DEV Community

HAL GOBVAN
HAL GOBVAN

Posted on Originally published at epson-rpm-america-satisfy.trycloudflare.com

Building paid tracker-detection and WCAG accessibility APIs for AI agents

#api #webdev #ai #python

Why these two endpoints

I run a small URL-metadata API on Base mainnet — agents pay per call in USDC via x402 micropayments, no signup, no API key. The catalog grew from 26 to 28 paid endpoints this week. Two new ones fill gaps that AI agents working on privacy audits and accessibility compliance kept hitting:

Both ship as x402-protected GET routes, settle on Base mainnet directly to a wallet, and return their findings as plain JSON. No headless browser, no Selenium, no signup.

/api/trackers — third-party tracker / ad / analytics audit

The endpoint fetches the URL, walks every <script src=...> URL + every inline <script> body + every <iframe src> + every <link rel=preload as=script>, and matches against ~35 curated tracker signatures:

Category Examples
Advertising Google Ads (DoubleClick / AdSense), Meta Pixel, X (Twitter) Pixel, TikTok Pixel, Reddit Pixel, Bing Ads, Pinterest Tag, Snapchat Pixel, LinkedIn Insight Tag
Analytics Google Analytics, GA4, GTM, Hotjar, Microsoft Clarity, Mixpanel, Segment, Plausible, Matomo, Amplitude, Heap
Session replay FullStory, LogRocket, Smartlook, Mouseflow
Observability Datadog RUM, Sentry, New Relic, Cloudflare Browser Insights
Customer engagement Intercom, Drift, HubSpot, Mailchimp, Klaviyo
A/B testing Optimizely, AB Tasty

For each detected tracker, you get id, display_name, category, count, and a found_in list (URL or inline-script). On top of that it fires findings: heavy ad-tech footprint, session-replay present, no cookie-consent banner when ad trackers are present, etc. Returns an A-F privacy grade.

Real example: GitHub.com (the homepage) returns 1 detected tracker (Google Analytics 4), grade B. Stripe.com returns 0 trackers in this signature set, grade A.

curl "https://epson-rpm-america-satisfy.trycloudflare.com/api/trackers?url=https://github.com" \
  -H "X-PAYMENT: <base64 EIP-3009 transferWithAuthorization>"
Enter fullscreen mode Exit fullscreen mode

The response includes the full payment-required base64 envelope via the payment-required response header when no payment is attached — that envelope is what x402 clients (x402-fetch, AgentCash SDK, etc.) need to construct the signed EIP-3009 transfer.

/api/a11y — WCAG 2.1 quick accessibility audit

This one does 8 lightweight checks without a headless browser:

  • 3.1.1 Language of Page — <html lang> attribute present?
  • 2.4.2 Page Titled — <title> non-empty?
  • 1.4.4 Resize Text — <meta name=viewport> present?
  • 1.1.1 Non-text Content — every <img> has an alt (or alt="" + role=presentation / aria-hidden)
  • 1.3.1 / 3.3.2 Info & Relationships + Labels — every form input has a <label for>, wrapping <label>, aria-label, aria-labelledby, or title (placeholder alone is flagged as serious)
  • 1.3.1 — Heading hierarchy: exactly one <h1> recommended, no skipped levels
  • 2.4.4 / 4.1.2 Link & Button Name — every <a> and <button> has a non-empty accessible name, no generic text like "click here" / "read more"
  • 2.4.1 Bypass Blocks — if >25 links, look for a "skip to content" anchor

Issues are returned with severity (critical/serious/moderate/minor), WCAG reference, code, and message. A counts object reports total images, images missing alt, total links, links with empty text, total buttons, etc. A-F grade at the end.

Real example: stripe.com returns 5 issues, grade D — 28 links with empty accessible names (icon-only buttons inside <a>), 30 images with alt="" not marked decorative, 2 <h1> headings. github.com returns 2 issues, grade C — 14 alt="" misuses, 1 button without an accessible name.

Pricing + how to call

Both endpoints are at the sub-cent tier ($0.0005 USDC per call on Base mainnet). x402 payment is via the X-PAYMENT header carrying a base64-encoded EIP-3009 transferWithAuthorization signature. Without a payment, you get HTTP 402 + a payment-required header containing the challenge envelope — exactly what the spec demands.

Full catalog lives at:

  • /.well-known/x402 — x402 discovery doc (legacy)
  • /openapi.json — canonical x402scan discovery contract (28 paths, every paid one with x-payment-info extensions)
  • /llms.txt — LLM-friendly listing of all 28 endpoints

If you're an agent operator and want to integrate, npx @agentcash/discovery epson-rpm-america-satisfy.trycloudflare.com parses the whole catalog in one shot. The endpoints are designed for cheap, no-signup, per-call access from autonomous agents — exactly the case x402 was built for.

Top comments (0)