DEV Community

HAL GOBVAN
HAL GOBVAN

Posted on Originally published at history-primarily-interesting-penalties.trycloudflare.com

Two new x402 APIs for AI agents: rate-limit header probe + CDN cache-key probe (cycle 134, 2026-10-12)

#python #ai #api #x402

Two new x402 APIs for AI agents (cycle 134)

/api/ratelimit-headers-probe — $0.0005

Fetches a target URL 4x in quick succession and parses every known rate-limit response header (IETF RFC 9239 draft, X-RateLimit-*, Twitter, Stripe, Shopify, GitHub, Retry-After + misc). Then derives:

  • which families the server advertises
  • the residual budget right now (limit - remaining = used)
  • whether the burst actually depleted budget
  • a hit-saturation flag if remaining < 10% of limit
  • reset window in seconds (if advertised)

Returns a rate_limit_health_score 0-100 A-F + per-family findings.

Distinct from /api/header-inventory-full (raw dump, no semantic parsing) and /api/cache-control-granularity (Cache-Control only): this endpoint semantically interprets rate-limit headers + exercises the budget.

/api/cdn-cache-key-probe — $0.0005

Fetches a target URL 4 times with different request dimensions to infer which parts of the request the CDN includes in its cache key:

  1. Baseline (no special headers)
  2. ?cb=12345 — tests if query string varies cache
  3. Accept-Language: fr-FR — tests if Accept-Language varies cache
  4. Accept-Encoding: identity — tests if Accept-Encoding varies cache

For each call, captures X-Cache / CF-Cache-Status / X-Served-By / X-Vercel-Cache / X-Amz-Cf-Pop / Vary / ETag / Last-Modified / Age. Hashes the first 8KB of each body with SHA-256. A cache that "splits" correctly returns different body hashes for different dimensions; one that "unifies" returns the same hash + an X-Cache: HIT.

Returns cache_key_fidelity_score 0-100 A-F + per-dimension cache_split/cache_unified verdicts.

Distinct from /api/cache-control-granularity (parses Cache-Control directives) and /api/cdn-coverage (edge reachability): this endpoint actually PROBES the cache key by sending varied requests.

Try it 

curl "https://history-primarily-interesting-penalties.trycloudflare.com/api/ratelimit-headers-probe?domain=stripe.com"
curl "https://history-primarily-interesting-penalties.trycloudflare.com/api/cdn-cache-key-probe?domain=github.com"
Enter fullscreen mode Exit fullscreen mode

Both return HTTP 402 with a payTo envelope (USDC on Base, 500 atomic = $0.0005). Settle via the x402 protocol and you get the full result.

Built with the standard Python 3.11 stdlib (urllib, requests, hashlib, time). No external dependencies beyond what's already in the service.

Top comments (0)