x402-crosschain-gas

Barcode check digit validator in one GET: EAN-13, UPC-A, EAN-8, ISBN-10 and ISBN-13 — returns the symbology, the check digit it carries, the expected check digit and whether the number is valid. curl: GET /barcode?code=9780306406157 (spaces and hyphens are ignored). Response: {"normalized":"9780306406157","symbology":"isbn-13","length":13,"check_digit":"7","expected_check_digit":"7","valid":true,"gs1_prefix":"978","isbn":{"format":"isbn-13","prefix":"978"}}. ISBN-10 accepts a trailing X. The verdict is check-digit arithmetic on the number you pass, not a registry lookup: a valid code does not prove that the product or book exists. Computed inside the Worker from the input; no upstream call, no account, no key. 0.001 USDC, one GET, one delivery. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Base64 encode or decode text in one GET, with URL-safe output and the byte counts. Returns result, action, bytes, result_chars and sha256. Decoding accepts standard and URL-safe alphabets with or without padding and returns UTF-8 text only; invalid Base64 or non-UTF-8 bytes are 400 before payment. curl: GET /base64?data=hello&action=encode . Response: {"result":"aGVsbG8=","bytes":5,...}. data at most 16384 characters. No encryption, no binary delivery, no storage. No keys, no account, one GET, one delivery — 0.001 USDC. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

OHLCV candles for one crypto pair from Coinbase Exchange in one GET: time, open, high, low, close and volume, newest first, with the source URL and fetch time. curl: GET /candles?pair=BTC-USD&granularity=3600&limit=24 (granularity 60|300|900|3600|21600|86400 seconds, default 3600; limit 1-300, default 24; pair defaults to BTC-USD). Response: {"pair":"BTC-USD","granularity_seconds":3600,"count":24,"candles":[{"unix":1792670400,"time":"2026-10-22T12:00:00.000Z","open":81656.69,"high":81816.21,"low":81605.44,"close":81746.7,"volume":95.50529109}],"source":{"name":"Coinbase Exchange","http_status":200,"latency_ms":210}}. The exchange is read once after payment; a pair it does not list is a 502 and is not charged. 0.005 USDC, no account, no key, one GET, one delivery. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

The observed x402 catalogue is mass-produced: one GET returns every repeating description template, how many resources share it, the axis it varies along and a representative example — 30 families, largest 80 members, computed from 2562 observed resources (2400 with a description). curl: GET /catalog/families (optional min_members>=2, axis=tld|selector|domain|number|url|literal|token|none, limit=1-200). Response: {"count":30,"max_members":80,"axis_counts":{"selector":1,"token":17,"none":10,"tld":1,"domain":1},"families":[{"family_id":"fam-001","members":80,"axis":"selector","axis_values":["sendgrid._domainkey.","namecheap._domainkey.","marketo._domainkey."],"template":"dkim public key selector <q> domain looks <var> <var> <var> <var> <var> <var> <var> <var> <var> <var> <var> <var> <var> ","price_usd":{"min":0.01,"median":0.01,"max":0.01},"representatives":[{"resource":"https://dns.intel.rallylive.ca/dns/dkim/ionos","description":"DKIM public key for selector \"ionos\" of a domain: look

See what moved in the x402 catalogue over the period you choose: for every field, the value before and after, the observation time and the target it belongs to — plus where observation stopped, where it resumed and which cycles are missing. One GET, one delivery, read-only, no live upstream call. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

The whole period in one call: up to 100 counted units of detected change from the stored x402 catalogue observations. One unit = one target x one field x one detected change inside the period you pass. The response states units_requested, units_delivered and the unit definition, and when fewer units exist it says why — separating fields that were observed and did not change from fields whose target is missing observation cycles. One GET, one delivery, read-only, no live upstream call. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Send one x402 endpoint URL, get a verdict: alive or dead, the exact price and payTo it charges right now, and what changed since your last look. One GET, no key. Agents call this before paying someone else. The call answers all three: alive (with the reason when it is not), the probe facts (HTTP status, latency, redirects, bytes, cutoff), the exact 402 the target serves right now (amount, asset, network, payTo, maxTimeoutSeconds, required fields), response_shape (what it actually answered), history (uptime reached/of, challenges seen, changes_since_previous) and delivery_evidence. The target is fetched once per paid call, with no payment header, so the 402 you read is the one a buyer faces. By specification: a 5-second timeout, at most 3 redirects, a 64 KB body cutoff, and a refusal — before any payment — of internal, private or link-local hosts, non-web ports, URLs over 2048 characters and URLs that embed credentials. One GET, one probe, one delivery. A purchase is two calls by design

IPv4 CIDR calculator in one GET: network, broadcast, netmask, wildcard, first/last usable host, total and usable counts, and the address-class and scope flags. curl: GET /cidr?cidr=192.168.1.10/24 (a bare address means /32). Response: {"ip":"192.168.1.10","prefix":24,"network":"192.168.1.0","broadcast":"192.168.1.255","netmask":"255.255.255.0","first_host":"192.168.1.1","last_host":"192.168.1.254","total_addresses":256,"usable_hosts":254,"is_private":true}. Computed inside the Worker from the input; no upstream call, no account, no key. 0.001 USDC, one GET, one delivery. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Hex colour to RGB/HSL and WCAG contrast in one GET: pass a text colour and a background colour (3 or 6 hex digits) and get each as #rrggbb, RGB and HSL, the WCAG relative luminance, the contrast ratio and the four AA/AAA verdicts. curl: GET /color?hex=1a2b3c&against=ffffff (against defaults to ffffff). Response: {"foreground":{"hex":"#1a2b3c","rgb":{"r":26,"g":43,"b":60},"hsl":{"h":210,"s":39.5,"l":16.9}},"background":{"hex":"#ffffff"},"contrast_ratio":14.69,"wcag":{"aa_normal":true,"aa_large":true,"aaa_normal":true,"aaa_large":true}}. A missing or non-hex value, or an alpha hex (#rgba/#rrggbbaa), is refused with 400 before payment. Computed inside the Worker from the input; no upstream call, no account, no key. 0.001 USDC, one GET, one delivery. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Catch a breaking schema change before it reaches production: post one {schema, actual} JSON pair and get a compatibility report with an RFC 6901 JSON Pointer to every mismatch, the keyword that failed and the expected vs actual value. One POST, one report, supported keywords only, no upstream call. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Know whether a 402 will work with your client before you pay it: pass the URL and one GET returns whether the payment challenge is readable by x402 v2 clients (the PAYMENT-REQUIRED header), readable by v1 clients (the JSON body), or neither — and exactly which required fields are missing from the accepts[] it serves. curl: GET /compat-check?url=https://api.example.com/paid. Response: {verdict:{buyable_with_v2_client,buyable_with_v1_client,one_line,blocking[]}, v2:{readable,x402_version,network_form,missing_required[],amount_atomic,asset,pay_to}, v1:{readable,x402_version,network_form,missing_required[],amount_atomic,asset,pay_to}, header:{payment_required_present,decodes_as_base64_json}, challenge:{...the facts the target served...}}. The verdict is computed from the response the target actually serves, read once per paid call with no payment header, so it is the same 402 a buyer faces: a 5-second timeout, at most 3 redirects, a 64 KB body cutoff, and a refusal — before any payment — o

This 402 — can you tell what it returns from the type alone? Ask for any x402 URL and one GET normalises the output contract the seller actually declared into field names, types and required flags, so you can decide before you pay whether you can bind to it. curl: GET /contract?url=https://api.example.com/paid (a free sample is GET /contract/sample?url=…, and /contract/sample with no url shows this service's own /history). Response: {url, x402Version, mime, output:{fields:[{name,type,required,example}], declared, schema_only_type_example, properties_empty}, error_shape_declared, weakness:[...], fetched_at, sha256}. measured 2026-10-16 over 2433 observed x402 resources: 100% declare an output schema and 87.8% declare nothing in it but {type, example} (type 2135, example 2137); 288 declare an empty properties object; only a dozen or so name any field at all. That is the gap this report closes: it says field by field what the paid 200 will contain, or says declared:false and lists the wea

Unit conversion in one GET, without an LLM or a calculator: length, mass, volume, data and time, plus temperature. curl: GET /convert?value=1&from=km&to=m (from/to are unit names; temperature uses c|f|k). Response: {"input":{"value":1,"from":"km","to":"m"},"category":"length","result":1000,"unit":"m","formula":"1 km = 1000 m"}. The definitions are fixed in this Worker; no external service is called. Unknown units and cross-category pairs are refused with 400 before payment. 0.001 USDC, no account, no key, one GET, one delivery. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Cron expression to the next run times in UTC: expr is a standard 5-field expression (minute hour day-of-month month day-of-week). One GET returns count times after from, each with run_at, unix, weekday and in_seconds, plus the parsed field values and the day-of-month/day-of-week OR rule. Nothing is scheduled or stored; all times are UTC. curl: GET /cron?expr=0+9+*+*+1-5&count=3 . Response: {"expr":"0 9 * * 1-5","next":[{"run_at":"..."}]}. A bad expression, count or from is 400 before payment. No keys, no account, one GET, one delivery — 0.001 USDC. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Uniform dice rolls in one GET: count dice with sides faces, returned as rolls[], total, notation and the possible range. crypto.getRandomValues with rejection sampling removes modulo bias; nothing is fetched or stored. curl: GET /dice?count=2&sides=6 . Response: {"notation":"2d6","rolls":[4,2],"total":6,...}. count 1..100 (default 1), sides 2..1000 (default 6); a non-integer or out-of-range value is 400 before payment. No seed and no signed beacon; each paid call returns fresh rolls. No keys, no account, one GET, one delivery — 0.001 USDC. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

DNS record lookup in one GET: A, AAAA, CNAME, MX, NS, TXT, SOA or CAA for one hostname, with TTL and the record data. curl: GET /dns?name=example.com&type=A (type defaults to A). Response: {"query":{"name":"example.com","type":"A"},"count":2,"resolution":"records","records":[{"type":"A","ttl":300,"data":"93.184.216.34"}]}. resolution also reports none (name exists, no record of that type) or nxdomain (name does not exist); an upstream failure returns 502/503 and is not charged. 0.001 USDC, one GET, one answer. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Stop opening five explorers to price one transaction: one GET returns what each chain is charging for gas right now — for base, eth, arbitrum, optimism and polygon: the current gas price in gwei (with the raw wei the RPC returned), the latest block's base fee, the priority fee a 50th-percentile transaction actually paid across the last five blocks, the next block's base fee under the EIP-1559 formula, the block number and timestamp those numbers came from, and the public RPC that answered. curl: GET /gas?chains=base,eth (omit chains for all five; aliases like ethereum or arb work). Response: {gas:[{chain,chain_id,gas_price_gwei,base_fee_gwei,priority_fee_gwei,block:{number,timestamp},source_rpc,fetched_at}]}. Every value is a measurement from a public RPC, never an estimate: a chain no RPC answered for is listed in chains_unavailable with the reason, and a figure that could not be measured is null. Values are cached for 15 seconds, and each one carries the fetched_at of the measurement

The seller's playbook for a live x402 endpoint: the exact 402 challenge to serve (v2 header and v1 body in one response), what the facilitator /verify really checks and the balance rule that rejects a valid signature, how a settled payment becomes a delivery, delivery evidence in three independent records, how to get listed where agent buyers search, and a plain-USDC page for human buyers who will never read a 402. Delivered as the full text plus a signed, expiring PDF download link. One GET, one delivery, no live upstream call, and the free sample at /guide/sample carries the whole protocol before you pay. The same playbook also covers the receiving side: USDC on Base with no account, no KYC and no third party between you and the buyer. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

SHA-256, SHA-384, SHA-512 or SHA-1 of any text in one GET, without an LLM or a local tool: pass text and get the digest as hex or base64. curl: GET /hash?text=hello (algo sha256|sha384|sha512|sha1, default sha256; encoding hex|base64, default hex; add key= for HMAC). Response: {"algo":"sha256","encoding":"hex","value":"2cf24dba5fb0a30e...","digest_bytes":32,"input_bytes":5,"mode":"digest"}. The digest is computed once in this Worker with Web Crypto after the payment is verified; the text is not stored, logged or echoed back. Missing text, unsupported algo/encoding and text over 8192 characters are refused with 400 before payment. No keys, no account, one GET, one delivery — 0.001 USDC. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Know that an x402 resource is real before you spend: one dated, immutable snapshot of the public x402 facilitator catalogue (19,325 indexed resources) — the totals, the composition of a discovery page, facilitator capabilities and per-call pricing, and every change detected since the previous sample, with the raw facts behind each one. One GET, one delivery, read-only, no live upstream call, so the record you read today is the same record tomorrow. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Public holidays for one country and year in one GET: the date, the local-language name, the English name, the types, the weekday and how many days from today each one falls. curl: GET /holidays?country=JP&year=2026 (country is a two-letter ISO 3166-1 code; year defaults to this year). Response: {"country":"JP","year":2026,"count":16,"holidays":[{"date":"2026-01-01","local_name":"元日","name":"New Year's Day","types":["Public"],"weekday":"Thursday","global":true,"days_from_today":-290}],"upcoming":[...],"source":{"name":"Nager.Date","api":"https://date.nager.at/api/v3/PublicHolidays","fetched_at":"…"}}. Every value is read from the Nager.Date public API at the moment of the call, and the response carries the API URL and the fetched_at it came from. 0.003 USDC, no account, no key, one GET, one delivery. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 20

Check an IBAN before you store it or send a payout instruction: one GET returns the normalised IBAN and its groups of four, whether the two check digits pass MOD-97, whether the length matches the national length for the SEPA countries in the built-in table, the country code and the BBAN - each check reported separately, so a typo is visible instead of a bare false. Everything is computed from the string inside this Worker: no bank, no register, no network call, nothing stored. It does not prove that the account exists, is open, or belongs to anyone. curl: GET /iban?iban=DE89370400440532013000 . Response: {iban, formatted, valid, checks:{format,length{checked,ok,expected,actual},checksum{ok,remainder}}, country{code,sepa_length_table,sepa}, bban{value,length}, source, note, paid, delivery}. 400 missing_iban / iban_too_long / invalid_iban before any payment is verified. No keys, no account, one GET, one delivery - 0.002 USDC. A purchase is two calls by design: this first call returns 40

IPv4 and IPv6 address inspector: one GET takes one address and returns its canonical and fully expanded form, its decimal integer and hex value, its reverse-DNS name (in-addr.arpa or ip6.arpa), and the special-purpose ranges it belongs to — private, loopback, link-local, multicast, documentation, carrier-grade NAT, unique-local, NAT64, 6to4, Teredo — as scope, flags and special_ranges. An IPv4-mapped IPv6 address also returns the embedded IPv4 address and its classification. curl: GET /ip?addr=2001:db8::1 . Response: {"version":6,"canonical":"2001:db8::1","expanded":"2001:0db8:...","scope":"documentation","flags":{...}}. global means outside the special-purpose ranges checked here; it is not a claim about reachability, ownership or reputation, and no DNS query is made. A missing, malformed, over-long or zone-id address is 400 before payment and before any charge. No keys, no account, one GET, one delivery — 0.001 USDC. A purchase is two calls by design: this first call returns 402 with

Is this ISIN well formed? One GET applies the ISO 6166 check digit and returns valid, the supplied and expected check digit, the checksum total, the country code and name, and the 9-character NSIN. Malformed input is 400 before payment; a wrong check digit is 200 with valid=false. The algorithm is bundled in this Worker; no registry is queried, nothing is stored and the query is not logged. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Canonicalize JSON before you hash, compare or sign it: one POST takes a JSON string or any JSON value and returns the RFC 8785 (JCS) form, its SHA-256 and its UTF-8 byte length. Object keys are ordered by UTF-16 code units, strings use minimal escaping, numbers use ECMAScript Number::toString, and arrays keep their order. Duplicate keys, NaN, Infinity, trailing commas and a lone surrogate are refused with 400 before any payment; integers outside +-2^53 come back with a number_precision_loss warning instead of being silently rounded. input_sha256 is the hash of the json as supplied, so it differs from sha256 when only whitespace or key order changed. The value is not stored, no URL is fetched and nothing is signed or transferred. curl: POST /json-canonical -H 'content-type: application/json' -d '{"json":"{\"b\":2,\"a\":1}"}' . Response: {canonical, sha256, bytes, input_sha256, warnings[], canonicalization, limits, paid, delivery}. No keys, no account, one POST, one delivery - 0.002 USDC

JWT decoder and expiry check in one GET: pass a JSON Web Token and get its decoded header and payload, whether exp has passed, the seconds until or since expiry, and iat/nbf/iss/sub/aud/jti where present. curl: GET /jwt?token=<JWT>. Response: {"header":{"alg":"HS256","typ":"JWT"},"payload":{"sub":"1234567890","iat":1516239022},"signature_present":true,"algorithm":"HS256","expired":null,"warnings":["signature_not_verified"]}. The signature is NOT verified and the raw token is never echoed. A missing token, a value that is not three dot-separated parts, invalid base64url/JSON, or over 8192 characters is refused with 400 before payment. Computed inside the Worker from the input; no upstream call, no account, no key. 0.001 USDC, one GET, one delivery. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Look up a legal entity in the GLEIF register: the official LEI, the legal name, the registered address, the jurisdiction and the registration status in one GET. curl: GET /lei?q=Apple%20Inc (a company name and a 20-character LEI both work: ?q=HWUPKR0MPOU8FGXBT394). Response: {"query":"Apple Inc","count":1,"total_matches":24,"results":[{"lei":"HWUPKR0MPOU8FGXBT394","legal_name":"Apple Inc.","entity_status":"ACTIVE","registration_status":"ISSUED","jurisdiction":"US-CA","legal_address":{"city":"Glendale","region":"US-CA","country":"US","postal_code":"91203"}}],"source":{"name":"GLEIF","api":"https://api.gleif.org/api/v1/lei-records","fetched_at":"…"}}. Every value is read from the GLEIF public API (Global Legal Entity Identifier Foundation) at the moment of the call, and the response carries the API URL and the fetched_at it came from. 0.005 USDC, no account, no key, one GET, one delivery. A purchase is two calls by design: this first call returns 402 with the price and the payment terms,

Can I get just the article, as Markdown you can paste? Pass one URL and get the body back as clean Markdown — headings, paragraphs, lists, fenced code, inline code, links, images, quotes and tables kept; navigation, cookie banners, ads, sidebars, share buttons and the footer dropped. The response is text/markdown itself, so it is ready to paste into a prompt, a document or a file: no wrapper to unwrap. The page is fetched once per paid call, after payment, with a 5-second timeout and at most 3 redirects, and internal, private or link-local hosts, non-web ports, URLs over 2048 characters and URLs that embed credentials are refused with 400 before payment. Calling the same URL again within a minute is served from this service's short-lived cache. One GET, one article, one delivery. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

What Content-Type is this file? One GET maps one file extension (ext=json, with or without the dot) or one media type (type=application/json) to the canonical media type, its known extensions, the usual charset, whether it is usually compressed in transit, and its top-level category. Unknown but well-formed values are 200 with found=false. The table is bundled in this Worker; no fetch, no storage, no logging of the query. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Is this string mojibake, and can it be put back? One POST takes text you already hold and returns a verdict (clean, suspect, confirmed, unknown), the evidence (U+FFFD positions, C1 controls, half-width katakana ratio, non-ASCII ratio, UTF-8 round-trip, hint match) and up to five ranked candidates. Each candidate names the recovered original encoding and the decoder that broke it, a confidence, whether it is reversible, a sample of at most 120 graphemes and the reason. repaired is returned only when the top candidate is high-confidence and reversible, and it is a candidate, not proof of the original bytes. CP932-to-UTF-8 damage (U+FFFD) is detection only. URL encoding and HTML entities are out of scope. No fetch, no storage, no logging of the text. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Market headlines from public RSS in one GET: title, URL, publication time and source, newest first, with nothing older than 48 hours. curl: GET /news?topic=markets&limit=20 (topic markets|crypto|tech|world, default markets; limit 1-50, default 20). Response: {"topic":"markets","count":20,"freshness":{"max_age_hours":48,"newest_published_at":"2026-10-16T20:36:00.000Z","oldest_published_at":"2026-10-16T02:12:00.000Z","fetched_at":"2026-10-16T20:41:07.000Z","items_within_window":94,"dropped_older_than_window":12,"dropped_undated":0},"items":[{"title":"Stocks close at a record as earnings beat","url":"https://…","published_at":"2026-10-16T20:30:00.000Z","source":"MarketWatch","age_minutes":11}],"sources":[{"source":"BBC Business","feed_url":"…","ok":true,"http_status":200,"items_in_window":28,"latency_ms":180}]}. The five market feeds are read in parallel at the moment of the call, each with a 6 second cutoff, and every item carries the time its feed published it, so the age of each headli

Just the diff, not the whole pack? Pass the version you already hold (from=) and get only the records that were added or changed since it, as JSONL or CSV, with the added/changed kind and the changed field names on each line, plus the signed download link once the payment is confirmed. The manifest states the base and target version, the diff record count, the unchanged records excluded, the bytes and the sha256 before you pay, and a free sample of the first diff records is at /pack/diff/sample. One GET, one delivery, changed records only. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Pick random items from a list in one GET: count items from the items you pass, uniform, by default without replacement. Returns picked[] and the 0-based indices[], drawn with crypto.getRandomValues and rejection sampling (Fisher-Yates for unique draws). Nothing is fetched or stored. curl: GET /pick?items=alice,bob,carol&count=2 . Response: {"picked":["carol","alice"],"indices":[2,0],"unique":true,...}. items 1..100 comma/newline separated; count 1..100 (default 1); replace=false by default. An empty item, too many/over-long items, a bad count or count>items without replacement is 400 before payment. No seed and no signed beacon; each paid call returns fresh picks. No keys, no account, one GET, one delivery — 0.001 USDC. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Is this price the going rate, or is it over the odds? One GET tells you where it sits in the measured x402 market — cheap, fair or expensive — with the median, the 25th and 90th percentiles, the band, and how many measured prices are behind the comparison. curl: GET /price?amount=0.02 (add &url=https://your.endpoint/path to also compare against that URL's category). Response: {verdict:{label,plain,one_line,rule}, price_position:{percentile_text,band,multiple_of_median}, market:{sample_size,p25,median,p90,bands,fetched_at}, category:{...}, my_price:{...}}. Every figure is a measured amount from the public discovery index, carried with the date it was fetched; nothing is estimated or interpolated. The comparison is served from the bundled snapshot, so the response does not depend on any third party. No keys, no account, one GET, one delivery — 0.02 USDC. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same reque

Random bytes in one GET, without an LLM or Math.random(): hex, base64 or a UUID. curl: GET /random?bytes=32&format=hex (bytes 1-1024, default 32; format hex|base64|uuid, default hex). Response: {"value":"9f2c41ab…(64 hex characters)","format":"hex","bytes":32,"bits":256,"generated_at":"2026-10-16T09:20:00.000Z","sha256":"41ab…","sha256_of":"value","source":"crypto.getRandomValues"}. The bytes come from the Worker runtime's Web Crypto API, crypto.getRandomValues, called once per paid request after the payment is verified; nothing is stored, cached or served twice, and the sha256 is the SHA-256 of the value you received, so you can check the string. format=uuid answers a UUID version 4 string. 0.001 USDC, no account, no key, one GET, one delivery. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

Which routes can actually pay me, where do they pay out, and what do they demand first? One GET returns every route that was judged, each with the state that was measured and the date, the currency and chain it pays out in, whether it needs KYC, whether it needs SMS, its fees and the evidence behind the judgement. curl: GET /reality (every route) or GET /reality?name=Loopuman (one route; a partial name matches). Response: {count, routes:[{name,url,alive,alive_measured_at,receive_currency_chain,kyc_required,sms_required,fees,paid_evidence,usable_without_identity_gate,source}], summary, data:{generated_at}}. Every judgement is a recorded measurement carried with its date, and a field that was never measured says 未確認 rather than guessing. The map is served from the bundled record, so the response does not depend on any third party. No keys, no account, one GET, one delivery — 0.05 USDC. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, an

Timestamp conversion in one GET: epoch seconds, milliseconds, microseconds, nanoseconds, ISO 8601 and RFC 2822, in any direction. curl: GET /ts?value=1760000000&from=s&to=iso (from auto|s|ms|us|ns|iso|rfc2822, default auto; to iso|s|ms|us|ns|rfc2822|date, default iso). Response: {"result":"2025-10-09T08:53:20.000Z","unix_seconds":1760000000,"unix_milliseconds":1760000000000,"iso":"2025-10-09T08:53:20.000Z","rfc2822":"Thu, 09 Oct 2025 08:53:20 GMT"}. All conversion is integer/Date arithmetic inside this Worker; nothing is read from a clock service. 0.001 USDC, no account, no key, one GET, one delivery. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

URL inspector: one GET takes one absolute http(s) URL and returns its scheme, host, port, origin, path, path segments, every query parameter as name/value pairs (duplicates preserved), fragment and normalized href. It also reports has_credentials and password_present but never returns the password. curl: GET /url?url=https%3A%2F%2Fexample.com%2Fa%3Fx%3D1 . Nothing is fetched, DNS-resolved or stored. Missing, malformed, over-long and non-http(s) URLs are 400 before payment. No keys, no account, one GET, one delivery — 0.001 USDC. A purchase is two calls by design: this first call returns 402 with the price and the payment terms, and you then repeat the same request with the PAYMENT-SIGNATURE header to receive the 200 delivery.

登録した x402 のURLの支払条件が変わった時だけ差分を返す。変わっていなければ changed:false。壊れる前に気づくための1コール。条件は scheme・network・asset・amount・payTo・maxTimeoutSeconds の6項目で、差分は変わった項目の field / from / to だけ。curl: curl -X POST -H 'content-type: application/json' -d '{"url":"https://api.example.com/paid"}' https://<host>/watch → watch_id を受け取り、以後は curl 'https://<host>/watch?id=<watch_id>' で差分だけを読む。Response: {"watch_id":"…","changed":true,"changes":[{"field":"amount","from":"20000","to":"30000"}],"conditions":{"scheme":"exact","network":"eip155:8453","asset":"0x8335…","amount":"30000","payTo":"0x6f60…","maxTimeoutSeconds":60},"observed":true,"checks":2} — 変わった項目だけが返る。 Monitor an x402 endpoint's uptime and payment conditions: register the URL once, then every later call returns only the fields that changed (changed:false when nothing moved) — an uptime and change monitor for x402 paid endpoints, with no webhook to run.登録も差分も1コール 0.02 USDC。対象は支払いの後に1回だけ取得し、5秒で打ち切り・リダイレクトは3回まで。同じURLの60秒以内の再取得はキャッシュから返す。 A purchase is two calls by

登録した最大10本の x402 URLの支払条件が変わった時だけ、1コールで全部の差分を返す。変わっていなければ changed:false。1本ずつ /watch を呼ぶと本数分の往復と本数分の支払いになるので、まとめて1回にする。条件は scheme・network・asset・amount・payTo・maxTimeoutSeconds の6項目で、差分は URL ごとに変わった項目の field / from / to だけ。curl: curl -X POST -H 'content-type: application/json' -d '{"urls":["https://api.example.com/a","https://api.example.com/b"]}' https://<host>/watchlist → watchlist_id を受け取り、以後は curl 'https://<host>/watchlist?id=<watchlist_id>' で差分だけを読む。Response: {"watchlist_id":"…","changed":true,"summary":{"total":2,"changed":1,"unchanged":1,"indeterminate":0},"items":[{"url":"https://api.example.com/a","status":"changed","changes":[{"field":"amount","from":"20000","to":"30000"}],"conditions":{"scheme":"exact","network":"eip155:8453","amount":"30000","payTo":"0x6f60…","maxTimeoutSeconds":60}},{"url":"https://api.example.com/b","status":"unchanged","changes":[]}]} — 変わったURLの変わった項目だけが返る。読み取れなかったURLは status:"indeterminate" で返り、「変化なし」にはしない（基準も上書きしない）。上限は10本で、超える要求は支払いの前に400で断る。登録も差分も1コール 0.

A short, attributable Wikipedia summary of one article in one GET: pass a title and a language and get the title, one-line description, plain-text extract, article type, Wikidata item, page URL and thumbnail, plus the exact API URL read, the HTTP status and the text licence (CC BY-SA 4.0). curl: GET /wiki?q=Apple%20Inc.&lang=en (lang en|ja|de|fr|es|it|pt|ru|zh|ko; default en). Response: {found:true, title:"Apple Inc.", description, extract, extract_chars, article_type, wikibase_item, url, thumbnail_url, source:{name:"Wikipedia",api,page_url,license:"CC BY-SA 4.0",http_status,ok,latency_ms}}. If no article matches the exact title, found:false and no text is invented. q is required: a bare GET /wiki answers 402 for catalogues; a paid call without q is 400 before anything is read. An unreadable Wikipedia API is 502 before payment verification, so nothing is charged. No keys, no account, one GET, one delivery — 0.002 USDC. A purchase is two calls by design: this first call returns 402 with