# agent-exec URL Attestation

> agent-exec URL Attestation is a paid API for AI agents from agent-exec.448c.org, paid per call via x402, $0.008/call, status unknown (last checked 2026-10-11).

Fetches a URL from a neutral vantage point and returns a cryptographically signed attestation of the HTTP response metadata, including status code, body hash, and redirect chain.

## Facts

- Endpoint: POST https://agent-exec.448c.org/attest?utm_source=zero.xyz
- Price: $0.008/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agent-exec-url-attestation-7c2d09e4
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_GCIt5-RDXXyd_Wkx4390n

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agent-exec-url-attestation-7c2d09e4 -d '<json body>'
```

Example prompt: Can you fetch https://example.com/invoice/abc123 from a neutral server and give me a cryptographically signed attestation — including the HTTP status code, body hash, and any redirects — so I can prove what was there at this moment?

## When to prefer this

Choose this endpoint when you need a neutral, third-party HTTP fetch with a cryptographically signed, on-chain-verifiable attestation of the response — particularly for proving what a URL returned at a specific moment in time without trusting the requester's own report. It is ideal for dispute resolution, audit trails, and smart-contract-adjacent workflows where tamper-proof provenance matters. Unlike simple uptime monitors, it produces EIP-191 signatures verifiable with viem, making it suitable for blockchain and Web3 contexts. It requires no account or API key — only a valid x402 USDC micropayment.

## Known failure modes

- DNS or TCP connection failure returns fetch_ok=false with a descriptive fetch_code
- SSRF-safety refusal (e.g. private IP ranges or redirect to unsafe target) returns fetch_ok=false with detail explaining the refusal
- Timeout budget exceeded returns fetch_ok=false with the timeout value in detail
- Invalid or non-absolute URL in the request body returns a 4xx error before any fetch is attempted
- Payment failure or insufficient funds returns HTTP 402 with payment requirements
- Body larger than 1 MB is read but truncated; body_truncated=true is set in the response

## How this service works

Accountless, pay-per-use code execution for software agents: submit source code, get stdout, stderr and exit code back from an isolated, network-less sandbox. No account, no API key -- possession of valid payment is sufficient.

## Output

Returns a signed attestation object containing: a unique attestation ID, the requested URL, the final URL after any redirects, the number of redirects followed, the HTTP status code, whether the fetch succeeded (fetch_ok), a fetch_code for failures, the SHA-256 hash of the response body, the body size in bytes, a truncation flag, the content type, the timestamp of observation, and an EIP-191 personal-sign signature over all key fields from a known signer address. On success (HTTP 201), also includes payment metadata (asset, payer address, amount, network, transaction hash).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "url"
 ],
 "properties": {
  "url": {
   "type": "string",
   "description": "An absolute http:// or https:// URL, at most 2048 UTF-8 bytes. Fetched from OUR vantage point; the body is never returned to you."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "attestation_id",
  "url",
  "observed_at",
  "fetch_ok",
  "fetch_code",
  "http_status",
  "body_sha256",
  "body_bytes",
  "body_truncated",
  "content_type",
  "final_url_after_redirects",
  "redirects",
  "detail",
  "signature",
  "signer_address"
 ],
 "properties": {
  "url": {
   "type": "string",
   "description": "The URL you asked us to fetch, exactly as sent."
  },
  "detail": {
   "type": [
    "string",
    "null"
   ],
   "description": "Free-text detail on a non-OK fetch_code (e.g. the timeout budget, the unsafe redirect target). Null when fetch_ok is true."
  },
  "payment": {
   "type": "object",
   "properties": {
    "asset": {
     "type": "string"
    },
    "payer": {
     "type": "string",
     "description": "The paying wallet's address."
    },
    "amount": {
     "type": "string",
     "description": "Atomic units of the settlement asset that were charged."
    },
    "network": {
     "type": "string"
    },
    "transaction": {
     "type": "string",
     "description": "On-chain settlement transaction hash."
    }
   },
   "description": "Only present on POST /attest's 201, never on a GET /attest/{id} read."
  },
  "fetch_ok": {
   "type": "boolean",
   "description": "Whether the fetch reached a real HTTP response, however unsuccessful. false means DNS/connect failure, timeout, or a redirect refused for SSRF safety -- see fetch_code."
  },
  "redirects": {
   "type": "integer",
   "description": "How many redirects were followed before the final response (or the refusal)."
  },
  "signature": {
   "type": "string",
   "description": "An EIP-191 personal-sign signature over attestation_id, url, final_url_after_redirects, observed_at, http_status, body_sha256, body_bytes, body_truncated, content_type, fetch_ok, fetch_code and redirects (domain \"agent-exec attestation v2\"), from signer_address. `detail` and `signer_address` are NOT part of the signed message. Verify with viem's verifyMessage({address: signer_address, message, signature}) -- see GET /attest/{id}'s description for the exact message and for handling an attestation signed under the prior v1 domain."
  },
  "body_bytes": {
   "type": "integer",
   "description": "Bytes actually read off the wire, capped at 1048576 per fetch -- see body_truncated."
  },
  "fetch_code": {
   "enum": [
    "ATTEST_FETCH_OK",
    "ATTEST_FETCH_URL_REFUSED",
    "ATTEST_FETCH_REDIRECT_UNSAFE",
    "ATTEST_FETCH_TOO_MANY_REDIRECTS",
    "ATTEST_FETC
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agent-exec-url-attestation-7c2d09e4/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agent-exec.448c.org](https://www.zero.xyz/host/agent-exec.448c.org/llms.txt)