x402-mime

The seller's playbook for a live x402 endpoint: the exact 402 challenge to serve (v2 header and v1 body in one response), what the facilitator /verify really checks and the balance rule that rejects a valid signature, how a settled payment becomes a delivery, delivery evidence in three independent records, how to get listed where agent buyers search, and a plain-USDC page for human buyers who will

Catch a breaking schema change before it reaches production: post one {schema, actual} JSON pair and get a compatibility report with an RFC 6901 JSON Pointer to every mismatch, the keyword that failed and the expected vs actual value. One POST, one report, supported keywords only, no upstream call. A purchase is two calls by design: this first call returns 402 with the price and the payment terms,

Know whether a 402 will work with your client before you pay it: pass the URL and one GET returns whether the payment challenge is readable by x402 v2 clients (the PAYMENT-REQUIRED header), readable by v1 clients (the JSON body), or neither — and exactly which required fields are missing from the accepts[] it serves. curl: GET /compat-check?url=https://api.example.com/paid. Response: {verdict:{buy

Which routes can actually pay me, where do they pay out, and what do they demand first? One GET returns every route that was judged, each with the state that was measured and the date, the currency and chain it pays out in, whether it needs KYC, whether it needs SMS, its fees and the evidence behind the judgement. curl: GET /reality (every route) or GET /reality?name=Loopuman (one route; a partial

Is this price the going rate, or is it over the odds? One GET tells you where it sits in the measured x402 market — cheap, fair or expensive — with the median, the 25th and 90th percentiles, the band, and how many measured prices are behind the comparison. curl: GET /price?amount=0.02 (add &url=https://your.endpoint/path to also compare against that URL's category). Response: {verdict:{label,plain

Market headlines from public RSS in one GET: title, URL, publication time and source, newest first, with nothing older than 48 hours. curl: GET /news?topic=markets&limit=20 (topic markets|crypto|tech|world, default markets; limit 1-50, default 20). Response: {"topic":"markets","count":20,"freshness":{"max_age_hours":48,"newest_published_at":"2026-10-16T20:36:00.000Z","oldest_published_at":"2026-10

Random bytes in one GET, without an LLM or Math.random(): hex, base64 or a UUID. curl: GET /random?bytes=32&format=hex (bytes 1-1024, default 32; format hex|base64|uuid, default hex). Response: {"value":"9f2c41ab…(64 hex characters)","format":"hex","bytes":32,"bits":256,"generated_at":"2026-10-16T09:20:00.000Z","sha256":"41ab…","sha256_of":"value","source":"crypto.getRandomValues"}. The bytes come

Just the diff, not the whole pack? Pass the version you already hold (from=) and get only the records that were added or changed since it, as JSONL or CSV, with the added/changed kind and the changed field names on each line, plus the signed download link once the payment is confirmed. The manifest states the base and target version, the diff record count, the unchanged records excluded, the bytes

Look up a legal entity in the GLEIF register: the official LEI, the legal name, the registered address, the jurisdiction and the registration status in one GET. curl: GET /lei?q=Apple%20Inc (a company name and a 20-character LEI both work: ?q=HWUPKR0MPOU8FGXBT394). Response: {"query":"Apple Inc","count":1,"total_matches":24,"results":[{"lei":"HWUPKR0MPOU8FGXBT394","legal_name":"Apple Inc.","entity

The observed x402 catalogue is mass-produced: one GET returns every repeating description template, how many resources share it, the axis it varies along and a representative example — 30 families, largest 80 members, computed from 2562 observed resources (2400 with a description). curl: GET /catalog/families (optional min_members>=2, axis=tld|selector|domain|number|url|literal|token|none, limit=1

登録した x402 のURLの支払条件が変わった時だけ差分を返す。変わっていなければ changed:false。壊れる前に気づくための1コール。条件は scheme・network・asset・amount・payTo・maxTimeoutSeconds の6項目で、差分は変わった項目の field / from / to だけ。curl: curl -X POST -H 'content-type: application/json' -d '{"url":"https://api.example.com/paid"}' https://<host>/watch → watch_id を受け取り、以後は curl 'https://<host>/watch?id=<watch_id>' で差分だけを読む。Response: {"watch_id":"…","changed":true,

Can I get just the article, as Markdown you can paste? Pass one URL and get the body back as clean Markdown — headings, paragraphs, lists, fenced code, inline code, links, images, quotes and tables kept; navigation, cookie banners, ads, sidebars, share buttons and the footer dropped. The response is text/markdown itself, so it is ready to paste into a prompt, a document or a file: no wrapper to un

登録した最大10本の x402 URLの支払条件が変わった時だけ、1コールで全部の差分を返す。変わっていなければ changed:false。1本ずつ /watch を呼ぶと本数分の往復と本数分の支払いになるので、まとめて1回にする。条件は scheme・network・asset・amount・payTo・maxTimeoutSeconds の6項目で、差分は URL ごとに変わった項目の field / from / to だけ。curl: curl -X POST -H 'content-type: application/json' -d '{"urls":["https://api.example.com/a","https://api.example.com/b"]}' https://<host>/watchlist → watchlist_id を受け取り、以後は curl

This 402 — can you tell what it returns from the type alone? Ask for any x402 URL and one GET normalises the output contract the seller actually declared into field names, types and required flags, so you can decide before you pay whether you can bind to it. curl: GET /contract?url=https://api.example.com/paid (a free sample is GET /contract/sample?url=…, and /contract/sample with no url shows thi

Unit conversion in one GET, without an LLM or a calculator: length, mass, volume, data and time, plus temperature. curl: GET /convert?value=1&from=km&to=m (from/to are unit names; temperature uses c|f|k). Response: {"input":{"value":1,"from":"km","to":"m"},"category":"length","result":1000,"unit":"m","formula":"1 km = 1000 m"}. The definitions are fixed in this Worker; no external service is calle

Timestamp conversion in one GET: epoch seconds, milliseconds, microseconds, nanoseconds, ISO 8601 and RFC 2822, in any direction. curl: GET /ts?value=1760000000&from=s&to=iso (from auto|s|ms|us|ns|iso|rfc2822, default auto; to iso|s|ms|us|ns|rfc2822|date, default iso). Response: {"result":"2025-10-09T08:53:20.000Z","unix_seconds":1760000000,"unix_milliseconds":1760000000000,"iso":"2025-10-09T08:53

IPv4 CIDR calculator in one GET: network, broadcast, netmask, wildcard, first/last usable host, total and usable counts, and the address-class and scope flags. curl: GET /cidr?cidr=192.168.1.10/24 (a bare address means /32). Response: {"ip":"192.168.1.10","prefix":24,"network":"192.168.1.0","broadcast":"192.168.1.255","netmask":"255.255.255.0","first_host":"192.168.1.1","last_host":"192.168.1.254"

DNS record lookup in one GET: A, AAAA, CNAME, MX, NS, TXT, SOA or CAA for one hostname, with TTL and the record data. curl: GET /dns?name=example.com&type=A (type defaults to A). Response: {"query":{"name":"example.com","type":"A"},"count":2,"resolution":"records","records":[{"type":"A","ttl":300,"data":"93.184.216.34"}]}. resolution also reports none (name exists, no record of that type) or nxdom

SHA-256, SHA-384, SHA-512 or SHA-1 of any text in one GET, without an LLM or a local tool: pass text and get the digest as hex or base64. curl: GET /hash?text=hello (algo sha256|sha384|sha512|sha1, default sha256; encoding hex|base64, default hex; add key= for HMAC). Response: {"algo":"sha256","encoding":"hex","value":"2cf24dba5fb0a30e...","digest_bytes":32,"input_bytes":5,"mode":"digest"}. The di

A short, attributable Wikipedia summary of one article in one GET: pass a title and a language and get the title, one-line description, plain-text extract, article type, Wikidata item, page URL and thumbnail, plus the exact API URL read, the HTTP status and the text licence (CC BY-SA 4.0). curl: GET /wiki?q=Apple%20Inc.&lang=en (lang en|ja|de|fr|es|it|pt|ru|zh|ko; default en). Response: {found:tru

Barcode check digit validator in one GET: EAN-13, UPC-A, EAN-8, ISBN-10 and ISBN-13 — returns the symbology, the check digit it carries, the expected check digit and whether the number is valid. curl: GET /barcode?code=9780306406157 (spaces and hyphens are ignored). Response: {"normalized":"9780306406157","symbology":"isbn-13","length":13,"check_digit":"7","expected_check_digit":"7","valid":true,"

Uniform dice rolls in one GET: count dice with sides faces, returned as rolls[], total, notation and the possible range. crypto.getRandomValues with rejection sampling removes modulo bias; nothing is fetched or stored. curl: GET /dice?count=2&sides=6 . Response: {"notation":"2d6","rolls":[4,2],"total":6,...}. count 1..100 (default 1), sides 2..1000 (default 6); a non-integer or out-of-range value

Hex colour to RGB/HSL and WCAG contrast in one GET: pass a text colour and a background colour (3 or 6 hex digits) and get each as #rrggbb, RGB and HSL, the WCAG relative luminance, the contrast ratio and the four AA/AAA verdicts. curl: GET /color?hex=1a2b3c&against=ffffff (against defaults to ffffff). Response: {"foreground":{"hex":"#1a2b3c","rgb":{"r":26,"g":43,"b":60},"hsl":{"h":210,"s":39.5,"l

JWT decoder and expiry check in one GET: pass a JSON Web Token and get its decoded header and payload, whether exp has passed, the seconds until or since expiry, and iat/nbf/iss/sub/aud/jti where present. curl: GET /jwt?token=<JWT>. Response: {"header":{"alg":"HS256","typ":"JWT"},"payload":{"sub":"1234567890","iat":1516239022},"signature_present":true,"algorithm":"HS256","expired":null,"warnings":

Cron expression to the next run times in UTC: expr is a standard 5-field expression (minute hour day-of-month month day-of-week). One GET returns count times after from, each with run_at, unix, weekday and in_seconds, plus the parsed field values and the day-of-month/day-of-week OR rule. Nothing is scheduled or stored; all times are UTC. curl: GET /cron?expr=0+9+*+*+1-5&count=3 . Response: {"expr"

IPv4 and IPv6 address inspector: one GET takes one address and returns its canonical and fully expanded form, its decimal integer and hex value, its reverse-DNS name (in-addr.arpa or ip6.arpa), and the special-purpose ranges it belongs to — private, loopback, link-local, multicast, documentation, carrier-grade NAT, unique-local, NAT64, 6to4, Teredo — as scope, flags and special_ranges. An IPv4-map

Pick random items from a list in one GET: count items from the items you pass, uniform, by default without replacement. Returns picked[] and the 0-based indices[], drawn with crypto.getRandomValues and rejection sampling (Fisher-Yates for unique draws). Nothing is fetched or stored. curl: GET /pick?items=alice,bob,carol&count=2 . Response: {"picked":["carol","alice"],"indices":[2,0],"unique":true,

Base64 encode or decode text in one GET, with URL-safe output and the byte counts. Returns result, action, bytes, result_chars and sha256. Decoding accepts standard and URL-safe alphabets with or without padding and returns UTF-8 text only; invalid Base64 or non-UTF-8 bytes are 400 before payment. curl: GET /base64?data=hello&action=encode . Response: {"result":"aGVsbG8=","bytes":5,...}. data at m

Check an IBAN before you store it or send a payout instruction: one GET returns the normalised IBAN and its groups of four, whether the two check digits pass MOD-97, whether the length matches the national length for the SEPA countries in the built-in table, the country code and the BBAN - each check reported separately, so a typo is visible instead of a bare false. Everything is computed from the

Canonicalize JSON before you hash, compare or sign it: one POST takes a JSON string or any JSON value and returns the RFC 8785 (JCS) form, its SHA-256 and its UTF-8 byte length. Object keys are ordered by UTF-16 code units, strings use minimal escaping, numbers use ECMAScript Number::toString, and arrays keep their order. Duplicate keys, NaN, Infinity, trailing commas and a lone surrogate are refu

What Content-Type is this file? One GET maps one file extension (ext=json, with or without the dot) or one media type (type=application/json) to the canonical media type, its known extensions, the usual charset, whether it is usually compressed in transit, and its top-level category. Unknown but well-formed values are 200 with found=false. The table is bundled in this Worker; no fetch, no storage,

Is this ISIN well formed? One GET applies the ISO 6166 check digit and returns valid, the supplied and expected check digit, the checksum total, the country code and name, and the 9-character NSIN. Malformed input is 400 before payment; a wrong check digit is 200 with valid=false. The algorithm is bundled in this Worker; no registry is queried, nothing is stored and the query is not logged. A purc

Is this string mojibake, and can it be put back? One POST takes text you already hold and returns a verdict (clean, suspect, confirmed, unknown), the evidence (U+FFFD positions, C1 controls, half-width katakana ratio, non-ASCII ratio, UTF-8 round-trip, hint match) and up to five ranked candidates. Each candidate names the recovered original encoding and the decoder that broke it, a confidence, whe

OHLCV candles for one crypto pair from Coinbase Exchange in one GET: time, open, high, low, close and volume, newest first, with the source URL and fetch time. curl: GET /candles?pair=BTC-USD&granularity=3600&limit=24 (granularity 60|300|900|3600|21600|86400 seconds, default 3600; limit 1-300, default 24; pair defaults to BTC-USD). Response: {"pair":"BTC-USD","granularity_seconds":3600,"count":24,

Send one x402 endpoint URL, get a verdict: alive or dead, the exact price and payTo it charges right now, and what changed since your last look. One GET, no key. Agents call this before paying someone else. The call answers all three: alive (with the reason when it is not), the probe facts (HTTP status, latency, redirects, bytes, cutoff), the exact 402 the target serves right now (amount, asset, n

See what moved in the x402 catalogue over the period you choose: for every field, the value before and after, the observation time and the target it belongs to — plus where observation stopped, where it resumed and which cycles are missing. One GET, one delivery, read-only, no live upstream call. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, a

The whole period in one call: up to 100 counted units of detected change from the stored x402 catalogue observations. One unit = one target x one field x one detected change inside the period you pass. The response states units_requested, units_delivered and the unit definition, and when fewer units exist it says why — separating fields that were observed and did not change from fields whose targe

Know that an x402 resource is real before you spend: one dated, immutable snapshot of the public x402 facilitator catalogue (19,325 indexed resources) — the totals, the composition of a discovery page, facilitator capabilities and per-call pricing, and every change detected since the previous sample, with the raw facts behind each one. One GET, one delivery, read-only, no live upstream call, so th

Public holidays for one country and year in one GET: the date, the local-language name, the English name, the types, the weekday and how many days from today each one falls. curl: GET /holidays?country=JP&year=2026 (country is a two-letter ISO 3166-1 code; year defaults to this year). Response: {"country":"JP","year":2026,"count":16,"holidays":[{"date":"2026-01-01","local_name":"元日","name":"New Ye

Stop opening five explorers to price one transaction: one GET returns what each chain is charging for gas right now — for base, eth, arbitrum, optimism and polygon: the current gas price in gwei (with the raw wei the RPC returned), the latest block's base fee, the priority fee a 50th-percentile transaction actually paid across the last five blocks, the next block's base fee under the EIP-1559 form

URL inspector: one GET takes one absolute http(s) URL and returns its scheme, host, port, origin, path, path segments, every query parameter as name/value pairs (duplicates preserved), fragment and normalized href. It also reports has_credentials and password_present but never returns the password. curl: GET /url?url=https%3A%2F%2Fexample.com%2Fa%3Fx%3D1 . Nothing is fetched, DNS-resolved or store