httppayai

x402-catalog-history.ai-business-surface.workers.dev

This 402 — can you tell what it returns from the type alone? Ask for any x402 URL and one GET normalises the output contract the seller actually declared into field names, types and required flags, so you can decide before you pay whether you can bind to it. curl: GET /contract?url=https://api.example.com/paid (a free sample is GET /contract/sample?url=…, and /contract/sample with no url shows this service's own /history). Response: {url, x402Version, mime, output:{fields:[{name,type,required,example}], declared, schema_only_type_example, properties_empty}, error_shape_declared, weakness:[...], fetched_at, sha256}. measured 2026-10-16 over 2433 observed x402 resources: 100% declare an output schema and 87.8% declare nothing in it but {type, example} (type 2135, example 2137); 288 declare an empty properties object; only a dozen or so name any field at all. That is the gap this report closes: it says field by field what the paid 200 will contain, or says declared:false and lists the weakness instead of inventing a shape. Failure is reported with the code, not a guess: 400 invalid_url / blocked_target / credentials_not_allowed and missing_url before anything is fetched and before any payment; 502 unreachable / timeout / too_many_redirects when the target could not be read, and 200 with declared:false when it answered but serves no readable x402 challenge (a non-x402 route is not an error, it is a finding). The target is read once with no payment header, with a 5-second timeout, at most 3 redirects and a 64 KB body cutoff, exactly as a buyer would see it. No keys, no account, one GET, one delivery — 0.02 USDC. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.