Build & verify

x402 Service Conformance

Help your agent inspect an x402 service’s protocol and discovery setup, with specific findings and measured limits.

You choose the task. Your agent calls Mekler and brings the result back to your conversation or workflow.

No Mekler workspace account required. Follow the setup guide for your assistant.

Browse scanned services and grade history →

Catalog search and listing details are free. Domain proof lets an operator hide a listing or suppress branding; it never changes a grade.

What your agent can do

Inspect an x402 service

Diagnose x402 protocol, request-example schemas and discovery consistency with an asynchronous conformance scan

0.05 USDC per completed scan

Paid only. No free trial for this operation.

Use this service →

This operation needs paid setup. New to Mekler? Start with a free sample task →

Know before you use it

Paid delivery verification
Safety or quality certification
Private networks, login, arbitrary request bodies or target credentials
Independent chain indexing, universal adoption coverage and automatic publication of unreviewed target identities

Data handling

Storage: Encrypted job state and artifacts. No raw target responses, customer inputs, payment proofs or private identifiers in logs or public projections.
Retention: Reports are public for 24 hours; encrypted report artifacts expire after two days. The active encrypted catalog snapshot has no expiry. Replaced snapshots are marked retired and expire after two days; recovery prunes old events and sweeps abandoned snapshots. Paid catalog results expire after 31 days with 30 day recovery. Grade events retain 30 days or 50000 events; per-listing history retains the latest 100 observations. Job/idempotency records retain 90 days; payment replay ledger remains separate.
Public: Fixed diagnostic reports and opaque catalog identities by default; business attribution only after identity review. Origin-derived branding claims are labeled unverified and can be suppressed by a verified owner. No raw target bodies, contacts, payout addresses or private ownership credentials.
Directory: Only reviewed business wording and reviewed route paths are public. Unreviewed imports remain private. Raw source responses, target bodies, contacts, payout addresses and owner credentials stay private. Free history follows current suppression.
Owner workflows: Private contacts are stored separately from public catalog snapshots and scanner access. Verified contacts retain for the original grant plus 30 days; correction requests 90 days; email outbox 30 days. Email acceptance is not delivery; ambiguous sends are retained without blind replay. No contact/code/credential in URLs or logs.

Input example and exact contract

{
  "origin": "https://api.mekler.ai",
  "quote_mode": "fast"
}

API reference: input, output and error schemas →

Example output

{
  "checks_version": "mekler-2026-10-07.1",
  "linter": {
    "score": 89,
    "grade": "B",
    "categories": {
      "protocol": 100,
      "docs": 68,
      "directory": 100
    },
    "evaluated": 20,
    "total": 25,
    "provisional": true,
    "rules_version": "mekler-2026-10-07.1"
  },
  "compliance": {
    "score": 100,
    "grade": "A",
    "evaluated": 14,
    "total": 14,
    "provisional": false,
    "rules_version": "mekler-2026-10-07.1"
  },
  "findings": [
    {
      "id": "P1",
      "title": "http-reachable",
      "severity": "critical",
      "category": "protocol",
      "status": "pass",
      "evidence": "criterion_satisfied",
      "fix": "Serve a reachable public HTTP endpoint."
    }
  ],
  "coverage": {
    "paid_routes_probed": 1,
    "head_observations": 1,
    "chain_checks": "not_evaluated",
    "delivery_verified": false,
    "raw_content_published": false
  },
  "report_id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
  "scanned_at": 1791331200,
  "expires_at": 1791417600,
  "diagnostics": {
    "version": "mekler-inputs-2026-10-19.1",
    "summary": {
      "pass": 1,
      "fail": 0,
      "warn": 0,
      "unknown": 0,
      "skip": 0
    },
    "findings": [
      {
        "id": "E1",
        "subject": "operation_01",
        "title": "Request example satisfies its schema",
        "status": "pass",
        "evidence": "example_matches_supported_schema",
        "fix": "Publish an application/json example that satisfies the declared request schema, including every required field."
      }
    ],
    "examples_replayed": false,
    "paid_delivery_verified": false
  }
}

Calling, result interpretation and recovery

Calling

Endpoint

POST /v1/services/conformance/scan-origin

Content type

application/json

Input

Public origin and optional paths. With quote_mode fast, unsigned input returns 402 without starting work. Resend the unchanged body with PAYMENT-SIGNATURE; save the returned job_id and recovery_capability, then poll GET retrieve-scan-status using X-Mekler-Scan-Capability. Fast mode may omit idempotency_key; the original proof identifies retries. Without fast mode, supply a random idempotency_key, retain the initial 202 capability, poll until result-ready, then request a quote and pay using the same body and capability.

Free reads

GET /v1/services/conformance/retrieve-scan-status
GET /v1/services/conformance/retrieve-scan-report
GET /v1/services/conformance/list-conformance-checks
GET /v1/services/listings/search-listings
GET /v1/services/listings/retrieve-listing
GET /v1/services/listings/list-categories
GET /v1/services/listings/list-networks
GET /v1/services/listings/list-offer-changes
GET /v1/services/health/retrieve-listing-history
GET /v1/services/health/retrieve-health-checks
GET /v1/services/health/summarize-directory-status

Interpret the result

Linter: 50/35/15 protocol/docs/ecosystem weighting, Mekler bands and critical failure cap.
Compliance: Percent of evaluated applicable checks; fewer than 10 is ungraded, EVM signing-domain failure caps at C.
Coverage: Unknown evidence is not failure or measured zero. D1-D4 use one observed resource and label directory/Bazaar source, observation time and 30 day external activity coverage; they do not independently establish finalized chain history. D5 stays unknown while the former official registry is not published.
Billing: Successful reports are stored before settlement and withheld until finalized payment. 202 is pending, not fulfillment. Recovery never buys a replacement.
Privacy: Opaque report IDs; target attribution withheld pending identity review.
Diagnostics: E1-E6 are additive offline schema and unsigned-observation diagnostics, with version, fixed reasons, opaque subject numbering, bounds and pass/fail/warn/unknown/skip summary. Patterns, formats, external references, recursive schemas and unsupported keywords remain unknown; examples are never replayed. A pass is not paid-delivery, semantic or safety verification. Older reports can omit this field.
Directory: Imported entries start ungraded and unverified; source claims are labeled. Health uses rolling 1/7/30/90-day completed-cycle windows and excludes unknown observations. Daily rollups persist; raw observations retain 30 days. No independent chain index or paid delivery certificate is supplied in this release.

Limits

Request bytes

65536

Max paths

Scan seconds

Queue start seconds

Response capture bytes

65536

Per origin concurrency

Unpaid admission

20 scans per client and origin per UTC day; 1000 globally. Default in-flight identical scans share work. Fast jobs bind one payment identity; unsigned fast probes create no work.

Semantics

Public IPs and standard HTTP(S) ports only. No payment or credentials sent to targets.
Cached reports expire 24 hours after the scan; idempotency survives at least 90 days.

Openapi document bytes

4194304

Catalog

Read requests per ip per minute: 30
Ownership requests per ip per minute: 10
Catalog capacity: 20000
Export records: 10000
Grade events per page: 1000
Search cursor seconds: 86400
Event retention days: 30
Event retention cap: 50000
Grade history per listing: 100
Ownership seconds: 3600
Control days: 90
Recheck days: 7

Payment and recovery

Network

Solana mainnet or Base mainnet

Networks

solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp
eip155:8453

Protocol

x402 v2

Price usdc

0.05

Flow

Optional quote-first-async; default compute-then-pay. Both settle only after durable successful output.

Retry

Retain the original body, capability and payment proof; never sign a second payment for the same job.

Quote

Fast mode returns a payable first 402 for any valid input; default quotes require result-ready and capability. Empty input remains nonpayable preflight.

Authentication

No API key. Recovery capability protects a private job; the buyer signs its chosen payment offer.

Expiry

Queue starts within 30 seconds and scanning takes at most 75 seconds. Quotes last 120 seconds; Base authorization and Solana blockhash can expire sooner. Recheck before initiation; terminal expired-uncharged jobs never replace their proof. A new scan requires a fresh purchase only after an explicit terminal uncharged outcome. Once settlement may have started, retain the same proof through finality, including after expiry.

Operation prices usdc

Scanorigin: 0.05
Exportlistings: 0.25
Listgradechanges: 0.01

Catalog recovery

A genuine first quote creates no work. After proof verification, a fresh idempotency key pins one result before settlement; retain it and the exact original proof for 30 day recovery. Do not pay again on 202, timeout or uncertain settlement.

Price scope

Selected operation: scanOrigin

What your agent can do

Export listings

Export the scanned x402 service catalog with grades, history and provenance

0.25 USDC per catalog export

Paid only. No free trial for this operation.

Use this service →

This operation needs paid setup. New to Mekler? Start with a free sample task →

Know before you use it

Paid delivery verification
Safety or quality certification
Private networks, login, arbitrary request bodies or target credentials
Independent chain indexing, universal adoption coverage and automatic publication of unreviewed target identities

Data handling

Storage: Encrypted job state and artifacts. No raw target responses, customer inputs, payment proofs or private identifiers in logs or public projections.
Retention: Reports are public for 24 hours; encrypted report artifacts expire after two days. The active encrypted catalog snapshot has no expiry. Replaced snapshots are marked retired and expire after two days; recovery prunes old events and sweeps abandoned snapshots. Paid catalog results expire after 31 days with 30 day recovery. Grade events retain 30 days or 50000 events; per-listing history retains the latest 100 observations. Job/idempotency records retain 90 days; payment replay ledger remains separate.
Public: Fixed diagnostic reports and opaque catalog identities by default; business attribution only after identity review. Origin-derived branding claims are labeled unverified and can be suppressed by a verified owner. No raw target bodies, contacts, payout addresses or private ownership credentials.
Directory: Only reviewed business wording and reviewed route paths are public. Unreviewed imports remain private. Raw source responses, target bodies, contacts, payout addresses and owner credentials stay private. Free history follows current suppression.
Owner workflows: Private contacts are stored separately from public catalog snapshots and scanner access. Verified contacts retain for the original grant plus 30 days; correction requests 90 days; email outbox 30 days. Email acceptance is not delivery; ambiguous sends are retained without blind replay. No contact/code/credential in URLs or logs.

Input example and exact contract

{
  "idempotency_key": "example-export-request-0001"
}

API reference: input, output and error schemas →

Example output

{
  "status": "ok",
  "content_encoding": "gzip+base64",
  "content_type": "application/json",
  "content": "H4sIAAAAAAAA/01QXU7DMAy+ipXnboLXcgQEF0CochNvDcvsKHaGKsTdcTskyEsU+/vL9xUi1jA+PvgZwrlhomnJatLWKUrpV9YwvgWZldqN0oQWfmF+a5RG4X0IxRmZzxvUX7XJjRg5UhjDC10KtUOUa+1GCe5KaFlYnwDrDk4wd81MqpATsWVbwRcfFHccCJfV/Rp13TSfiSrYQpA5lp6cfnf5Lw5/KeBzIYaN7BnhhNE6Ftg/oUd4FZfKLR0qNrdNaKhkA0Rh8yggDeaGnDZuyZFY3VdBe60lUzpuPTBWXcS2dkavUQ2texlBLr41MSz73FrniN5CGE9YlL5/ANbTOd9+AQAA",
  "sha256": "1b14bb641af5ff6e993a76f10685f0364b208aac7a9515e4449468f420de3bd3",
  "records": 0,
  "total": 0,
  "cap": 10000,
  "truncated": false,
  "snapshot_at": 0
}

Calling, result interpretation and recovery

Calling

Endpoint

POST /v1/services/conformance/scan-origin

Content type

application/json

Input

Free reads

GET /v1/services/conformance/retrieve-scan-status
GET /v1/services/conformance/retrieve-scan-report
GET /v1/services/conformance/list-conformance-checks
GET /v1/services/listings/search-listings
GET /v1/services/listings/retrieve-listing
GET /v1/services/listings/list-categories
GET /v1/services/listings/list-networks
GET /v1/services/listings/list-offer-changes
GET /v1/services/health/retrieve-listing-history
GET /v1/services/health/retrieve-health-checks
GET /v1/services/health/summarize-directory-status

Interpret the result

Linter: 50/35/15 protocol/docs/ecosystem weighting, Mekler bands and critical failure cap.
Compliance: Percent of evaluated applicable checks; fewer than 10 is ungraded, EVM signing-domain failure caps at C.
Coverage: Unknown evidence is not failure or measured zero. D1-D4 use one observed resource and label directory/Bazaar source, observation time and 30 day external activity coverage; they do not independently establish finalized chain history. D5 stays unknown while the former official registry is not published.
Billing: Successful reports are stored before settlement and withheld until finalized payment. 202 is pending, not fulfillment. Recovery never buys a replacement.
Privacy: Opaque report IDs; target attribution withheld pending identity review.
Diagnostics: E1-E6 are additive offline schema and unsigned-observation diagnostics, with version, fixed reasons, opaque subject numbering, bounds and pass/fail/warn/unknown/skip summary. Patterns, formats, external references, recursive schemas and unsupported keywords remain unknown; examples are never replayed. A pass is not paid-delivery, semantic or safety verification. Older reports can omit this field.
Directory: Imported entries start ungraded and unverified; source claims are labeled. Health uses rolling 1/7/30/90-day completed-cycle windows and excludes unknown observations. Daily rollups persist; raw observations retain 30 days. No independent chain index or paid delivery certificate is supplied in this release.

Limits

Request bytes

65536

Max paths

Scan seconds

Queue start seconds

Response capture bytes

65536

Per origin concurrency

Unpaid admission

20 scans per client and origin per UTC day; 1000 globally. Default in-flight identical scans share work. Fast jobs bind one payment identity; unsigned fast probes create no work.

Semantics

Public IPs and standard HTTP(S) ports only. No payment or credentials sent to targets.
Cached reports expire 24 hours after the scan; idempotency survives at least 90 days.

Openapi document bytes

4194304

Catalog

Read requests per ip per minute: 30
Ownership requests per ip per minute: 10
Catalog capacity: 20000
Export records: 10000
Grade events per page: 1000
Search cursor seconds: 86400
Event retention days: 30
Event retention cap: 50000
Grade history per listing: 100
Ownership seconds: 3600
Control days: 90
Recheck days: 7

Payment and recovery

Network

Solana mainnet or Base mainnet

Networks

solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp
eip155:8453

Protocol

x402 v2

Price usdc

0.25

Flow

Optional quote-first-async; default compute-then-pay. Both settle only after durable successful output.

Retry

Retain the original body, capability and payment proof; never sign a second payment for the same job.

Quote

Fast mode returns a payable first 402 for any valid input; default quotes require result-ready and capability. Empty input remains nonpayable preflight.

Authentication

No API key. Recovery capability protects a private job; the buyer signs its chosen payment offer.

Expiry

Operation prices usdc

Scanorigin: 0.05
Exportlistings: 0.25
Listgradechanges: 0.01

Catalog recovery

Price scope

Selected operation: exportListings

What your agent can do

List grade changes

Read incremental x402 service grade changes with stable cursors

0.01 USDC per grade-change page

Paid only. No free trial for this operation.

Use this service →

This operation needs paid setup. New to Mekler? Start with a free sample task →

Know before you use it

Paid delivery verification
Safety or quality certification
Private networks, login, arbitrary request bodies or target credentials
Independent chain indexing, universal adoption coverage and automatic publication of unreviewed target identities

Data handling

Storage: Encrypted job state and artifacts. No raw target responses, customer inputs, payment proofs or private identifiers in logs or public projections.
Retention: Reports are public for 24 hours; encrypted report artifacts expire after two days. The active encrypted catalog snapshot has no expiry. Replaced snapshots are marked retired and expire after two days; recovery prunes old events and sweeps abandoned snapshots. Paid catalog results expire after 31 days with 30 day recovery. Grade events retain 30 days or 50000 events; per-listing history retains the latest 100 observations. Job/idempotency records retain 90 days; payment replay ledger remains separate.
Public: Fixed diagnostic reports and opaque catalog identities by default; business attribution only after identity review. Origin-derived branding claims are labeled unverified and can be suppressed by a verified owner. No raw target bodies, contacts, payout addresses or private ownership credentials.
Directory: Only reviewed business wording and reviewed route paths are public. Unreviewed imports remain private. Raw source responses, target bodies, contacts, payout addresses and owner credentials stay private. Free history follows current suppression.
Owner workflows: Private contacts are stored separately from public catalog snapshots and scanner access. Verified contacts retain for the original grant plus 30 days; correction requests 90 days; email outbox 30 days. Email acceptance is not delivery; ambiguous sends are retained without blind replay. No contact/code/credential in URLs or logs.

Input example and exact contract

{
  "idempotency_key": "example-grade-request-0001",
  "limit": 200
}

API reference: input, output and error schemas →

Example output

{
  "status": "ok",
  "events": [],
  "has_more": false,
  "next_cursor": "synthetic-cursor-replace-with-actual-response",
  "watermark": 0,
  "retention_days": 30,
  "event_cap": 50000,
  "history_floor": 0
}

Calling, result interpretation and recovery

Calling

Endpoint

POST /v1/services/conformance/scan-origin

Content type

application/json

Input

Free reads

GET /v1/services/conformance/retrieve-scan-status
GET /v1/services/conformance/retrieve-scan-report
GET /v1/services/conformance/list-conformance-checks
GET /v1/services/listings/search-listings
GET /v1/services/listings/retrieve-listing
GET /v1/services/listings/list-categories
GET /v1/services/listings/list-networks
GET /v1/services/listings/list-offer-changes
GET /v1/services/health/retrieve-listing-history
GET /v1/services/health/retrieve-health-checks
GET /v1/services/health/summarize-directory-status

Interpret the result

Linter: 50/35/15 protocol/docs/ecosystem weighting, Mekler bands and critical failure cap.
Compliance: Percent of evaluated applicable checks; fewer than 10 is ungraded, EVM signing-domain failure caps at C.
Coverage: Unknown evidence is not failure or measured zero. D1-D4 use one observed resource and label directory/Bazaar source, observation time and 30 day external activity coverage; they do not independently establish finalized chain history. D5 stays unknown while the former official registry is not published.
Billing: Successful reports are stored before settlement and withheld until finalized payment. 202 is pending, not fulfillment. Recovery never buys a replacement.
Privacy: Opaque report IDs; target attribution withheld pending identity review.
Diagnostics: E1-E6 are additive offline schema and unsigned-observation diagnostics, with version, fixed reasons, opaque subject numbering, bounds and pass/fail/warn/unknown/skip summary. Patterns, formats, external references, recursive schemas and unsupported keywords remain unknown; examples are never replayed. A pass is not paid-delivery, semantic or safety verification. Older reports can omit this field.
Directory: Imported entries start ungraded and unverified; source claims are labeled. Health uses rolling 1/7/30/90-day completed-cycle windows and excludes unknown observations. Daily rollups persist; raw observations retain 30 days. No independent chain index or paid delivery certificate is supplied in this release.

Limits

Request bytes

65536

Max paths

Scan seconds

Queue start seconds

Response capture bytes

65536

Per origin concurrency

Unpaid admission

20 scans per client and origin per UTC day; 1000 globally. Default in-flight identical scans share work. Fast jobs bind one payment identity; unsigned fast probes create no work.

Semantics

Public IPs and standard HTTP(S) ports only. No payment or credentials sent to targets.
Cached reports expire 24 hours after the scan; idempotency survives at least 90 days.

Openapi document bytes

4194304

Catalog

Read requests per ip per minute: 30
Ownership requests per ip per minute: 10
Catalog capacity: 20000
Export records: 10000
Grade events per page: 1000
Search cursor seconds: 86400
Event retention days: 30
Event retention cap: 50000
Grade history per listing: 100
Ownership seconds: 3600
Control days: 90
Recheck days: 7

Payment and recovery

Network

Solana mainnet or Base mainnet

Networks

solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp
eip155:8453

Protocol

x402 v2

Price usdc

0.01

Flow

Optional quote-first-async; default compute-then-pay. Both settle only after durable successful output.

Retry

Retain the original body, capability and payment proof; never sign a second payment for the same job.

Quote

Fast mode returns a payable first 402 for any valid input; default quotes require result-ready and capability. Empty input remains nonpayable preflight.

Authentication

No API key. Recovery capability protects a private job; the buyer signs its chosen payment offer.

Expiry

Operation prices usdc

Scanorigin: 0.05
Exportlistings: 0.25
Listgradechanges: 0.01

Catalog recovery

Price scope

Selected operation: listGradeChanges