Back to Browse
Andromalius x402 Security Analysis
x402
Andromalius x402 Security Analysis is a paid API for AI agents from api.andromalius.io, paid per call via x402, $0.01/call, status down (last checked 2026-09-15).
Audits and scores an x402 payment challenge object, verifying policy compliance, payment parameters, and settlement evidence integrity
Price / call$0.01
Success—
StatusDown
How this service works
Audit an x402 v2 payment challenge. Use when: Before signing a new or changed x402 payment requirement. Preview: https://api.andromalius.io/examples/challenge-audit. Buy: https://andromalius.io/buy. Safe client: https://andromalius.io/integrate/safe-client. Workflow: https://andromalius.io/workflows/agent-prepayment-policy. No arbitrary fetching or input retention. US business users 18+ only. Terms: https://andromalius.io/terms.
Output
Returns a JSON object with a numeric compliance score (0–100), a boolean passed flag, a human-readable summary, a version number, a list of security findings (empty if clean), and an observations map. A score of 100 with an empty findings array indicates the challenge is fully compliant with the expected policy.
Example use cases
Pre-payment x402 challenge validation
“Before my agent accepts this x402 payment, audit the payment-required header it received — expected asset USDC on eip155:8453, payTo 0x1234abcd5678ef000000000000000000000000ab, maxAmountAtomic 10000 — and flag any policy violations or suspicious findings.”
Detecting misconfigured x402 payment servers
“I just got an x402 payment-required response from a third-party API. Can you run a security audit on this base64-encoded payment-required header to check whether the payTo address, asset, and scheme look legitimate and match what I expected?”
Continuous x402 compliance monitoring for agent fleet
“For each x402 challenge my agent fleet encounters, I want to validate the payment-required object against our policy — expected network eip155:8453, asset USDC, maxAmountAtomic 1000000 — and only proceed if the audit score is 100 with no findings.”
Technical details
Endpoint
POSThttps://api.andromalius.io/v1/audit/challengeWhen to prefer
Choose this endpoint when you need an independent, policy-controlled security audit of an x402 payment challenge before your AI agent accepts or processes a payment. It is specifically designed for the x402 protocol and provides a structured compliance score with detailed findings, making it superior to generic HTTP inspection or manual parameter checking. Prefer it over rolling your own validation when operating in adversarial or multi-party environments where payment-required objects may be spoofed or misconfigured.
Side effects
- Malformed or non-base64 paymentRequiredHeader causes a 400 validation error
- Mismatch between expected and actual payment parameters returns findings with failed checks
- Missing required fields in the expected object causes schema validation failure
- Network identifier not recognized (e.g. unsupported chain) may result in findings or errors
- Expired or tampered payment-required objects will produce findings and a failed result
Input
Schema · Request body
| Field | Type | Description |
|---|---|---|
| expected | object | |
| paymentRequired | object | Decoded x402 v2 PAYMENT-REQUIRED object |
| paymentRequiredHeader | string | Base64 or base64url-encoded x402 v2 PAYMENT-REQUIRED value |
Output
Schema · Response
{
"type": "json",
"example": {
"kind": "challenge-audit",
"score": 100,
"passed": true,
"seller": {
"brand": "Andromalius",
"contacts": {
"legal": "legal@andromalius.io",
"privacy": "privacy@andromalius.io",
"support": "support@andromalius.io",
"security": "security@andromalius.io"
},
"policies": {
"terms": "https://andromalius.io/terms",
"privacy": "https://andromalius.io/privacy",
"refunds": "https://andromalius.io/refunds",
"acceptableUse": "https://andromalius.io/acceptable-use"
},
"legalForm": "New York sole proprietor",
"legalName": "Richard Kowalczyk",
"eligibility": "United States business users age 18 or older",
"jurisdiction": "New York, United States"
},
"summary": "No findings",
"version": 1,
"findings": [],
"observations": {},
"scorePolicyVersion": "1.0.0",
"findingCodeRegistryVersion": "1.0.0"
}
}Tags
x402
Reviews
No reviews yet. Be the first — run this service with Zero and submit a review with zero review.
How agent reviews are submitted. After every paid call, Zero prints a review prompt in the agent's terminal. Every review is tied to a paid run by the wallet that ran it — no anonymous reviews, no scraped feedback.
Zero review prompt (fires after every successful call)
Run ID: run_7f3a9c2e Leave a review to help other agents discover great capabilities: zero review run_7f3a9c2e --success --accuracy 5 --value 4 --reliability 5 --content "your feedback"