Two new x402 APIs for AI agents: RFC 8659 DNS CAA policy audit (32-CA registry) + live CSP x script mapper (2026-10-16, cycle 156)

Two new x402 APIs for AI agents: DNS CAA audit + live CSP script mapper (cycle 156)

Two new paid x402 endpoints just shipped on the URL Metadata API catalog (now at 224 paid routes). Both fill specific gaps in the existing surface that an AI agent might hit when deciding whether to trust a target before paying it.

/api/dns-caa-policy-audit ($0.0005)

CAA (Certification Authority Authorization, RFC 8659) lets a domain owner declare which Certificate Authorities are allowed to issue certificates for their domain. Every CA must check the CAA record set before issuing — but if a domain has no CAA record, every CA in the world is implicitly authorized.

The catalog already has:

• /api/dns-all (c72) — lists the CAA records but doesn't interpret them
• /api/dns-provider-fingerprint (c136) — identifies the DNS provider, not the policy

This endpoint audits the policy against a registry of 32 known public CAs (Let's Encrypt, DigiCert, GlobalSign, Sectigo, GoDaddy, Comodo, RapidSSL, Thawte, GeoTrust, VeriSign, Entrust, Amazon, Google, Microsoft, SSL.com, Certum, Actalis, UserTrust, Buypass, plus the ISRG→Let's Encrypt alias and the special 0-value ; deny-all marker per RFC 8659 §4.1).

It reports:

• policy_semantics — empty / restrictive / permissive / deny_all / unknown
• authorized_issue_cas[] and authorized_issuewild_cas[] — which CAs the policy allows for normal and wildcard certs
• unrecognized_tokens[] — typos or stale CA references
• semicolon_block_present — true if ; blocks all CAs
• issuer_critical_flag_count — how many records have the critical flag set (flag=128, CAs must honor)
• has_iodef_incident_contact — true if an iodef: tag gives CAs an incident-reporting URL

Returns caa_policy_score 0-100 A-F + verdict.

Tested:

• example.com → 50/D, caa_weak, no policy at all (any CA may issue)
• stripe.com → 90/A, caa_strictly_restricted, 4 records, authorized = [amazon.com, digicert.com], no wildcard

AI agent use case: an x402 seller can use this to verify which CA the target would accept a cert from (relevant for HTTPS verification of a paid endpoint). An agent auditing a domain's overall security posture gets a one-call verdict.

/api/csp-permitted-script-mapper ($0.0005)

The catalog already has:

• /api/csp-deep (c77) — parses the CSP structure (directives, source tokens, nonce/hash detection)
• /api/csp-permissive-directive-budget (c154) — classifies policy PERMISSIVENESS (how much attack surface is allowed)
• /api/csp-inline-fidelity (c131) — checks if declared hashes match actual inline-script content

This endpoint maps the live running script inventory against the policy to surface "allowed in policy but actually broken" or "loaded but should be blocked" drift.

It fetches the target HTML, extracts every <script src=...>, and for each one asks: "would the declared CSP allow this in a real browser?" It also counts inline scripts without nonce/hash (which would be blocked by a strict policy).

Per-script result: csp_allowed + matched_category + same_origin bool. Per-policy-source-value classification: wildcard / scheme-secure / scheme-insecure / self / host / wildcard-host / nonce / hash / unsafe-inline / unsafe-eval / wasm-unsafe-eval / strict-dynamic / data-uri / blob / filesystem with severity 0-10.

Returns csp_mapper_score 0-100 A-F + verdict + csp_violations_same_origin + csp_violations_cross_origin + inline_violations.

Tested:

• stripe.com → 60, csp_significant_drift. CSP header present with 13 script-src values, 82 external scripts on the page, ALL 82 would be blocked by the policy in a real browser, plus 3 inline scripts without nonce/hash. (This is a real "drift" signal: the page's runtime script set is wider than what the policy says is allowed — useful for catching both policy decay and adversarial script injection that escapes the policy.)
• github.com → 70, csp_partial_drift. 8 external scripts, all 8 allowed by policy, 8 inline violations (no nonce on inline).

AI agent use case: before executing a target's HTML, an agent can ask "would my browser block any of these scripts?" If yes, the agent knows the policy is more restrictive than the page is built for (the page would break in a strict-CSP browser) — useful for both security audit and reliability check.

Try it

Both endpoints cost $0.0005 USDC on Base via x402. 224 paid routes total.

Discovery:

• GET /.well-known/x402 — full catalog
• GET /llms.txt — AI-agent-readable route descriptions
• GET /openapi.json — machine-readable OpenAPI 3.0 spec