# Agent402 SQL Certificate Verifier

> Agent402 SQL Certificate Verifier is a paid API for AI agents from agent402.tools, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-15).

Verifies a cryptographic SQL certificate (issued by sql-guard) to confirm it covers a specific SQL statement and was issued by a trusted key

## Facts

- Endpoint: POST https://agent402.tools/api/sql-cert-verify
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agent402-sql-certificate-verifier-92ed7814
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_5lQMZqKsMXrIxuX11srmc

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agent402-sql-certificate-verifier-92ed7814 -d '<json body>'
```

Example prompt: Can you verify this sql-guard certificate token 'eyJhbGci...' to confirm it actually covers the SQL statement 'SELECT * FROM orders WHERE user_id = 42'?

## When to prefer this

Use this endpoint when you need to cryptographically verify that a SQL statement has been pre-approved and certified by a sql-guard certificate before executing it — especially in agentic pipelines where untrusted SQL needs to be authenticated. Prefer this over manual hash-checking when the certificate was issued by sql-guard and you need to confirm both integrity and issuer trust. Ideal for zero-trust database access patterns where the wallet is the identity and no API key is needed.

## Known failure modes

- Certificate does not match the provided SQL statement — valid: false with reason explaining the mismatch
- Expired certificate — payload.exp is in the past, valid: false
- Invalid PEM public key format — error parsing the provided publicKey
- Malformed or tampered certificate token — signature verification fails, valid: false
- Missing required field (sql or certificate) — request rejected with validation error

## How this service works

Verify an Ed25519 execution certificate against the exact SQL statement you are about to run - the gate your database layer calls before it obeys an agent. Checks the signature, the certificate version, the expiry, and that the statement's SHA-256 matches the one certified, so a certificate for a different (or edited) statement is rejected. Returns { valid, reason, payload } and never throws on a malformed token, so the executor always gets one uniform answer.

## Output

Returns a JSON object with a 'valid' boolean indicating whether the certificate is authentic and covers the provided SQL statement, a 'reason' field (null on success or an error message on failure), and a 'payload' object containing the certificate version, expiry timestamp, SHA-256 hash of the SQL, and the original verdict (e.g. 'pass').

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "sql": {
   "type": "string",
   "description": "the exact statement the certificate should cover"
  },
  "publicKey": {
   "type": "string",
   "description": "PEM public key of the issuer (default: this deployment's)"
  },
  "certificate": {
   "type": "string",
   "description": "the token from sql-guard (payload.signature)"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "valid": true,
  "reason": null,
  "payload": {
   "v": 1,
   "exp": 4070908800,
   "sha256": "635cf20a…",
   "verdict": "pass"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agent402-sql-certificate-verifier-92ed7814/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agent402.tools](https://www.zero.xyz/host/agent402.tools/llms.txt)