x402-catalog-history.ai-business-surface.workers.dev x402 offerings

IPv4 and IPv6 address inspector: one GET takes one address and returns its canonical and fully expanded form, its decimal integer and hex value, its reverse-DNS name (in-addr.arpa or ip6.arpa), and the special-purpose ranges it belongs to — private, loopback, link-local, multicast, documentation, carrier-grade NAT, unique-local, NAT64, 6to4, Teredo — as scope, flags and special_ranges. An IPv4-mapped IPv6 address also returns the embedded IPv4 address and its classification. curl: GET /ip?addr=2001:db8::1 . Response: {"version":6,"canonical":"2001:db8::1","expanded":"2001:0db8:...","scope":"documentation","flags":{...}}. global means outside the special-purpose ranges checked here; it is not a claim about reachability, ownership or reputation, and no DNS query is made. A missing, malformed, over-long or zone-id address is 400 before payment and before any charge. No keys, no account, one GET, one delivery — 0.001 USDC. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Pick random items from a list in one GET: count items from the items you pass, uniform, by default without replacement. Returns picked[] and the 0-based indices[], drawn with crypto.getRandomValues and rejection sampling (Fisher-Yates for unique draws). Nothing is fetched or stored. curl: GET /pick?items=alice,bob,carol&count=2 . Response: {"picked":["carol","alice"],"indices":[2,0],"unique":true,...}. items 1..100 comma/newline separated; count 1..100 (default 1); replace=false by default. An empty item, too many/over-long items, a bad count or count>items without replacement is 400 before payment. No seed and no signed beacon; each paid call returns fresh picks. No keys, no account, one GET, one delivery — 0.001 USDC. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

URL inspector: one GET takes one absolute http(s) URL and returns its scheme, host, port, origin, path, path segments, every query parameter as name/value pairs (duplicates preserved), fragment and normalized href. It also reports has_credentials and password_present but never returns the password. curl: GET /url?url=https%3A%2F%2Fexample.com%2Fa%3Fx%3D1 . Nothing is fetched, DNS-resolved or stored. Missing, malformed, over-long and non-http(s) URLs are 400 before payment. No keys, no account, one GET, one delivery — 0.001 USDC. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Send one x402 endpoint URL, get a verdict: alive or dead, the exact price and payTo it charges right now, and what changed since your last look. One GET, no key. Agents call this before paying someone else. The call answers all three: alive (with the reason when it is not), the probe facts (HTTP status, latency, redirects, bytes, cutoff), the exact 402 the target serves right now (amount, asset, network, payTo, maxTimeoutSeconds, required fields), response_shape (what it actually answered), history (uptime reached/of, challenges seen, changes_since_previous) and delivery_evidence. The target is fetched once per paid call, with no payment header, so the 402 you read is the one a buyer faces. By specification: a 5-second timeout, at most 3 redirects, a 64 KB body cutoff, and a refusal — before any payment — of internal, private or link-local hosts, non-web ports, URLs over 2048 characters and URLs that embed credentials. One GET, one probe, one delivery. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

登録した x402 のURLの支払条件が変わった時だけ差分を返す。変わっていなければ changed:false。壊れる前に気づくための1コール。条件は scheme・network・asset・amount・payTo・maxTimeoutSeconds の6項目で、差分は変わった項目の field / from / to だけ。curl: curl -X POST -H 'content-type: application/json' -d '{"url":"https://api.example.com/paid"}' https://<host>/watch → watch_id を受け取り、以後は curl 'https://<host>/watch?id=<watch_id>' で差分だけを読む。Response: {"watch_id":"…","changed":true,"changes":[{"field":"amount","from":"20000","to":"30000"}],"conditions":{"scheme":"exact","network":"eip155:8453","asset":"0x8335…","amount":"30000","payTo":"0x6f60…","maxTimeoutSeconds":60},"observed":true,"checks":2} — 変わった項目だけが返る。 Monitor an x402 endpoint's uptime and payment conditions: register the URL once, then every later call returns only the fields that changed (changed:false when nothing moved) — an uptime and change monitor for x402 paid endpoints, with no webhook to run.登録も差分も1コール 0.02 USDC。対象は支払いの後に1回だけ取得し、5秒で打ち切り・リダイレクトは3回まで。同じURLの60秒以内の再取得はキャッシュから返す。 A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Can I get just the article, as Markdown you can paste? Pass one URL and get the body back as clean Markdown — headings, paragraphs, lists, fenced code, inline code, links, images, quotes and tables kept; navigation, cookie banners, ads, sidebars, share buttons and the footer dropped. The response is text/markdown itself, so it is ready to paste into a prompt, a document or a file: no wrapper to unwrap. The page is fetched once per paid call, after payment, with a 5-second timeout and at most 3 redirects, and internal, private or link-local hosts, non-web ports, URLs over 2048 characters and URLs that embed credentials are refused with 400 before payment. Calling the same URL again within a minute is served from this service's short-lived cache. One GET, one article, one delivery. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Know whether a 402 will work with your client before you pay it: pass the URL and one GET returns whether the payment challenge is readable by x402 v2 clients (the PAYMENT-REQUIRED header), readable by v1 clients (the JSON body), or neither — and exactly which required fields are missing from the accepts[] it serves. curl: GET /compat-check?url=https://api.example.com/paid. Response: {verdict:{buyable_with_v2_client,buyable_with_v1_client,one_line,blocking[]}, v2:{readable,x402_version,network_form,missing_required[],amount_atomic,asset,pay_to}, v1:{readable,x402_version,network_form,missing_required[],amount_atomic,asset,pay_to}, header:{payment_required_present,decodes_as_base64_json}, challenge:{...the facts the target served...}}. The verdict is computed from the response the target actually serves, read once per paid call with no payment header, so it is the same 402 a buyer faces: a 5-second timeout, at most 3 redirects, a 64 KB body cutoff, and a refusal — before any payment — of internal, private or link-local hosts, non-web ports, URLs over 2048 characters and URLs that embed credentials. No keys, no account, one GET, one delivery — 0.02 USDC. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Which routes can actually pay me, where do they pay out, and what do they demand first? One GET returns every route that was judged, each with the state that was measured and the date, the currency and chain it pays out in, whether it needs KYC, whether it needs SMS, its fees and the evidence behind the judgement. curl: GET /reality (every route) or GET /reality?name=Loopuman (one route; a partial name matches). Response: {count, routes:[{name,url,alive,alive_measured_at,receive_currency_chain,kyc_required,sms_required,fees,paid_evidence,usable_without_identity_gate,source}], summary, data:{generated_at}}. Every judgement is a recorded measurement carried with its date, and a field that was never measured says 未確認 rather than guessing. The map is served from the bundled record, so the response does not depend on any third party. No keys, no account, one GET, one delivery — 0.05 USDC. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Is this price the going rate, or is it over the odds? One GET tells you where it sits in the measured x402 market — cheap, fair or expensive — with the median, the 25th and 90th percentiles, the band, and how many measured prices are behind the comparison. curl: GET /price?amount=0.02 (add &url=https://your.endpoint/path to also compare against that URL's category). Response: {verdict:{label,plain,one_line,rule}, price_position:{percentile_text,band,multiple_of_median}, market:{sample_size,p25,median,p90,bands,fetched_at}, category:{...}, my_price:{...}}. Every figure is a measured amount from the public discovery index, carried with the date it was fetched; nothing is estimated or interpolated. The comparison is served from the bundled snapshot, so the response does not depend on any third party. No keys, no account, one GET, one delivery — 0.02 USDC. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Catch a breaking schema change before it reaches production: post one {schema, actual} JSON pair and get a compatibility report with an RFC 6901 JSON Pointer to every mismatch, the keyword that faile…

See what moved in the x402 catalogue over the period you choose: for every field, the value before and after, the observation time and the target it belongs to — plus where observation stopped, where it resumed and which cycles are missing. One GET, one delivery, read-only, no live upstream call. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Know that an x402 resource is real before you spend: one dated, immutable snapshot of the public x402 facilitator catalogue (19,325 indexed resources) — the totals, the composition of a discovery page, facilitator capabilities and per-call pricing, and every change detected since the previous sample, with the raw facts behind each one. One GET, one delivery, read-only, no live upstream call, so the record you read today is the same record tomorrow. Canonical source: https://x402-catalog-history.ai-business-surface.workers.dev/history — if you see this data offered elsewhere, that URL is the origin, and only this endpoint returns the observation timestamps that say when each fact was collected. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

The seller's playbook for a live x402 endpoint: the exact 402 challenge to serve (v2 header and v1 body in one response), what the facilitator /verify really checks and the balance rule that rejects …

Random bytes in one GET, without an LLM or Math.random(): hex, base64 or a UUID. curl: GET /random?bytes=32&format=hex (bytes 1-1024, default 32; format hex|base64|uuid, default hex). Response: {"value":"9f2c41ab…(64 hex characters)","format":"hex","bytes":32,"bits":256,"generated_at":"2026-10-16T09:20:00.000Z","sha256":"41ab…","sha256_of":"value","source":"crypto.getRandomValues"}. The bytes come from the Worker runtime's Web Crypto API, crypto.getRandomValues, called once per paid request after the payment is verified; nothing is stored, cached or served twice, and the sha256 is the SHA-256 of the value you received, so you can check the string. format=uuid answers a UUID version 4 string. 0.001 USDC, no account, no key, one GET, one delivery. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Look up a legal entity in the GLEIF register: the official LEI, the legal name, the registered address, the jurisdiction and the registration status in one GET. curl: GET /lei?q=Apple%20Inc (a company name and a 20-character LEI both work: ?q=HWUPKR0MPOU8FGXBT394). Response: {"query":"Apple Inc","count":1,"total_matches":24,"results":[{"lei":"HWUPKR0MPOU8FGXBT394","legal_name":"Apple Inc.","entity_status":"ACTIVE","registration_status":"ISSUED","jurisdiction":"US-CA","legal_address":{"city":"Glendale","region":"US-CA","country":"US","postal_code":"91203"}}],"source":{"name":"GLEIF","api":"https://api.gleif.org/api/v1/lei-records","fetched_at":"…"}}. Every value is read from the GLEIF public API (Global Legal Entity Identifier Foundation) at the moment of the call, and the response carries the API URL and the fetched_at it came from. 0.005 USDC, no account, no key, one GET, one delivery. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

The observed x402 catalogue is mass-produced: one GET returns every repeating description template, how many resources share it, the axis it varies along and a representative example — 30 families, largest 80 members, computed from 2562 observed resources (2400 with a description). curl: GET /catalog/families (optional min_members>=2, axis=tld|selector|domain|number|url|literal|token|none, limit=1-200). Response: {"count":30,"max_members":80,"axis_counts":{"selector":1,"token":17,"none":10,"tld":1,"domain":1},"families":[{"family_id":"fam-001","members":80,"axis":"selector","axis_values":["sendgrid._domainkey.","namecheap._domainkey.","marketo._domainkey."],"template":"dkim public key selector <q> domain looks <var> <var> <var> <var> <var> <var> <var> <var> <var> <var> <var> <var> <var> ","price_usd":{"min":0.01,"median":0.01,"max":0.01},"representatives":[{"resource":"https://dns.intel.rallylive.ca/dns/dkim/ionos","description":"DKIM public key for selector \"ionos\" of a domain: looks up ionos._domainkey.<domain> (TXT, Cloudflare DoH) and parses v="}]}]}. 0.05 USDC, no account, no key, one GET, one delivery. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Market headlines from public RSS in one GET: title, URL, publication time and source, newest first, with nothing older than 48 hours. curl: GET /news?topic=markets&limit=20 (topic markets|crypto|tech|world, default markets; limit 1-50, default 20). Response: {"topic":"markets","count":20,"freshness":{"max_age_hours":48,"newest_published_at":"2026-10-16T20:36:00.000Z","oldest_published_at":"2026-10-16T02:12:00.000Z","fetched_at":"2026-10-16T20:41:07.000Z","items_within_window":94,"dropped_older_than_window":12,"dropped_undated":0},"items":[{"title":"Stocks close at a record as earnings beat","url":"https://…","published_at":"2026-10-16T20:30:00.000Z","source":"MarketWatch","age_minutes":11}],"sources":[{"source":"BBC Business","feed_url":"…","ok":true,"http_status":200,"items_in_window":28,"latency_ms":180}]}. The five market feeds are read in parallel at the moment of the call, each with a 6 second cutoff, and every item carries the time its feed published it, so the age of each headline is visible. 0.005 USDC, no account, no key, one GET, one delivery. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Public holidays for one country and year in one GET: the date, the local-language name, the English name, the types, the weekday and how many days from today each one falls. curl: GET /holidays?country=JP&year=2026 (country is a two-letter ISO 3166-1 code; year defaults to this year). Response: {"country":"JP","year":2026,"count":16,"holidays":[{"date":"2026-01-01","local_name":"元日","name":"New Year's Day","types":["Public"],"weekday":"Thursday","global":true,"days_from_today":-290}],"upcoming":[...],"source":{"name":"Nager.Date","api":"https://date.nager.at/api/v3/PublicHolidays","fetched_at":"…"}}. Every value is read from the Nager.Date public API at the moment of the call, and the response carries the API URL and the fetched_at it came from. 0.003 USDC, no account, no key, one GET, one delivery. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Buy the period once instead of ten times: up to 100 counted units of detected change in one 0.10 USDC GET (single-change calls cost 0.02 each, so this is the same data for half the price at 10 units and better after that). One unit = one target x one field x one detected change inside the period you pass, from the stored x402 catalogue observations. The response states units_requested, units_delivered and the unit definition, and when fewer units exist it says why — separating fields that were observed and did not change from fields whose target is missing observation cycles. One GET, one delivery, read-only, no live upstream call. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

OHLCV candles for one crypto pair from Coinbase Exchange in one GET: time, open, high, low, close and volume, newest first, with the source URL and fetch time. curl: GET /candles?pair=BTC-USD&granularity=3600&limit=24 (granularity 60|300|900|3600|21600|86400 seconds, default 3600; limit 1-300, default 24; pair defaults to BTC-USD). Response: {"pair":"BTC-USD","granularity_seconds":3600,"count":24,"candles":[{"unix":1792670400,"time":"2026-10-22T12:00:00.000Z","open":81656.69,"high":81816.21,"low":81605.44,"close":81746.7,"volume":95.50529109}],"source":{"name":"Coinbase Exchange","http_status":200,"latency_ms":210}}. The exchange is read once after payment; a pair it does not list is a 502 and is not charged. 0.005 USDC, no account, no key, one GET, one delivery. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Is this string mojibake, and can it be put back? One POST takes text you already hold and returns a verdict (clean, suspect, confirmed, unknown), the evidence (U+FFFD positions, C1 controls, half-wid…

Is this ISIN well formed? One GET applies the ISO 6166 check digit and returns valid, the supplied and expected check digit, the checksum total, the country code and name, and the 9-character NSIN. Malformed input is 400 before payment; a wrong check digit is 200 with valid=false. The algorithm is bundled in this Worker; no registry is queried, nothing is stored and the query is not logged. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

What Content-Type is this file? One GET maps one file extension (ext=json, with or without the dot) or one media type (type=application/json) to the canonical media type, its known extensions, the usual charset, whether it is usually compressed in transit, and its top-level category. Unknown but well-formed values are 200 with found=false. The table is bundled in this Worker; no fetch, no storage, no logging of the query. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Canonicalize JSON before you hash, compare or sign it: one POST takes a JSON string or any JSON value and returns the RFC 8785 (JCS) form, its SHA-256 and its UTF-8 byte length. Object keys are order…