X402 Audit

Last 30 days

Uptime

100%

Response time

523 ms typical, 680 ms slowest 5%

Last check

2 h ago

Next check

any minute now

How to call it

# See the payment challenge (nothing is charged)
curl -i -X GET "https://quartermaster.surewhynot.app/v1/x402-audit?url=https%3A%2F%2Fapi.example.com%2Fpaid-endpoint"

import { wrapFetchWithPayment } from "@x402/fetch";
import { x402Client } from "@x402/core/client";
import { ExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

const client = new x402Client().register(
  "eip155:8453",
  new ExactEvmScheme(privateKeyToAccount(process.env.AGENT_KEY)),
);
const pay = wrapFetchWithPayment(fetch, client);

// Not sure it's safe to pay? Preflight it first for $0.005:
// GET https://toolvet.app/api/v1/check?url=https%3A%2F%2Fquartermaster.surewhynot.app%2Fv1%2Fx402-audit
const res = await pay("https://quartermaster.surewhynot.app/v1/x402-audit?url=https%3A%2F%2Fapi.example.com%2Fpaid-endpoint");
console.log(await res.json());

Example input

{
  "url": "https://api.example.com/paid-endpoint"
}

Example output

{
  "bazaar": {
    "has_metadata": false
  },
  "checks": [
    {
      "id": "returns_402",
      "label": "Endpoint returns HTTP 402 for unpaid requests",
      "status": "pass"
    }
  ],
  "discovery": {
    "discovery_resources": "missing",
    "llms_txt": "missing",
    "openapi_json": "present",
    "well_known_x402": "missing"
  },
  "payment": {
    "asset_name": "USDC (Base mainnet)",
    "is_x402": true,
    "network": "eip155:8453",
    "x402_version": 2
  },
  "recommended_fixes": [
    "Declare Bazaar discovery metadata on the route - without it, settlements will NOT list you in the Coinbase Bazaar."
  ],
  "score": 72,
  "status": "warn",
  "target_url": "https://api.example.com/paid-endpoint"
}

Security scan

• No findings. We scan names, descriptions and tool definitions for hidden instructions and other prompt-injection patterns.

Recent checks