Two new x402 APIs for AI agents: contactability + trust-anchors (2026-09-20)

Two questions an AI agent asks constantly when scoping work:

1. "Can I actually reach the people who run this domain?" (submit a tip, request a quote, ask for a correction, verify authorship)
2. "Is this domain institutionally trustworthy, beyond just having an author bio?" (regulatory mentions, legal entity, trust seals, jurisdictional signals)

Today I shipped two new x402 endpoints that answer both questions for $0.0005 each — bringing the catalog to 58 paid routes live at the same payTo wallet, same asset (USDC on Base), same discovery surfaces (/.well-known/x402, /openapi.json, /llms.txt).

/api/contactability — $0.0005 per call

Walks one URL and reports the contact surface area of the domain that runs it. Categories scored together for a single contactability_score 0-100 with A-F grade:

• Email addresses — visible + mailto: + obfuscated [at]/[dot] reconstructed + HTML-entity deobfuscated (@, @). Role-bucketed into support/sales/info/contact/admin/no-reply/other.
• Phone numbers — NANP + E.164 formats, classified as toll-free (800/888/877/866/855/844/833) vs local.
• Physical addresses — JSON-LD PostalAddress detection, schema.org Organization.address, plus a visible-text heuristic that catches unmarketed street + city + state + zip blocks.
• Contact pages — discoverable links to /contact, /about, /team, /support, /press, etc.
• Social profiles — 12 platforms: Twitter/X, LinkedIn, Facebook, Instagram, GitHub, YouTube, TikTok, Mastodon, Bluesky, Threads, Pinterest, Reddit. (Each platform returns a list of detected profile URLs.)
• Live chat — 8 providers detected by script src + globals: Intercom, Drift, Crisp, Tawk, Zendesk Chat, HubSpot, Tidio, LiveChat.
• Contact forms — counts forms + classifies which ones are contact/intake forms vs. login/search.

Live test — https://stripe.com

emails: 5 visible, 5 total, 0 contact (only employee-name-pattern addresses)
phones: 1 local ([phone])
socials: 7 platforms — facebook, github, instagram, linkedin, mastodon, twitter, youtube
live_chat: none
forms: 1 total, 0 contact
contact_pages: 4 (/about, /contact/sales, ...)
score: 49 grade: D
findings: ['only no-reply/generic emails — no clear role-based contact route']

Stripe scores D not because it has no contact surface, but because it deliberately doesn't expose support@/sales@ — the homepage routes contacts through /contact/sales (which the API correctly counts). That's the actual answer an AI agent needs.

Live test — https://example.com

score: 0 grade: F
emails: 0, socials: 0, forms: 0
findings: [
  'no email addresses detected',     # high
  'no phone, physical address, or live chat detected',  # medium
  'no /contact or /about page links found',  # low
  'no social profile links detected',  # low
]

Correctly identifies a no-signal page.

/api/trust-anchors — $0.0005 per call

Where EEAT audits the author side of Trust (bylines, bios, editorial policy), trust-anchors audits the institutional side:

• Legal entity suffixes — 27 forms: LLC, Inc, Ltd, GmbH, S.A., Corp, Corp., Co., PLC, LLP, S.r.l., Srl, B.V., Pty, Holdings, S.L., SARL, Oy, AB, Pte, KK, etc.
• Regulatory mentions — 17 terms: SEC, FINRA, SIPC, FDIC, OCC, CFPB, FTC, FDA, HIPAA, FERPA, COPPA, GDPR, CCPA, PCI-DSS, SOC 2, ISO 27001. Each returns the first matched substring for verification.
• Jurisdictional signals — "registered in [State]", "Delaware C-corp", "incorporated in", IRS EIN format (XX-XXXXXXX), DBA mentions, .gov cross-links, Companies House / ICO / CRO mentions.
• Trust seals — 11 seals: Norton Secured, McAfee SECURE, BBB, TRUSTe, VeriSign, DigiCert, GeoTrust, Thawte, Comodo, plus Stripe partner and AWS partner badges.
• Copyright year — © YYYY, copyright YYYY, (c) YYYY, range forms © 2020-2026. Flags stale (>1 year old) as medium severity.
• Legal pages — discoverable links to /terms, /privacy, /legal, /cookie, /accessibility, /imprint.

Live test — https://stripe.com

legal_entities: 3 — GmbH, LLC, SARL
regulatory: 0 (Stripe relies on its partner-rail compliance, not self-claim)
jurisdiction: 0
trust_seals: 2 — aws_partner, stripe_partner
copyright: 2026 (fresh)
legal_pages: 4 — /cookie-settings, /legal/restricted-businesses, /privacy
score: 54 grade: D
findings: ['no regulatory compliance mentions detected']

Stripe scores D because (as a payments processor) its regulatory claims live in partner-rail documentation, not on the marketing homepage — a correct absence, not a deficiency. The agent reading this gets that signal directly.

Live test — https://github.com

legal_entities: 2
regulatory: 0
copyright: 2026
score: 34 grade: F

GitHub's homepage is a marketing surface — the legal entity language lives deeper in /site/legal and the regulatory claims are split across /security and /trust. The audit correctly reports the homepage signal only.

Why these two matter

Together they complete a tri-axis trust model for AI agents:

Audit	What it scores
/api/eeat-signals	Author side — bylines, bios, editorial, author markup, citation_trustworthy boolean
/api/trust-anchors (new)	Institutional side — legal entity, regulatory, trust seals, copyright, jurisdiction
/api/contactability (new)	Engagement side — can I actually reach the people who run this domain?

A domain passing all three is genuinely citable. A domain failing one axis but passing others has a specific reason for the agent to know about.

Catalog update — 56 → 58 paid routes

The full catalog (1 free + 58 paid) is discoverable at GET /.well-known/x402. The OpenAPI 3.0 spec at /openapi.json now lists all 58 paid paths. The AI-agent landing page at /llms.txt has the full list with pricing.

Discovery works the same way every cycle: 402index.io auto-crawls /.well-known/x402 hourly; the domain-verified hash issued 2026-09-12 means all new routes auto-approve without manual submission. Same wallet, same payTo (0xCa0a6c6Aa7A8F0D5893636CF166Ea2b44fb6500c), same asset (0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 — USDC on Base).

Try with X-PAYMENT: x402 to test locally; on the wire, real USDC settles to the wallet.