# agent-exec URL Attestation (POST /attest)

> agent-exec URL Attestation (POST /attest) is a paid API for AI agents from agent-exec.448c.net, paid per call via x402, $0.008/call, status unknown (last checked 2026-10-11).

Fetches a URL from the service's vantage point and returns a cryptographically signed attestation of the HTTP response metadata, including status code, content hash, and redirect chain.

## Facts

- Endpoint: POST https://agent-exec.448c.net/attest?utm_source=zero.xyz
- Price: $0.008/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agent-exec-url-attestation-post-attest-40f3b680
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap__iCk1IQc6rJLB7VdIhvJt

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agent-exec-url-attestation-post-attest-40f3b680 -d '<json body>'
```

Example prompt: Fetch https://example.com/report.pdf from your vantage point and give me a signed cryptographic attestation of its HTTP status and content hash — I need verifiable proof of what was there at this moment.

## When to prefer this

Choose this endpoint when you need a cryptographically verifiable, third-party attestation of a URL's HTTP response metadata (status, content hash, redirects) rather than just fetching the content yourself. It is especially valuable when you must prove to an external party — possibly on-chain — that a URL was reachable and had specific content at a given moment. Note: the response body itself is never returned; only metadata and a signed hash are provided. Prefer this over self-fetch when neutrality, non-repudiation, or external-vantage-point checking matters.

## Known failure modes

- fetch_ok=false if the URL has a DNS failure, connection timeout, or SSRF-unsafe redirect — detail field explains the reason
- Non-existent or unreachable domain returns fetch_ok=false with a DNS/connect error detail
- Redirects to private/internal IP ranges are refused for SSRF safety
- Payment failure results in HTTP 402 before the fetch is attempted
- URL exceeds 2048 UTF-8 bytes returns a validation error
- Body truncated at 1 MB — body_truncated=true if the resource is larger

## How this service works

Accountless, pay-per-use code execution for software agents: submit source code, get stdout, stderr and exit code back from an isolated, network-less sandbox. No account, no API key -- possession of valid payment is sufficient.

## Output

A signed attestation object containing: attestation_id, the original URL, observed_at timestamp, fetch_ok boolean, fetch_code, HTTP status code, SHA-256 hash of the response body, body byte count, truncation flag, content-type, final URL after redirects, redirect count, and an EIP-191 personal-sign signature from the attesting signer_address. On success, also includes payment metadata (asset, payer address, amount, network, transaction hash). The signature can be verified with viem's verifyMessage under the 'agent-exec attestation v2' domain.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "url"
 ],
 "properties": {
  "url": {
   "type": "string",
   "description": "An absolute http:// or https:// URL, at most 2048 UTF-8 bytes. Fetched from OUR vantage point; the body is never returned to you."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "attestation_id",
  "url",
  "observed_at",
  "fetch_ok",
  "fetch_code",
  "http_status",
  "body_sha256",
  "body_bytes",
  "body_truncated",
  "content_type",
  "final_url_after_redirects",
  "redirects",
  "detail",
  "signature",
  "signer_address"
 ],
 "properties": {
  "url": {
   "type": "string",
   "description": "The URL you asked us to fetch, exactly as sent."
  },
  "detail": {
   "type": [
    "string",
    "null"
   ],
   "description": "Free-text detail on a non-OK fetch_code (e.g. the timeout budget, the unsafe redirect target). Null when fetch_ok is true."
  },
  "payment": {
   "type": "object",
   "properties": {
    "asset": {
     "type": "string"
    },
    "payer": {
     "type": "string",
     "description": "The paying wallet's address."
    },
    "amount": {
     "type": "string",
     "description": "Atomic units of the settlement asset that were charged."
    },
    "network": {
     "type": "string"
    },
    "transaction": {
     "type": "string",
     "description": "On-chain settlement transaction hash."
    }
   },
   "description": "Only present on POST /attest's 201, never on a GET /attest/{id} read."
  },
  "fetch_ok": {
   "type": "boolean",
   "description": "Whether the fetch reached a real HTTP response, however unsuccessful. false means DNS/connect failure, timeout, or a redirect refused for SSRF safety -- see fetch_code."
  },
  "redirects": {
   "type": "integer",
   "description": "How many redirects were followed before the final response (or the refusal)."
  },
  "signature": {
   "type": "string",
   "description": "An EIP-191 personal-sign signature over attestation_id, url, final_url_after_redirects, observed_at, http_status, body_sha256, body_bytes, body_truncated, content_type, fetch_ok, fetch_code and redirects (domain \"agent-exec attestation v2\"), from signer_address. `detail` and `signer_address` are NOT part of the signed message. Verify with viem's verifyMessage({address: signer_address, message, signature}) -- see GET /attest/{id}'s description for the exact message and for handling an attestation signed under the prior v1 domain."
  },
  "body_bytes": {
   "type": "integer",
   "description": "Bytes actually read off the wire, capped at 1048576 per fetch -- see body_truncated."
  },
  "fetch_code": {
   "enum": [
    "ATTEST_FETCH_OK",
    "ATTEST_FETCH_URL_REFUSED",
    "ATTEST_FETCH_REDIRECT_UNSAFE",
    "ATTEST_FETCH_TOO_MANY_REDIRECTS",
    "ATTEST_FETC
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agent-exec-url-attestation-post-attest-40f3b680/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agent-exec.448c.net](https://www.zero.xyz/host/agent-exec.448c.net/llms.txt)