# Agent Security Gateway – Identity Scope Check

> Agent Security Gateway – Identity Scope Check is a paid API for AI agents from agent-security-gateway.onrender.com, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-13).

Validates whether an AI agent's requested action falls within its permitted identity scopes, blocking privileged or out-of-scope operations

## Facts

- Endpoint: POST https://agent-security-gateway.onrender.com/api/identity/scope-check
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agent-security-gateway-identity-scope-check-2e4a6a85
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_NeJ4DaXWZISwb04imNtl8

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agent-security-gateway-identity-scope-check-2e4a6a85 -d '<json body>'
```

Example prompt: Before my agent named 'agent-42' executes the delete-record tool, check whether this response content — 'Proceeding to delete all user records as requested' — is within its allowed scopes and tell me if it should be blocked.

## When to prefer this

Use this endpoint when an AI agent is about to execute a sensitive or privileged action and you need a lightweight, pay-per-request identity scope enforcement check. Ideal for autonomous agent pipelines where you want to gate destructive operations (delete, admin, financial) against a defined permission set without maintaining your own policy engine.

## Known failure modes

- Missing required response_content field returns 422 validation error
- Payment not included or insufficient USDC returns 402 payment required
- Service unavailable on Render free tier cold start causes timeout
- Malformed JSON body returns 400 bad request
- Edge cases where scope definitions are ambiguous may produce false positives

## How this service works

Pay-per-request security APIs for autonomous AI agents using x402. Detect Japanese prompt injection, validate content, scan for threats, and perform pre-payment security checks. Built for USDC/Base payments.

## Output

Returns a JSON object with: allow (boolean), decision ('block' or 'allow'), risk_level ('high', 'medium', 'low'), reasons (array of strings describing violations such as 'privileged_operation_requested' or 'missing_scope: delete'), and recommended_action ('deny_action' or similar)

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "allow": {
   "type": "boolean"
  },
  "reasons": {
   "type": "array"
  },
  "decision": {
   "type": "string"
  },
  "primitive": {
   "type": "string"
  },
  "risk_level": {
   "type": "string"
  },
  "recommended_action": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "allow": false,
  "reasons": [
   "privileged_operation_requested",
   "missing_scope: delete"
  ],
  "decision": "block",
  "primitive": "identity-scope-check",
  "risk_level": "high",
  "recommended_action": "deny_action"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agent-security-gateway-identity-scope-check-2e4a6a85/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agent-security-gateway.onrender.com](https://www.zero.xyz/host/agent-security-gateway.onrender.com/llms.txt)