# Agent-Exec URL Attestation

> Agent-Exec URL Attestation is a paid API for AI agents from agent-exec.45.67.221.128.sslip.io, paid per call via x402, $0.008/call, status unknown (last checked 2026-09-15).

Fetches a URL from a neutral vantage point and returns a cryptographically signed attestation of the HTTP response metadata (status, body hash, content-type, redirects) without returning the body itself.

## Facts

- Endpoint: POST https://agent-exec.45.67.221.128.sslip.io/attest
- Price: $0.008/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agent-exec-url-attestation-98c41399
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_l-ooDZ-eohJJWyMpGZYdr

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agent-exec-url-attestation-98c41399 -d '<json body>'
```

Example prompt: Can you get me a signed attestation proving that https://example.com/report.pdf exists right now — I need the body SHA-256 hash, the HTTP status code, and the final URL after any redirects, all signed so I can verify it later?

## When to prefer this

Choose this endpoint when you need a neutral, cryptographically signed third-party witness of a URL's HTTP response state — especially when the body itself is not needed but proof of existence, content hash, status code, or redirect chain is required. It is uniquely suited for audit trails, legal evidence, on-chain verification (EIP-191 signatures), or any scenario where you cannot trust your own fetch because you are a party to the transaction. Prefer it over a simple HTTP GET when non-repudiation or third-party attestation matters.

## Known failure modes

- DNS or connection failure: fetch_ok=false with fetch_code indicating the error
- SSRF safety refusal: fetch_ok=false when the target resolves to a private/internal IP
- Redirect loop or too many redirects: fetch_ok=false with detail explaining the limit
- Timeout: fetch_ok=false with detail noting the timeout budget
- Payment failure: HTTP 402 returned if the x402 payment is missing or invalid
- Body truncation: body larger than 1 MB is capped; body_truncated=true but fetch still succeeds
- Invalid URL: request rejected if URL exceeds 2048 bytes or is not absolute http/https

## How this service works

Accountless, pay-per-use code execution for software agents: submit source code, get stdout, stderr and exit code back from an isolated, network-less sandbox. No account, no API key -- possession of valid payment is sufficient.

## Output

A JSON object containing: a unique attestation_id, the requested URL, the observed_at timestamp, whether the fetch succeeded (fetch_ok), a fetch_code, the HTTP status code, a SHA-256 hash of the response body, body byte count, a truncation flag, content-type, the final URL after redirects, redirect count, optional free-text detail on failures, an EIP-191 personal-sign signature over the key fields, and the signer's Ethereum address. On a successful POST /attest call, a payment sub-object with asset, payer address, amount, network, and transaction hash is also included.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "url"
 ],
 "properties": {
  "url": {
   "type": "string",
   "description": "An absolute http:// or https:// URL, at most 2048 UTF-8 bytes. Fetched from OUR vantage point; the body is never returned to you."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "attestation_id",
  "url",
  "observed_at",
  "fetch_ok",
  "fetch_code",
  "http_status",
  "body_sha256",
  "body_bytes",
  "body_truncated",
  "content_type",
  "final_url_after_redirects",
  "redirects",
  "detail",
  "signature",
  "signer_address"
 ],
 "properties": {
  "url": {
   "type": "string",
   "description": "The URL you asked us to fetch, exactly as sent."
  },
  "detail": {
   "type": [
    "string",
    "null"
   ],
   "description": "Free-text detail on a non-OK fetch_code (e.g. the timeout budget, the unsafe redirect target). Null when fetch_ok is true."
  },
  "payment": {
   "type": "object",
   "properties": {
    "asset": {
     "type": "string"
    },
    "payer": {
     "type": "string",
     "description": "The paying wallet's address."
    },
    "amount": {
     "type": "string",
     "description": "Atomic units of the settlement asset that were charged."
    },
    "network": {
     "type": "string"
    },
    "transaction": {
     "type": "string",
     "description": "On-chain settlement transaction hash."
    }
   },
   "description": "Only present on POST /attest's 201, never on a GET /attest/{id} read."
  },
  "fetch_ok": {
   "type": "boolean",
   "description": "Whether the fetch reached a real HTTP response, however unsuccessful. false means DNS/connect failure, timeout, or a redirect refused for SSRF safety -- see fetch_code."
  },
  "redirects": {
   "type": "integer",
   "description": "How many redirects were followed before the final response (or the refusal)."
  },
  "signature": {
   "type": "string",
   "description": "An EIP-191 personal-sign signature over attestation_id, url, final_url_after_redirects, observed_at, http_status, body_sha256, body_bytes, body_truncated, content_type, fetch_ok, fetch_code and redirects (domain \"agent-exec attestation v2\"), from signer_address. `detail` and `signer_address` are NOT part of the signed message. Verify with viem's verifyMessage({address: signer_address, message, signature}) -- see GET /attest/{id}'s description for the exact message and for handling an attestation signed under the prior v1 domain."
  },
  "body_bytes": {
   "type": "integer",
   "description": "Bytes actually read off the wire, capped at 1048576 per fetch -- see body_truncated."
  },
  "fetch_code": {
   "enum": [
    "ATTEST_FETCH_OK",
    "ATTEST_FETCH_URL_REFUSED",
    "ATTEST_FETCH_REDIRECT_UNSAFE",
    "ATTEST_FETCH_TOO_MANY_REDIRECTS",
    "ATTEST_FETC
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agent-exec-url-attestation-98c41399/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agent-exec.45.67.221.128.sslip.io](https://www.zero.xyz/host/agent-exec.45.67.221.128.sslip.io/llms.txt)