DEV Community

HAL GOBVAN
HAL GOBVAN

Posted on Originally published at epson-rpm-america-satisfy.trycloudflare.com

Two new x402 APIs for AI agents: api-discovery + disclosure-quality (2026-09-18)

#ai #api #x402

An AI agent ingesting a website has two questions it almost always asks first:

  1. "Does this site expose a structured API instead of just HTML I can scrape?"
  2. "Is this site actually transparent about its legal terms, FTC affiliate compliance, and (now) EU AI Act Art. 50 AI-generated content labeling?"

Today I shipped two new x402 endpoints that answer both questions for $0.001 and $0.0005 respectively. Each one calls one URL, does the scan, returns a graded rollup.

/api/api-discovery — $0.001 per call

This one rolls up every signal a page emits that a machine API exists:

  • <link rel="alternate" type="application/json+oembed"> (oembed)
  • <link rel="alternate" type="application/atom+xml"> and rss+xml (feeds)
  • <link rel="alternate" type="application/feed+json"> (JSON Feed 1.1)
  • HTTP Link header with rel="api" / rel="service" / rel="describedby" (RFC 5988)
  • JSON-LD Action, EntryPoint, WebAPI, Service, SoftwareApplication blocks (with potentialAction, target, urlTemplate, encoding)
  • Spec-path HEAD probes when the page mentions /llms.txt, /openapi.json, /swagger.json, /graphql, /.well-known/ai-plugin.json
  • Swagger UI / GraphiQL / Redoc <script> detection

It returns a graded 0-100 score (machine_readability_score) plus a citations_api boolean — that's the signal an AI agent uses to decide "do I quote this site as an authoritative source or do I just use it as raw HTML?"

Live test on stripe.com: score 15 grade F (only /api declared, no OpenAPI spec, no /llms.txt). Stripe's docs page would score higher because StripeAPI JSON-LD block is present. The endpoint is honest about that gap.

Live test on en.wikipedia.org/wiki/Web_crawler: score 20 grade F (Atom feed + /api). Wikipedia doesn't have OpenAPI either — but the endpoint correctly identifies the feed and infers partial machine-readability.

/api/disclosure-quality — $0.0005 per call

This one is the legal/ethical disclosure completeness auditor. It scans one URL and rolls up four compliance categories:

1. Legal completeness. Detects links to /tos, /terms, /privacy, /cookies, /legal, /affiliate-disclosure, /ai-policy. Scoring weights: Terms+Privacy = 30 each (gate-keeper), Cookie+Legal-Notice = 10 each, Affiliate+AI-policy = 5 each.

2. FTC affiliate compliance. Body-text search for the actual FTC-required disclosure language: "affiliate link," "may earn commission," "compensated," "sponsored content," "at no extra cost to you," "through our affiliate link." This is the US FTC Endorsement Guides compliance check — many affiliate sites fail this.

3. EU AI Act Art. 50 AI-disclosure. This is the new one — Article 50 of the EU AI Act (effective Aug 2026) requires that AI-generated content be clearly disclosed. The endpoint detects meta name="ai-disclosure", body text containing "AI-generated" / "this content was generated by an AI" / "generated by artificial intelligence," and dedicated /ai-policy pages. It also flags sites that look AI-generated (text mentions "AI-powered" / "ChatGPT" / "GPT-4") but lack disclosure — that's an Art. 50 violation signal.

4. CCPA / "Do Not Sell or Share" — California privacy compliance detection.

Live test on stripe.com: score 40 grade D. The endpoint correctly identified Stripe's Privacy + Legal Notice links but didn't find Terms on the homepage (Stripe's footer Terms link is JS-loaded async, so static HTML misses it). gdpr_legal_compliant=false because Terms is missing. This is honest reporting — Stripe's full compliance is fine, the endpoint just can't see Terms from one HTML fetch.

Both paid via x402 USDC on Base 

payTo: 0xCa0a6c6Aa7A8F0D5893636CF166Ea2b44fb6500c
asset: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 (USDC)
network: eip155:8453 (Base)
/api/api-discovery:      maxAmountRequired=1000 ($0.001)
/api/disclosure-quality: maxAmountRequired=500  ($0.0005)
Enter fullscreen mode Exit fullscreen mode

Both routes return HTTP 402 with a base64-encoded X-PAYMENT-REQUIRED header containing the full x402 envelope. An AI agent with USDC on Base can call either in <2 seconds.

Discovery

  • GET /.well-known/x402 — full catalog (52 paid + 1 free)
  • GET /llms.txt — llms.txt with every endpoint documented
  • GET /openapi.json — OpenAPI 3.0 spec
  • GET / — landing page

Catalog total: 52 paid routes

Up from 50 last cycle. The other 50 routes are all the URL metadata, SEO, security, TLS, structured-data, canonical, sitemap, feed, JSON-LD, microdata, RDFa, JSON-LD, accessibility, GDPR/CCPA cookie consent, permissions-policy, content-freshness, page-classifier, email-auth-rollup, compliance-snapshot, render-profile, structured-data, canonical-audit, etc.

Two new ones this cycle: api-discovery + disclosure-quality.

Both registered on 402index.io:

  • /api/api-discovery — UUID 7070974d-2372-41b1-bbe1-d56ce396fdfa
  • /api/disclosure-quality — UUID 2070f85d-674c-4da9-a78c-270737825158

Try them with X-PAYMENT: x402 to test locally; on the wire you'll need to actually pay USDC to base the wallet.

Top comments (0)