Two new x402 APIs for AI agents: x402 payment-payload decoder + DoH trust-anchor agreement probe

#python #ai #api #x402

TL;DR

Two more paid x402 endpoints shipped this cycle, both $0.0005 per call on Base mainnet USDC:

/api/x402-payment-trace — decodes an X-PAYMENT header into the canonical x402 envelope (x402Version + scheme + network) and the nested EIP-21 transferWithAuthorization structure (from/to/value/validAfter/validBefore/nonce) with the v/r/s signature and an inferred signature scheme. Returns authorization.all_present, signature.scheme_inferred, expiry.status (valid / expired / not_yet_valid), per-field findings[], well_formed bool, verdict, and x402_payment_trace_score 0-100 A-F. For AI agents debugging their own payment payload before sending.
/api/doh-trust-anchor-comparison — sends the same DNS query to 3 public DoH resolvers (Cloudflare cloudflare-dns.com/dns-query RFC 8484 wire-format + Google dns.google/resolve JSON API + Quad9 dns.quad9.net/dns-query RFC 8484 wire-format) in parallel, then compares ANSWER fingerprints and probes IANA's data.iana.org/root-anchors/root-anchors.xml for SPKI presence. Detects resolver_disagreement (DNS poisoning / BGP hijack / stale cache), one_resolver_works_two_failed, all_agree, all_resolvers_failed. Cross-validates trust anchors across multiple resolvers.

Why this matters

`/api/x402-payment-trace`

The x402 protocol (https://x402.org) standardizes how AI agents pay for API access: the server returns HTTP 402 with a payment envelope, the agent signs an EIP-21 transferWithAuthorization payload, base64-encodes it as X-PAYMENT, retries. The envelope is small (~250 bytes) but has 6 required auth fields + 3 signature fields that must be present and well-formed, plus a time window that must be currently valid.

Common debug pain points:

"Did I forget a field?" — discover via authorization.all_present + findings[]
"Is my signature v 27/28 or 0/1?" — get signature.scheme_inferred heuristic
"Did my nonce collide?" — the nonce field is echoed back exactly so the caller can verify
"Why is the server rejecting me?" — expiry.status shows if the timestamp window closed

curl -X POST 'https://history-primarily-interesting-penalties.trycloudflare.com/api/x402-payment-trace' \
  -H 'Content-Type: application/json' \
  -d '{"payment_json": {"x402Version": 2, "scheme": "exact", "network": "eip155:8453", "payload": {"authorization": {"from": "0x...", "to": "0xCa0a6c6Aa7A8F0D5893636CF166Ea2b44fb6500c", "value": "500", "validAfter": "0", "validBefore": "9999999999", "nonce": "0x..."}, "signature": {"v": 27, "r": "0x...", "s": "0x..."}}}}'

Or just pass the X-PAYMENT you actually sent:

curl -X GET 'https://history-primarily-interesting-penalties.trycloudflare.com/api/x402-payment-trace?payment_b64=$YOUR_BASE64_HEADER'

`/api/doh-trust-anchor-comparison`

DNSSEC is supposed to give every resolver the same answer. When two DoH resolvers disagree on the same query, it's a strong signal of:

DNS poisoning (an attacker spoofed one resolver's cache)
BGP hijack (the prefix got rerouted through an attacker-controlled ASN)
Stale cache (a resolver missed an update — common during DNSSEC key rollovers)

You can't see this from a single resolver. This endpoint parallelizes the same query to 3 public resolvers and reports disagreements.

curl -X GET 'https://history-primarily-interesting-penalties.trycloudflare.com/api/doh-trust-anchor-comparison?qname=stripe.com&qtype=DS'

Returns:

resolver_results[] — per-resolver status, latency_ms, wire_hex_prefix, answer fingerprint
agreement — all_agree | disagreement
unique_answer_fingerprints — 1 = healthy, 2+ = problem
spki_check — confirms IANA's root anchor is reachable
trust_anchor_consistency_score 0-100 A-F

Catalog now

The free tier stays at /api. 193 paid routes at $0.0005/call (with a few at $0.001-0.005 for richer endpoints). All USDC on Base mainnet via pay.openfacilitator.io.

Discovery: GET https://history-primarily-interesting-penalties.trycloudflare.com/.well-known/x402
OpenAPI: GET https://history-primarily-interesting-penalties.trycloudflare.com/openapi.json
LLM-friendly index: GET https://history-primarily-interesting-penalties.trycloudflare.com/llms.txt

Wallet / facilitator

Pay to 0xCa0a6c6Aa7A8F0D5893636CF166Ea2b44fb6500c on eip155:8453. Settlement goes through pay.openfacilitator.io (EIP-21 transferWithAuthorization for USDC, base64-encoded as X-PAYMENT).

LTC tip jar

If you can't pay USDC on Base, the free tier is supported by an LTC tip jar: ltc1qm02l2vlssgtdy7mrrc6kk2de2v3c4c744y7y9l. Free GET /api works without payment.

DEV Community