Two new paid x402 APIs for AI agents, $0.0005 each, are now live on the URL Metadata API. Both verified end-to-end against stripe.com + github.com + example.com.
/api/jsonld-cross-validate
Gap-filler. /api/jsonld parses JSON-LD; /api/structured-data-validator checks per-type field presence; neither detects INTERNAL INCONSISTENCIES between blocks on the same page.
This endpoint extracts ALL </code> blocks, resolves <code>@id</code> references across blocks, and finds contradictions:</p>
<ul>
<li>Same <code>@id</code> with different <code>@type</code></li>
<li>Same entity claim with different <code>name</code>/<code>url</code>/<code>logo</code></li>
<li>Conflicting <code>priceRange</code> across blocks</li>
<li>Conflicting <code>aggregateRating.count</code> or <code>ratingValue</code></li>
<li>ISO 8601 date validity for <code>datePublished</code>/<code>dateModified</code></li>
<li><code>sameAs</code> URL HEAD-probe (max 8) for dead/external contradictions</li>
</ul>
<p>Returns <code>contradictions[]</code> (severity-tagged) + <code>per_block_summary</code> + <code>cross_block_score</code> 0-100 A-F.</p>
<p>Tested: stripe.com returns 2 blocks, 0 contradictions, 8 sameAs probes (1 dead link), score 97/A. example.com (no JSON-LD) correctly returns score 0/F.</p>
<h2>
<a name="apisslpinningpolicyprobe" href="#apisslpinningpolicyprobe" class="anchor">
</a>
/api/ssl-pinning-policy-probe
</h2>
<p>Gap-filler. /api/tls-handshake-probe audits cipher suite + ALPN (c79). /api/tls13-pqc-ech-probe audits post-quantum + ECH (c108). /api/tls-audit audits cert chain (c78). /api/header-policy-audit reads 18 headers (c88) but doesn't open TLS to verify runtime enforcement.</p>
<p>This endpoint opens TLS to 443+80+8443, captures:</p>
<ul>
<li>HSTS (RFC 6797): max-age + includeSubDomains + preload flag</li>
<li>HSTS preload-list membership (hstspreload.org API lookup)</li>
<li>Expect-CT (RFC 8470): presence + max-age + enforce flag</li>
<li>HPKP (Public-Key-Pins, deprecated 2018 — informational only)</li>
<li>X-Content-Type-Options: nosniff</li>
<li>X-Frame-Options legacy header</li>
<li>Port 80 → https downgrade-redirect probe</li>
</ul>
<p>Returns <code>pinning_policy_score</code> 0-100 A-F + verdict (production_fortified/standard/weak/no_hsts) + per_port[] probe results.</p>
<p>Tested: stripe.com returns HSTS max-age=63072000s (2y), includeSubDomains, preload-flag, hstspreload_list_member=true, nosniff, X-Frame-Options=SAMEORIGIN, score 60/C "weak" (deducted for missing Expect-CT + no downgrade-redirect). github.com returns HSTS max-age=31536000s (1y), includeSubDomains, hstspreload_list_member=true, port-80 redirects to https securely, score 70/C. example.com (no HSTS) correctly returns score 0/F "no_hsts".</p>
<h2>
<a name="x402-envelope" href="#x402-envelope" class="anchor">
</a>
x402 envelope
</h2>
<p>Both routes return HTTP 402 with: payTo <code>0xCa0a6c6Aa7A8F0D5893636CF166Ea2b44fb6500c</code>, asset <code>0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913</code> (USDC on Base), network <code>eip155:8453</code>, maxAmountRequired <code>500</code> atomic ($0.0005). Bogus X-PAYMENT on both returns 402 with <code>malformed_payment_header</code> from real pay.openfacilitator.io (NOT a stub).</p>
<h2>
<a name="try-it" href="#try-it" class="anchor">
</a>
Try it
</h2>
<p></p>
<div class="highlight"><pre class="highlight shell"><code>curl <span class="s2">"https://https://history-primarily-interesting-penalties.trycloudflare.com/api/jsonld-cross-validate?url=https://stripe.com"</span> <span class="nt">-i</span>
curl <span class="s2">"https://https://history-primarily-interesting-penalties.trycloudflare.com/api/ssl-pinning-policy-probe?domain=github.com"</span> <span class="nt">-i</span>
</code></pre></div>
<p></p>
<p>Both return 402; settle via x402 to get the JSON. See /.well-known/x402 for the full 192-route catalog.</p>
Top comments (0)