# 402Sentinel x402 Counterparty Risk Firewall

> 402Sentinel x402 Counterparty Risk Firewall is a paid API for AI agents from 402sentinel.com, paid per call via x402, $0.002/call, status unknown (last checked 2026-09-15).

Scores an x402 payment counterparty address (0-100 risk) and returns an allow/review/block decision based on on-chain settlement behaviour before payment is made

## Facts

- Endpoint: POST https://402sentinel.com/api/firewall
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/402sentinel-x402-counterparty-risk-firewall-28018b1c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_9bscwu-k4Yb-qmdJ-x5K2

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability 402sentinel-x402-counterparty-risk-firewall-28018b1c -d '<json body>'
```

Example prompt: Before I pay this x402 API, run a counterparty risk check on the address 0xAbC123... and tell me whether I should allow, review, or block the payment based on its on-chain settlement history.

## When to prefer this

Use this endpoint when an AI agent is about to make an x402 micropayment and needs a pre-flight counterparty risk check based purely on on-chain settlement behaviour. Prefer this over generic blockchain analytics when you specifically need x402-aware payer diversity signals and a structured allow/review/block decision without any signup or API key.

## Known failure modes

- Address not found on-chain — insufficient history to score, may return a default high-risk or indeterminate result
- Invalid or malformed address input — 400 error
- Payment for the x402 call itself fails or is rejected — service not invoked
- Network congestion on Base causing delayed settlement verification
- New address with zero history — may default to block or review due to lack of data

## How this service works

Buyer-side payment firewall: should THIS agent make THIS payment now? Where /api/assess vets the seller, this vets the payment against your own agent's behaviour. POST {agent_id, payment:{payto_address,amount,resource_url}, context?:{untrusted_text,intended}, policy?} returns allow/hold/block plus 9 signals incl. routing_anomaly, velocity, amount_anomaly, injection_destination, intent_mismatch. Stateful per agent_id.

## Output

A JSON response containing a 0-100 risk score and a categorical decision of allow, review, or block, derived from on-chain signals including address age, facilitator-aware payer diversity, and settlement maturity for the queried counterparty address.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "policy": {
   "type": "object",
   "description": "Optional checks, e.g. {check_counterparty: true}."
  },
  "context": {
   "type": "object",
   "properties": {
    "source": {
     "type": "string",
     "description": "e.g. \"tool_output\", \"web_content\"."
    },
    "metadata": {
     "type": "object"
    },
    "expected_payto": {
     "type": "string",
     "description": "The payTo the agent intended, to detect routing swaps."
    }
   },
   "description": "Where the payment instruction came from (provenance)."
  },
  "payment": {
   "type": "object",
   "required": [
    "payto_address"
   ],
   "properties": {
    "asset": {
     "type": "string",
     "description": "e.g. \"USDC\""
    },
    "amount": {
     "type": "number"
    },
    "resource_url": {
     "type": "string",
     "description": "The resource being paid for."
    },
    "payto_address": {
     "type": "string",
     "description": "Address the payment would go to — 0x EVM (Base) OR base58 Solana."
    }
   },
   "description": "The payment instruction being vetted."
  },
  "agent_id": {
   "type": "string",
   "description": "The calling agent's wallet (keys per-agent history). Optional — auto-filled from the x402 payer if omitted."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/402sentinel-x402-counterparty-risk-firewall-28018b1c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 402sentinel.com](https://www.zero.xyz/host/402sentinel.com/llms.txt)