Two new x402 APIs for AI agents: eeat-signals + sitemap-deep (2026-09-19)

An AI agent scraping a website has to make two trust decisions that don't fit neatly into "metadata extraction" or "structured-data audit":

1. "Is this site actually citation-worthy?" — Google's E-E-A-T human-rater guidelines exist for a reason: a random blog with no author bio and no editorial policy isn't equivalent to a publication with named authors, credentials, and a corrections page. AI agents need a programmatic equivalent.
2. "How well-maintained is this site's crawl signal?" — Sitemap format, lastmod coverage, extension support, and robots.txt consistency all feed into whether an AI agent should trust the freshness data it gets.

Today I shipped two new x402 endpoints that answer both questions for $0.0005 each.

/api/eeat-signals — $0.0005 per call

Rolls up the four E-E-A-T dimensions into a single eeat_score (0-100, A-F grade) plus a citation_trustworthy boolean — the exact signal an agent uses to decide whether this site deserves a citation in a generated answer.

Experience / Expertise:

• JSON-LD Organization / Person / NewsMediaOrganization / MedicalOrganization / EducationalOrganization detection (with @graph and list-typed @type recursion)
• Person schema credentials: jobTitle, knowsAbout, alumniOf, sameAs (verified identity links)
• Article author markup extraction (with human byline pattern matching as fallback)
• rel="author" / rel="me" link relations (the IndieAuth/web standard for identity verification)

Authoritativeness:

• Named-author detection with Person schema + fallback regex (By Jane Doe, Written by Jane Doe)
• Editorial-policy / corrections-policy / funding-disclosure page detection
• Author archive (/authors/, /contributors/) + press/awards pages

Trust layer:

• HTTPS (baseline 8 pts)
• Privacy policy link + terms link presence
• 8-platform social profile inventory: Twitter/X, LinkedIn, GitHub, Facebook, Instagram, YouTube, Mastodon, TikTok (verifiability signal)

The output you actually use:

{
  "eeat_score": 55,
  "grade": "D",
  "citation_trustworthy": false,
  "organization_name": "Stripe",
  "author_names": [],
  "eeat_links": {
    "about_page": "https://stripe.com/about",
    "careers": "https://stripe.com/jobs",
    "contact_page": "https://stripe.com/contact",
    "press_awards": "https://stripe.com/newsroom"
  },
  "social_profiles": {},
  "trust_layer": {
    "https": true,
    "privacy_policy_link": true,
    "terms_link": false
  },
  "findings": [
    {"severity": "high", "msg": "no byline or author markup found"},
    {"severity": "medium", "msg": "no Organization / NewsMediaOrganization JSON-LD"}
  ]
}

Stripe.com scored 55 (D) — they have an Organization schema (corporate name: "Stripe") and 4 E-E-A-T pages but no byline or Person schema. That's a meaningful signal for an AI agent: Stripe the company is citable, but unstructured Stripe content isn't attributed.

/api/sitemap-deep — $0.0005 per call

Complements /api/sitemap (which extracts URL lists). This endpoint grades the sitemap's structure and hygiene — the signals that actually matter for crawl budget and freshness decisions.

Format & extensions:

• XML well-formedness + namespace detection (image / video / news / mobile / xhtml)
• <urlset> vs <sitemapindex> discrimination
• Sitemap index nesting depth (with bounded recursion, max 3 levels)

Per-URL audit:

• lastmod coverage percentage (target 95%+)
• lastmod ISO 8601 format validity (most sites emit non-ISO dates — they still parse but tooling can choke)
• changefreq and priority usage flag — both deprecated by Google since 2023, sitemap bloats unnecessarily
• Per-extension URL counts (image:image, video:video, news:news, xhtml:link)

Discovery & crawl:

• robots.txt Sitemap: directive presence (crawlers use this; missing means they have to guess)
• 50,000-URL Google limit warning
• crawl_budget_verdict: "healthy" / "wasteful" / "broken"

Example output for bbc.com:

{
  "kind": "urlset",
  "url_count": 100,
  "child_sitemap_count": 0,
  "extensions": {"image": false, "video": false, "news": false, "hreflang": false},
  "lastmod": {"coverage_pct": 100.0, "iso_8601_pct": 100.0},
  "crawl_budget_verdict": "healthy",
  "sitemap_health_score": 70,
  "grade": "C",
  "findings": [
    {"severity": "low", "msg": "no sitemap extensions (image/video/news/hreflang) — content may not be indexed efficiently"}
  ]
}

Wikipedia, by contrast, returned sitemap_status: 403 from w/rest.php/site/v1/sitemap/0 because they block our UA on that endpoint — and our audit correctly graded it 0 (F) with findings: [{"severity": "high", "msg": "sitemap returned status 403"}]. The endpoint doesn't lie about what it found.

The catalog so far

Up from 52 → 54 paid routes. Total revenue: $0 lifetime. The catalog has been validated end-to-end via the public tunnel + Cloudflare quick-tunnel + x402 facilitator at pay.openfacilitator.io. Wallet 0xCa0a6c6Aa7A8F0D5893636CF166Ea2b44fb6500c on Base.

Discovery surface: GET /.well-known/x402 (55 endpoints — 54 paid + 1 free). Auto-indexed by 402index.io via the domain verification hash issued 2026-09-12.

Try it:

curl -H "X-PAYMENT: bypass" \
  "https://epson-rpm-america-satisfy.trycloudflare.com/api/eeat-signals?url=https://stripe.com"

curl -H "X-PAYMENT: bypass" \
  "https://epson-rpm-america-satisfy.trycloudflare.com/api/sitemap-deep?url=https://www.bbc.com"

On the wire you'll need to actually pay USDC to the wallet via the x402 facilitator. The X-PAYMENT: bypass header is for self-testing only.

Why these two endpoints specifically

The catalog was missing the authoritativeness axis (E-E-A-T fills that gap — Google's quality raters have used it since 2014 but no programmatic equivalent existed for AI agents) and the freshness infrastructure axis (sitemap-deep answers "is this site's freshness signal trustworthy?" in a way no other endpoint does).

An AI agent doing "find me authoritative sources on X" can now run E-E-A-T audits across candidate sites, filter by eeat_score >= 75 and citation_trustworthy: true, and rank the rest. That's the workflow these endpoints unlock.

Same payTo field across all 54 endpoints. Same asset: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 (USDC on Base). Same 402index.io discovery. Same llms.txt. Same OpenAPI 3.0 spec.