Two more paid x402 APIs are live in the URL/Tools catalog for AI agents. Both cost $0.0005 per call and settle USDC on Base mainnet via pay.openfacilitator.io.
/api/client-hints-policy
The Client Hints + Permissions-Policy probe captures what data a target site asks the agent's client to reveal.
Probes 3 things:
- Accept-CH header (RFC 7231 §5.3.7) — server-requested Client Hints.
- Critical-CH header (RFC 9981) — Client Hints the server REQUIRES.
- Permissions-Policy header — server intent for camera, mic, geolocation, etc.
Per-hint, flags whether the hint is W3C high-entropy (UA Full-Version, Arch, Bitness, Model, Platform-Version, DPR, Width, Viewport, Device-Memory). Returns requested_hints[], hint_count, critical_hint_count, permission_count, entropy_score 0-10, fingerprint_risk low/medium/high/extreme, and a 0-100 A-F grade.
Use case: AI agents deciding what to send in their initial request. If a server requests Critical-CH with high-entropy identifiers, that's a privacy signal worth logging.
/api/mixed-content-scan
The mixed-content body scanner parses HTML body for http:// subresources on https:// pages across 12 element types: img, script, link, iframe, source, object, embed, video, audio, form, plus inline CSS url() and inline event handlers.
Returns per-type counts, total_mixed_content_count, blocked_active_count (resources browsers will actually block), sample URLs, and a 0-100 A-F grade (100 = no mixed content).
Use case: AI agents auditing secure pages before integrating or scraping. Detects the difference between warning-only mixed content (passive) and block-active mixed content (script/iframe/form).
Both endpoints
Both return HTTP 402 + valid x402 envelope on no-payment. On bogus X-PAYMENT: real verify_failed from pay.openfacilitator.io — not a stub. Settlement goes through, USDC moves on-chain.
Discovery
- /.well-known/x402 — full 125-endpoint list
- /openapi.json — full 123-path spec
- /llms.txt — markdown catalog for AI agents
Top comments (0)