# Agent Session Key & Delegate Guard

> Agent Session Key & Delegate Guard is a paid API for AI agents from 402.com.tr, paid per call via x402, $0.03/call, status unknown (last checked 2026-10-17).

Pre-execution security audit for ERC-4337 session keys and EIP-7702 delegated signers, returning a GO / OVER_PERMISSIVE / DRAIN_RISK verdict before signing.

## Facts

- Endpoint: GET https://402.com.tr/api/x402/agent-session-guard?utm_source=zero.xyz
- Price: $0.03/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-17
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agent-session-key-delegate-guard-39cf7fba
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_4M0VvGzl1OwCbkSxXutRA

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agent-session-key-delegate-guard-39cf7fba
```

Example prompt: Before my agent signs with session key 0xAbC123...def, run a security audit on it — check if the time-lock is bounded, whether the spend cap is set to $500 USD, and confirm that only Uniswap and Aerodrome are in the allowed targets list.

## When to prefer this

Use this endpoint when an autonomous agent or smart wallet is about to grant or use an ERC-4337 session key or EIP-7702 delegated signer and you need a pre-execution risk verdict. It is specifically valuable when you need structured GO/OVER_PERMISSIVE/DRAIN_RISK classification rather than a raw on-chain data read — particularly for agents operating with DeFi routers where unbounded execution or missing expiry could lead to fund loss. Prefer this over generic on-chain inspection when you want an opinionated, actionable security ruling rather than raw permission data.

## Known failure modes

- Missing or invalid signer address returns a 400 error
- Unresolvable or non-existent signer address may return an unknown verdict or error
- If allowedTargets contains unrecognized contract addresses, the audit may flag them conservatively
- Optional parameters omitted may result in a more conservative verdict due to lack of constraint data
- Service unavailability or upstream timeout returns a 5xx error

## How this service works

🆕 Pre-execution security audit for autonomous agent session keys (ERC-4337) and delegated signers (EIP-7702). Evaluates time-locks (perpetual leak vs bounded session), per-tx spend caps, router target allowlisting (Uniswap/Aerodrome vs unbounded execution), and produces an actionable GO / OVER_PERMISSIVE / DRAIN_RISK verdict before signing. Pass signer= (session key address).

## Output

Returns a structured security verdict — one of GO, OVER_PERMISSIVE, or DRAIN_RISK — along with a breakdown of the session key's time-lock status (perpetual vs bounded), spend cap evaluation, and router target allowlist coverage (e.g. Uniswap/Aerodrome vs unbounded). Includes actionable recommendations to remediate any identified risks before signing.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "pathParams": {
     "type": "object"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "signer"
     ],
     "properties": {
      "signer": {
       "type": "string",
       "description": "Session key / delegate address"
      },
      "account": {
       "type": "string",
       "description": "Agent smart account (optional)"
      },
      "expiryHours": {
       "type": "string",
       "description": "Session lifetime hours (optional)"
      },
      "spendCapUsd": {
       "type": "string",
       "description": "Spending limit in USD (optional)"
      },
      "allowedTargets": {
       "type": "string",
       "description": "Comma-separated target contracts (optional)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agent-session-key-delegate-guard-39cf7fba/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 402.com.tr](https://www.zero.xyz/host/402.com.tr/llms.txt)