ToolVet
75trust / 100

Openapi Parameter Contract Audit

by OpenAPI Request Audit in Onchain & crypto

x402 APIPassing, checked 4 h ago

Audit a real request against the OpenAPI document it should satisfy. Matches the operation the way a router would, checks every path, query and header parameter against its declared schema, validates the body against the declared media type, and reports whether the credential the declared security scheme expects is present. You supply the request, so this works against an API nothing external can reach.

POST
https://api.zfinia.com/x402/v1/openapi-parameter-contract-audit
Price
$0.14
per call in USDC
Uptime
100%
last 30 days
Response time
477 ms
979 ms slowest 5%
Last check
Passed
4 h ago, next any minute now

Run a free test callHow to call it

Reliability

All checks passedSome failedAll failedNot checked

Status and outage history · Atom feed · Watch with other listings

How to call it

POST https://api.zfinia.com/x402/v1/openapi-parameter-contract-audit

Each call costs $0.14 in USDC on Base, paid with the request over x402.

Run a free test callOne unpaid request, the way an agent sends it. You see the payment challenge it gets back. Nothing is charged.

Example request

From the listing.

POST https://api.zfinia.com/x402/v1/openapi-parameter-contract-audit
content-type: application/json

{
  "request": {
    "headers": {
      "X-Api-Key": "redacted"
    },
    "method": "GET",
    "path": "/orders",
    "query": {
      "page": "first"
    }
  },
  "specification": {
    "components": {
      "schemas": {
        "Order": {
          "properties": {
            "id": {
              "type": "string"
            },
            "status": {
              "enum": [
                "open",
                "shipped",
                "disputed"
              ],
              "type": "string"
            },
            "tenant_id": {
              "type": "string"
            },
            "total": {
              "type": "number"
            }
          },
          "required": [
            "id",
            "total",
            "tenant_id"
          ],
          "type": "object"
        }
      },
      "securitySchemes": {
        "apiKey": {
          "in": "query",
          "name": "api_key",
          "type": "apiKey"
        }
      }
    },
    "info": {
      "title": "Orders API",
      "version": "2.0.0"
    },
    "openapi": "3.1.0",
    "paths": {
      "/orders": {
        "get": {
          "operationId": "listOrdersV2",
          "parameters": [
            {
              "in": "query",
              "name": "tenant",
              "required": true,
              "schema": {
                "type": "string"
              }
            }
          ],
          "responses": {
            "200": {
              "content": {
                "application/json": {
                  "schema": {
                    "items": {
                      "$ref": "#/components/schemas/Order"
                    },
                    "type": "array"
                  }
                }
              },
              "description": "A page of orders"
            }
          },
          "summary": "List orders"
        },
        "parameters": [
          {
            "in": "query",
            "name": "page",
            "schema": {
              "minimum": 1,
              "type": "integer"
            }
          }
        ],
        "post": {
          "operationId": "createOrder",
          "requestBody": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Order"
                }
              }
            },
            "required": true
          },
          "responses": {
            "201": {
              "content": {
                "application/json": {
                  "schema": {
                    "$ref": "#/components/schemas/Order"
                  }
                }
              },
              "description": "Created"
            }
          },
          "summary": "Create an order"
        }
      },
      "/orders/{id}": {
        "get": {
          "deprecated": true,
          "operationId": "getOrder",
          "parameters": [
            {
              "in": "path",
              "name": "id",
              "schema": {
                "type": "string"
              }
            }
          ],
          "responses": {
            "200": {
              "content": {
                "application/json": {
                  "schema": {
                    "$ref": "#/components/schemas/Order"
                  }
                }
              },
              "description": "The order"
            },
            "404": {
              "description": "Not found"
            }
          },
          "summary": "Fetch one order"
        }
      }
    },
    "security": [
      {
        "apiKey": []
      }
    ]
  }
}

Parameters

ParameterTypeRequiredDescription
requestobjectYes
specificationobjectYes

Example response

The provider's example. We can't check it without paying.

Example response, 62 lines
{
  "assumptions": [
    "A literal path segment is preferred over a template, as a router would, so /pets/mine is audited against its own operation rather than /pets/{id}.",
    "Path, query and header values arrive as text, so a value declared as an integer is checked against its text form rather than rejected for being a string.",
    "Header names are compared case-insensitively."
  ],
  "checked": {
    "body": false,
    "header_parameters": 0,
    "path_parameters": 0,
    "query_parameters": 2
  },
  "complete": true,
  "conformant": false,
  "finding_count": 3,
  "findings": [
    {
      "code": "TYPE_MISMATCH",
      "detail": "GET /orders: query parameter page Expected integer, found string.",
      "location": "query",
      "operation": "GET /orders",
      "parameter": "page"
    },
    {
      "code": "REQUIRED_PARAMETER_MISSING",
      "detail": "GET /orders: required query parameter tenant is absent from the request.",
      "location": "query",
      "operation": "GET /orders",
      "parameter": "tenant"
    },
    {
      "code": "SECURITY_REQUIREMENT_UNMET",
      "detail": "GET /orders requires apiKey and the request carries no matching credential.",
      "operation": "GET /orders"
    }
  ],
  "findings_by_code": {
    "REQUIRED_PARAMETER_MISSING": 1,
    "SECURITY_REQUIREMENT_UNMET": 1,
    "TYPE_MISMATCH": 1
  },
  "limitations": [
    "Conformance of one request against the supplied specification. Whether the specification is correct is not assessed.",
    "conformant is true only when every declared constraint for the matched operation was evaluated and none failed."
  ],
  "limits": {
    "maxClientOperations": 200,
    "maxFindings": 500,
    "maxOperations": 500,
    "maxRequestBodyBytes": 262144
  },
  "matched_operation": "GET /orders",
  "matched_path_template": "/orders",
  "not_examined": [],
  "observed_at": "2026-10-02T00:00:00.000Z",
  "operation_deprecated": false,
  "operation_id": "listOrdersV2",
  "path_variables": {},
  "request_id": "example-request",
  "service_id": "openapi_parameter_contract_audit",
  "service_version": "1.0.0"
}

Call it from code

The curl command shows the payment challenge. The JavaScript and Python versions pay and call, and never pay more than $0.14.

curl: see the payment challenge
# bash or zsh: see the payment challenge. Nothing is charged.
curl -sS -g -i -X POST 'https://api.zfinia.com/x402/v1/openapi-parameter-contract-audit' \
  -H 'content-type: application/json' \
  --data-raw '{"request":{"headers":{"X-Api-Key":"redacted"},"method":"GET","path":"/orders","query":{"page":"first"}},"specification":{"components":{"schemas":{"Order":{"properties":{"id":{"type":"string"},"status":{"enum":["open","shipped","disputed"],"type":"string"},"tenant_id":{"type":"string"},"total":{"type":"number"}},"required":["id","total","tenant_id"],"type":"object"}},"securitySchemes":{"apiKey":{"in":"query","name":"api_key","type":"apiKey"}}},"info":{"title":"Orders API","version":"2.0.0"},"openapi":"3.1.0","paths":{"/orders":{"get":{"operationId":"listOrdersV2","parameters":[{"in":"query","name":"tenant","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/Order"},"type":"array"}}},"description":"A page of orders"}},"summary":"List orders"},"parameters":[{"in":"query","name":"page","schema":{"minimum":1,"type":"integer"}}],"post":{"operationId":"createOrder","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Order"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Order"}}},"description":"Created"}},"summary":"Create an order"}},"/orders/{id}":{"get":{"deprecated":true,"operationId":"getOrder","parameters":[{"in":"path","name":"id","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Order"}}},"description":"The order"},"404":{"description":"Not found"}},"summary":"Fetch one order"}}},"security":[{"apiKey":[]}]}}'

# x402 v2 sends the challenge base64-encoded in the PAYMENT-REQUIRED header (v1 sends it in the body).
# To read the header:
curl -sS -g -o /dev/null -D - -X POST 'https://api.zfinia.com/x402/v1/openapi-parameter-contract-audit' \
  -H 'content-type: application/json' \
  --data-raw '{"request":{"headers":{"X-Api-Key":"redacted"},"method":"GET","path":"/orders","query":{"page":"first"}},"specification":{"components":{"schemas":{"Order":{"properties":{"id":{"type":"string"},"status":{"enum":["open","shipped","disputed"],"type":"string"},"tenant_id":{"type":"string"},"total":{"type":"number"}},"required":["id","total","tenant_id"],"type":"object"}},"securitySchemes":{"apiKey":{"in":"query","name":"api_key","type":"apiKey"}}},"info":{"title":"Orders API","version":"2.0.0"},"openapi":"3.1.0","paths":{"/orders":{"get":{"operationId":"listOrdersV2","parameters":[{"in":"query","name":"tenant","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/Order"},"type":"array"}}},"description":"A page of orders"}},"summary":"List orders"},"parameters":[{"in":"query","name":"page","schema":{"minimum":1,"type":"integer"}}],"post":{"operationId":"createOrder","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Order"}}},"required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Order"}}},"description":"Created"}},"summary":"Create an order"}},"/orders/{id}":{"get":{"deprecated":true,"operationId":"getOrder","parameters":[{"in":"path","name":"id","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Order"}}},"description":"The order"},"404":{"description":"Not found"}},"summary":"Fetch one order"}}},"security":[{"apiKey":[]}]}}' \
  | grep -i '^payment-required:' | cut -d' ' -f2 | tr -d '\r' | base64 --decode
JavaScript: pay and call
// npm i @x402/fetch @x402/evm viem
import { wrapFetchWithPayment, x402Client } from "@x402/fetch";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

// Pays at most $0.14 per call.
const client = new x402Client().setSpendControls({ maxAmountPerPayment: "$0.14" });
registerExactEvmScheme(client, { signer: privateKeyToAccount(process.env.EVM_PRIVATE_KEY) });
const pay = wrapFetchWithPayment(fetch, client);

// Not sure it's safe to pay? ToolVet checks it first for $0.005. Pay for that from a separate
// client: this one is capped at $0.14 per payment. GET https://toolvet.app/api/v1/check?url=https%3A%2F%2Fapi.zfinia.com%2Fx402%2Fv1%2Fopenapi-parameter-contract-audit&method=POST
const res = await pay("https://api.zfinia.com/x402/v1/openapi-parameter-contract-audit", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({
    "request": {
      "headers": {
        "X-Api-Key": "redacted"
      },
      "method": "GET",
      "path": "/orders",
      "query": {
        "page": "first"
      }
    },
    "specification": {
      "components": {
        "schemas": {
          "Order": {
            "properties": {
              "id": {
                "type": "string"
              },
              "status": {
                "enum": [
                  "open",
                  "shipped",
                  "disputed"
                ],
                "type": "string"
              },
              "tenant_id": {
                "type": "string"
              },
              "total": {
                "type": "number"
              }
            },
            "required": [
              "id",
              "total",
              "tenant_id"
            ],
            "type": "object"
          }
        },
        "securitySchemes": {
          "apiKey": {
            "in": "query",
            "name": "api_key",
            "type": "apiKey"
          }
        }
      },
      "info": {
        "title": "Orders API",
        "version": "2.0.0"
      },
      "openapi": "3.1.0",
      "paths": {
        "/orders": {
          "get": {
            "operationId": "listOrdersV2",
            "parameters": [
              {
                "in": "query",
                "name": "tenant",
                "required": true,
                "schema": {
                  "type": "string"
                }
              }
            ],
            "responses": {
              "200": {
                "content": {
                  "application/json": {
                    "schema": {
                      "items": {
                        "$ref": "#/components/schemas/Order"
                      },
                      "type": "array"
                    }
                  }
                },
                "description": "A page of orders"
              }
            },
            "summary": "List orders"
          },
          "parameters": [
            {
              "in": "query",
              "name": "page",
              "schema": {
                "minimum": 1,
                "type": "integer"
              }
            }
          ],
          "post": {
            "operationId": "createOrder",
            "requestBody": {
              "content": {
                "application/json": {
                  "schema": {
                    "$ref": "#/components/schemas/Order"
                  }
                }
              },
              "required": true
            },
            "responses": {
              "201": {
                "content": {
                  "application/json": {
                    "schema": {
                      "$ref": "#/components/schemas/Order"
                    }
                  }
                },
                "description": "Created"
              }
            },
            "summary": "Create an order"
          }
        },
        "/orders/{id}": {
          "get": {
            "deprecated": true,
            "operationId": "getOrder",
            "parameters": [
              {
                "in": "path",
                "name": "id",
                "schema": {
                  "type": "string"
                }
              }
            ],
            "responses": {
              "200": {
                "content": {
                  "application/json": {
                    "schema": {
                      "$ref": "#/components/schemas/Order"
                    }
                  }
                },
                "description": "The order"
              },
              "404": {
                "description": "Not found"
              }
            },
            "summary": "Fetch one order"
          }
        }
      },
      "security": [
        {
          "apiKey": []
        }
      ]
    }
  }),
});
console.log(res.status, await res.text());
Python: pay and call
# pip install "x402[requests,evm]"
import os
from eth_account import Account
from x402 import x402ClientSync
from x402.http.clients import x402_requests
from x402.mechanisms.evm import EthAccountSigner
from x402.mechanisms.evm.exact.register import register_exact_evm_client

# Pays at most $0.14 per call.
client = x402ClientSync().set_spend_controls({"max_amount_per_payment": "$0.14"})
register_exact_evm_client(client, EthAccountSigner(Account.from_key(os.environ["EVM_PRIVATE_KEY"])))

with x402_requests(client) as session:
    res = session.post(
        "https://api.zfinia.com/x402/v1/openapi-parameter-contract-audit",
        json={
            "request": {
                "headers": {
                    "X-Api-Key": "redacted",
                },
                "method": "GET",
                "path": "/orders",
                "query": {
                    "page": "first",
                },
            },
            "specification": {
                "components": {
                    "schemas": {
                        "Order": {
                            "properties": {
                                "id": {
                                    "type": "string",
                                },
                                "status": {
                                    "enum": [
                                        "open",
                                        "shipped",
                                        "disputed",
                                    ],
                                    "type": "string",
                                },
                                "tenant_id": {
                                    "type": "string",
                                },
                                "total": {
                                    "type": "number",
                                },
                            },
                            "required": [
                                "id",
                                "total",
                                "tenant_id",
                            ],
                            "type": "object",
                        },
                    },
                    "securitySchemes": {
                        "apiKey": {
                            "in": "query",
                            "name": "api_key",
                            "type": "apiKey",
                        },
                    },
                },
                "info": {
                    "title": "Orders API",
                    "version": "2.0.0",
                },
                "openapi": "3.1.0",
                "paths": {
                    "/orders": {
                        "get": {
                            "operationId": "listOrdersV2",
                            "parameters": [
                                {
                                    "in": "query",
                                    "name": "tenant",
                                    "required": True,
                                    "schema": {
                                        "type": "string",
                                    },
                                },
                            ],
                            "responses": {
                                "200": {
                                    "content": {
                                        "application/json": {
                                            "schema": {
                                                "items": {
                                                    "$ref": "#/components/schemas/Order",
                                                },
                                                "type": "array",
                                            },
                                        },
                                    },
                                    "description": "A page of orders",
                                },
                            },
                            "summary": "List orders",
                        },
                        "parameters": [
                            {
                                "in": "query",
                                "name": "page",
                                "schema": {
                                    "minimum": 1,
                                    "type": "integer",
                                },
                            },
                        ],
                        "post": {
                            "operationId": "createOrder",
                            "requestBody": {
                                "content": {
                                    "application/json": {
                                        "schema": {
                                            "$ref": "#/components/schemas/Order",
                                        },
                                    },
                                },
                                "required": True,
                            },
                            "responses": {
                                "201": {
                                    "content": {
                                        "application/json": {
                                            "schema": {
                                                "$ref": "#/components/schemas/Order",
                                            },
                                        },
                                    },
                                    "description": "Created",
                                },
                            },
                            "summary": "Create an order",
                        },
                    },
                    "/orders/{id}": {
                        "get": {
                            "deprecated": True,
                            "operationId": "getOrder",
                            "parameters": [
                                {
                                    "in": "path",
                                    "name": "id",
                                    "schema": {
                                        "type": "string",
                                    },
                                },
                            ],
                            "responses": {
                                "200": {
                                    "content": {
                                        "application/json": {
                                            "schema": {
                                                "$ref": "#/components/schemas/Order",
                                            },
                                        },
                                    },
                                    "description": "The order",
                                },
                                "404": {
                                    "description": "Not found",
                                },
                            },
                            "summary": "Fetch one order",
                        },
                    },
                },
                "security": [
                    {
                        "apiKey": [],
                    },
                ],
            },
        },
    )
    print(res.status_code, res.text)

Security scan

No findings

We scan names, descriptions and tool definitions for hidden instructions and other prompt-injection patterns.

Recent checks

WhenResultHTTPTimePrice
4 h agoPassed402453 ms$0.14
9 h agoPassed402560 ms$0.14
14 h agoPassed402456 ms$0.14
19 h agoPassed402477 ms$0.14
24 h agoPassed402738 ms$0.14
Show 10 older checks
29 h agoPassed402463 ms$0.14
34 h agoPassed402500 ms$0.14
38 h agoPassed402690 ms$0.14
43 h agoPassed402426 ms$0.14
47 h agoPassed402527 ms$0.14
2 days agoPassed402806 ms$0.14
2 days agoPassed402397 ms$0.14
3 days agoPassed402447 ms$0.14
3 days agoPassed402597 ms$0.14
3 days agoPassed402360 ms$0.14