Engineering note ·

Your API returns 402. Can an agent use it?

A payment challenge tells a client what to pay. A usable integration also needs a request the agent can construct, an output it can interpret, and evidence that settlement actually completes.

This is a case from our own API, not a customer testimonial. It documents a discovery-metadata repair, not a security audit, successful sale or completed paid integration.

The mismatch we repaired

Our Bazaar declaration included an output example inside info.output.example. The schema initially described the report directly at schema.properties.output, missing the enclosing type and example structure.

We changed that schema to describe the wrapper and placed the report properties under schema.properties.output.properties.example. Local checks covered our quick, deep and purchase declarations. Our recorded post-deployment checks found no AgentCash payment-metadata warnings for quick resolve, and the CDP validator returned valid: true with an accepted simulation for deep resolve.

Those are dated observations, not a current uptime guarantee. They do not establish that a client paid, received its report or generated revenue.

Illustrative output fragment below; input declarations and the surrounding payment requirement are intentionally omitted.

{
  "info": {
    "output": {
      "type": "json",
      "example": {
        "targetType": "domain",
        "verdict": "partial"
      }
    }
  },
  "schema": {
    "properties": {
      "output": {
        "type": "object",
        "properties": {
          "type": {
            "type": "string",
            "const": "json"
          },
          "example": {
            "type": "object",
            "properties": {
              "targetType": {
                "type": "string"
              },
              "verdict": {
                "type": "string"
              }
            }
          }
        },
        "required": [
          "type",
          "example"
        ]
      }
    }
  }
}

Inspect our challenge without a wallet

The small Node.js script below makes one unsigned request to our quick-resolve endpoint. It prints the advertised route, payment terms and output-wrapper shape. It sends no payment signature, API key or wallet secret and does not submit an enquiry.

Download the inspection script
node inspect-payment-challenge.mjs

Already have an unsigned x402 v2 challenge? Inspect it in your browser and download a summary. The browser tool does not contact your endpoint or upload the pasted data.

Requires Node.js 22+ and internet access. These are structural spot checks, not full JSON Schema validation. A timeout or non-402 response is a finding to investigate. Do not infer paid-call success from this script.

Keep four kinds of evidence separate

  1. Discovery: check the URL, method, description, input schema and example. Validate declared examples against their schemas, including required fields and wrapper objects.
  2. Payment terms: inspect network, asset, amount and recipient before any separately authorized paid test. A dollar label alone is insufficient.
  3. Settlement and delivery: reconcile the facilitator result, transaction and delivered response. CDP's seller setup requires server credentials for verify and settle. CDP seller quickstart.
  4. Customer revenue: link an external customer's payment to the delivered order; exclude self-transfers and test funding. A directory entry, simulation or token balance is not that evidence.

CDP's discovery guide describes validation before launch and a successful settled payment as part of getting indexed. Indexing does not guarantee buyers. Read the current Bazaar discovery guide.