Endpoint audit
The free check validates the shape of your 402 quote. The audit goes further and looks for the mistakes that only show up when a buyer tries to pay. It costs $0.02 per call and is sold the way your endpoint is: over x402, with no account.
What it adds
| Check | What it catches |
|---|---|
| Token contract, read on-chain | An asset address that is not a token on the quoted network, and extra.name or extra.version values that differ from the contract. These make every payment fail with invalid_exact_evm_signature or a token name mismatch. |
| Recipient | A payTo set to the zero address. |
| Facilitator support | A scheme and network that the public facilitators checked (x402.org and PayAI) do not list. |
| Quote stability | A price, recipient, token or network that changes between two requests. |
| Response time | A 402 slow enough that agents give up before seeing the price. |
On-chain checks cover Base and Base Sepolia. The audit never pays your endpoint and never holds a wallet.
Call it
curl -i 'https://x402testendpoint.com/api/audit?url=https://api.example.com/paid-route'The first response is a 402 whose quote states the price and network. Pay it with any x402 client and the retry returns the report as JSON, in the same shape as the free check plus an audit section.
const first = await fetch("https://x402testendpoint.com/api/audit?url=" + encodeURIComponent(target));
const quote = http.getPaymentRequiredResponse((h) => first.headers.get(h));
const headers = http.encodePaymentSignatureHeader(await core.createPaymentPayload(quote));
const report = await (await fetch(first.url, { headers })).json();Payment terms
- $0.02 in USDC on Base. While the paid tier is being switched on, the endpoint quotes test USDC on Base Sepolia (testnet) instead, so you can try the full flow for nothing. The quote always says which.
- You are charged only after the audit has run. If it fails, the payment is not settled.
- A URL the audit cannot accept is refused with HTTP 400 before any payment is requested.