# API Contracts Scope Boundary Audit

> API Contracts Scope Boundary Audit is a paid API for AI agents from www.mahastrategies.com, paid per call via x402, $0.038303/call, status unknown (last checked 2026-10-25).

Validates HTTP API contract scope boundaries by comparing owner, revision, scope, and allowed target declarations with exact precision across supplied contract records.

## Facts

- Endpoint: POST https://www.mahastrategies.com/api/v1/verify/api-contracts/scope-boundary-audit?utm_source=zero.xyz
- Price: $0.038303/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-25
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/api-contracts-scope-boundary-audit-fdbdabde
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_rfQ98Zy5j8qS2AmCCh9tq

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability api-contracts-scope-boundary-audit-fdbdabde -d '<json body>'
```

Example prompt: Can you run a scope boundary audit on our API contracts? The owner reference is 'org-acme', revision is 'v2.3.1', scope reference is 'payments-api', data class is 'public', allowed targets are ['https://api.acme.com/payments', 'https://api.acme.com/refunds'], and here are the two contracts I need checked — let me know if any scope boundaries are violated.

## When to prefer this

Choose this endpoint when you need exact, offline scope boundary verification of API contracts against declared owners, revisions, and allowed targets without any persistent storage of contract content. Ideal for CI/CD pipeline gates, pre-release compliance checks, or auditing whether API tool targets respect transport and path segment boundaries. Best suited for public or synthetic (non-personal) data classes where result retention of 24 hours is acceptable.

## Known failure modes

- Missing or invalid ownerRef causes request rejection
- Revision string mismatch between contract and declared revision returns boundary violation
- Contracts array exceeding 32 items or empty array returns validation error
- dataClass not set to 'public' or 'synthetic' causes enum rejection
- nonpersonalMetadata not set to true (const) causes request failure
- Allowed targets array empty or exceeding 32 items triggers schema error
- Malformed HTTP path segments in contracts cause parse failure

## How this service works

Compare HTTP contract owner, revision, scope and allowed target declarations exactly. HTTP paths include method and segment boundaries; tool targets include transport. Labels grant no authorization. Offline typed nonpersonal metadata only. Result retention: 24 hours; minimal receipt metadata: 90 days.

## Output

Returns a structured audit result indicating whether each supplied contract's owner reference, revision, scope reference, and allowed targets are consistent with declared boundaries. Reports any mismatches at the HTTP path method/segment level and transport level for tool targets, with a receipt of the audit retained for 90 days.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "ownerRef": {
   "type": "string"
  },
  "revision": {
   "type": "string"
  },
  "scopeRef": {
   "type": "string"
  },
  "contracts": {
   "type": "array",
   "maxItems": 32,
   "minItems": 1
  },
  "dataClass": {
   "enum": [
    "public",
    "synthetic"
   ],
   "type": "string"
  },
  "allowedTargets": {
   "type": "array",
   "maxItems": 32,
   "minItems": 1
  },
  "nonpersonalMetadata": {
   "type": "boolean",
   "const": true
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/api-contracts-scope-boundary-audit-fdbdabde/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from www.mahastrategies.com](https://www.zero.xyz/host/www.mahastrategies.com/llms.txt)