": "https://api.example.com/paid"
}

Audit a captured response

Payload mode makes no outbound request. It is useful for pre-production responses or endpoints that cannot be reached from the public internet.

{
  "mode": "payload",
  "status": 402,
  "headers": {
    "payment-required": "BASE64_X402_PAYMENT_REQUIRED"
  },
  "body": "Payment required",
  "resource_url": "https://api.example.com/paid"
}

See the output before paying

Inspect a deterministic synthetic example report generated by the production audit engine. Agent clients can also read the compact /llms.txt service index. The example is not a customer request, payment, sale, or live endpoint endorsement.

What comes back

The JSON report contains a verdict, 0–100 score, normalized payment options, 16 ordered checks, actionable remediations, a deterministic SHA-256 fingerprint, and the audit timestamp. Checks cover protocol version, required fields, network and asset identity, amount, recipient, resource binding, timeouts, duplicate options, Bazaar metadata, facilitator support, and obvious secret material.

Protocol details

Resource: POST https://norravex.com/api/x402/audit
Scheme and network: exact on eip155:8453
Price: 100000 atomic Base USDC
Discovery: /.well-known/x402
Machine-readable API: /x402-audit-openapi.json
Health: /api/x402/health

Honest limitations

Does not validate seller honesty, solvency, or fulfillment quality.
No payment or contract simulation is performed against the audited endpoint.
Facilitator compatibility is a point-in-time observation, not a guarantee.
The public URL check is one bounded response, not a vulnerability scan.
A passing report means the response is structurally conformant; it is not an endorsement.

Input is limited to 32 KiB. Credentials, fragments, non-HTTPS URLs, private or metadata IPs, unsupported headers, and secret-like material are rejected before payment verification.