Audit a webhook delivery log. Reports events that never succeeded and whether they still have retries or have exhausted them and are lost, events delivered more than once so the receiver had to be idempotent, retries issued after a success, and attempts beyond the declared limit. No payload is inspected and no signature or secret is handled.

Everything a reviewed public page declares, in one call and one fetch: title, meta and Open Graph, canonical, robots directive, JSON-LD with its schema.org types, resolved links with an external count, tables, content fingerprints, and readable Markdown. Replaces six separate extraction calls, and adds the cross-checks none of them can make alone — a canonical that disagrees with the URL you asked for, a page declaring noindex, missing structured data.

Find out whether your wallet configuration can satisfy a challenge, option by option. For each accepted payment it says usable or not and why: a network you are not configured for, an asset you do not hold, a scheme you have not implemented, or an amount above your ceiling. Names the cheapest usable option, because a buyer facing several will otherwise take the first one listed. Nothing is paid.

Check that an advertised catalogue matches the challenges actually served. Reports a resource advertised and not served - a dead listing a buyer follows to nothing - and a resource served and not advertised, which nobody can discover. Compares advertised price, network, asset and payee against what the challenge really says, since a buyer budgeting from a listing budgets wrongly when they disagree. Nothing is paid.

Audit a whole set of captured 402 challenges in one call. Per challenge it reports whether a payment can be constructed, which blocking defects stand in the way, whether the resource is bound to the URL it came from, the cheapest accepted amount and the networks offered. A challenge supplied without its URL has its binding reported as unchecked rather than assumed sound. Nothing is paid.

Decode an x402 payment challenge before paying: give it the raw 402 body or payment-required header, as JSON or base64, and get back the version, resource, and every accepted payment normalised to scheme, network, asset, amount and payTo. Names what is wrong with named warnings — bad amount, unrecognised network, invalid payTo, unsupported scheme, missing input or output schema — and returns the declared Bazaar schemas. No network call, no payment sent.

Is this paid endpoint answering right now? Returns whether it serves a payment challenge, how many well-formed priced offers it carries, which warnings would actually break a payment as opposed to merely making the call harder to construct, and a single payable_now flag. Reports only what was observed; it makes no judgement about the seller.

Find out what an x402 endpoint will charge before you pay it. Probes the endpoint, reads the challenge from the header or the body, and returns the decoded price, network, asset and payTo plus the declared input and output schemas. Never sends a payment. Only reviewed origins are reachable, and a redirect is refused rather than followed.

Audit a merchant estate across all its endpoints at once. The findings that matter are the ones no single-challenge check can see: endpoints paying different addresses, sitting on different networks, or declaring different protocol versions. Also checks each challenge against a contract you declare - expected payee, network, asset, host and price ceiling. Nothing is fetched, so this works on a merchant you do not control.

Is this merchant safe to depend on? Audits up to ten x402 endpoints in one call and returns a verdict — ready, partially ready or not ready — with the specific blockers. Checks each endpoint serves a payable challenge with well-formed terms and a declared input schema, and adds the cross-endpoint check no single probe can make: whether every endpoint pays the same recipient. Never pays anything.

Did this paid endpoint change its terms since you last looked? Give it a previous challenge as the baseline and it returns every difference: price changes with old and new amounts, offers added or removed, a protocol version change, and a payee_changed flag when a new recipient address appears. Never pays the endpoint.

Compare two snapshots of captured challenges and report every change of payee. A payee change is the most consequential thing a challenge can do, because paying the new one sends funds to a different recipient. Specifically flags a new payee sharing its first six and last four characters with the old one, which passes a human comparison and is a different account. Reports a change to confirm, never an accusation. Nothing is paid.

Decide whether a captured 402 challenge can actually be paid. Separates defects that stop a payment being constructed from ones that merely make the call harder to get right, and checks the resource is bound to the endpoint that served it - a challenge naming a different resource would, if paid, satisfy a requirement for something else. Also names the price spread when several payments are accepted. Nothing is fetched and nothing is paid.

Compare two snapshots of captured challenges and report every price movement per resource. Amounts are compared as exact integers, so a large atomic amount is never collapsed by floating point. Reports a resource that was priced before and is absent after, a rise beyond a tolerance you set, and a new resource that appeared. Nothing is paid.

Check that every challenge you captured names the endpoint that served it. A challenge naming a different resource would, if paid, satisfy a requirement for something else. A host mismatch is reported differently from a path mismatch, the first being the stronger signal. Also reports a non-https resource and, under version 2, a bare string resource, where a client reading resource.url gets undefined and stops checking the binding. Nothing is fetched and nothing is paid.

Find out what a seller’s change breaks for one specific buyer. You declare which resources you call and what your wallet supports; changes to anything else are counted and set aside, because blocking your own upgrade on somebody else’s change is the mistake this prevents. Reports a resource you use becoming unpayable by you, moving to an unsupported version, changing payee, or rising in price. Nothing is paid.

Find out which x402 versions you are actually dealing with across a set of sellers. Reports challenges declaring a version you do not support, challenges declaring no version at all - where how to read the rest is a guess - and a set spanning more than one version, which means your client must implement each of them at once. Nothing is paid.

Report what a YAML reader will do with the text supplied, as distinct from whether the data is correct. Reports a duplicate key, which most readers accept while silently keeping the last; an unquoted YAML 1.1 boolean word such as on, off, yes or no, which arrives as a boolean rather than text; a leading zero read as octal; and a two-part version read as a float, where a patch number would change the type. Anchors and merge keys are refused with the line.