# ARN x402 PayGuard – Payment Security Preflight

> ARN x402 PayGuard – Payment Security Preflight is a paid API for AI agents from arn-x402-payguard-payment-security.rajdeep-dutta-in.workers.dev, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-15).

Performs live preflight security checks on an x402 seller endpoint to return an ALLOW, CAUTION, or BLOCK decision before an AI agent authorizes payment.

## Facts

- Endpoint: POST https://arn-x402-payguard-payment-security.rajdeep-dutta-in.workers.dev/preflight
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/arn-x402-payguard-payment-security-preflight-d66ecdc8
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_e6WXR9Qqrm7-4E0J7lymE

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability arn-x402-payguard-payment-security-preflight-d66ecdc8 -d '<json body>'
```

Example prompt: Before my agent pays https://api.example-seller.com/premium-data, run a live x402 PayGuard preflight check against it — I'm about to authorize 0.03 USDC on Base (eip155:8453) in USDC (0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913) payable to 0x1111111111111111111111111111111111111111, and I want an ALLOW/CAUTION/BLOCK verdict with all security checks before I sign anything.

## When to prefer this

Use this endpoint whenever an AI agent is about to authorize an x402 payment and needs a live, multi-dimensional security verdict before signing. It is specifically designed for the x402 protocol and checks properties (challenge stability, canonical USDC, EIP-3009 payTo binding, redirect safety) that generic HTTP validators do not cover. Prefer it over manual inspection or generic security scanners when operating autonomously with real USDC on Base.

## Known failure modes

- Seller URL unreachable — reachable: false, decision likely BLOCK
- x402 challenge returns inconsistent or malformed data — x402_valid: false
- payTo address does not match authorization context — BLOCK with reason code
- Quoted price exceeds intended_spend_usdc — within_intended_spend: false, CAUTION or BLOCK
- Unsafe redirect detected on the seller endpoint — no_unsafe_redirect: false, BLOCK
- Non-canonical USDC asset address used — canonical_usdc: false
- Invalid or unsupported CAIP-2 network — supported_network: false
- Challenge changes between calls — challenge_stable: false, CAUTION

## How this service works

Agent Reliability Network: ARN x402 PayGuard provides x402 payment security for autonomous AI agents. Check the seller before you pay with payment preflight and payment-challenge validation. Returns ALLOW, CAUTION, or BLOCK.

## Output

A JSON object containing a top-level 'decision' of ALLOW, CAUTION, or BLOCK; a map of boolean check results (https, x402_valid, no_unsafe_redirect, exact_payment, canonical_usdc, supported_network, pay_to_safe_receiver, within_intended_spend, etc.); quoted_price_usdc and quoted_price_atomic; latency_ms; lists of errors, warnings, and reason_codes; and metadata fields including x402_version, methodology, and reachable status.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "format": "uri",
   "description": "HTTPS URL of the x402 seller endpoint to inspect live"
  },
  "authorization": {
   "type": "object",
   "properties": {
    "asset": {
     "type": "string",
     "description": "Payment asset the buyer is about to authorize"
    },
    "payTo": {
     "type": "string",
     "description": "Payment recipient the buyer is about to authorize"
    },
    "payer": {
     "type": "string",
     "description": "Optional expected EIP-3009 authorization payer; distinct from a transaction relayer"
    },
    "network": {
     "type": "string",
     "description": "CAIP-2 payment network the buyer is about to authorize"
    },
    "resource": {
     "type": "string",
     "format": "uri",
     "description": "Seller resource the authorization is intended to purchase"
    },
    "transaction": {
     "type": "object",
     "properties": {
      "to": {
       "type": "string",
       "description": "EVM call target; must match the challenged payment asset"
      },
      "data": {
       "type": "string",
       "pattern": "^0x(?:[0-9a-fA-F]{2})+$",
       "description": "Non-empty hex calldata for the unsigned simulation"
      },
      "from": {
       "type": "string",
       "description": "Optional EVM caller address for eth_call"
      },
      "value": {
       "type": "string",
       "pattern": "^0x(?:0|[1-9a-fA-F][0-9a-fA-F]*)$",
       "description": "Optional hexadecimal native-value quantity for eth_call"
      }
     },
     "description": "Optional unsigned Base eth_call input reused for transaction simulation and supported canonical USDC authorization decoding",
     "additionalProperties": false
    },
    "valid_after": {
     "type": [
      "integer",
      "string"
     ],
     "description": "Optional authorization valid-after Unix timestamp"
    },
    "valid_before": {
     "type": [
      "integer",
      "string"
     ],
     "description": "Optional authorization expiry Unix timestamp"
    },
    "amount_atomic": {
     "type": "string",
     "pattern": "^[0-9]+$",
     "description": "Atomic token amount the buyer is about to authorize"
    }
   },
   "description": "Optional unsigned payment authorization context to compare with the live x402 challenge",
   "additionalProperties": false
  },
  "intended_spend_usdc": {
   "type": "number",
   "description": "Optional maximum USDC amount the buyer intends to authorize",
   "exclusiv
… (truncated)
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
  "payTo": "0x1111111111111111111111111111111111111111",
  "checks": {
   "https": true,
   "x402_v2": true,
   "http_402": true,
   "reachable": true,
   "x402_valid": true,
   "exact_payment": true,
   "canonical_usdc": true,
   "positive_amount": true,
   "challenge_stable": true,
   "resource_binding": true,
   "content_type_sane": true,
   "supported_network": true,
   "no_unsafe_redirect": true,
   "reasonable_timeout": true,
   "asset_address_valid": true,
   "pay_to_address_valid": true,
   "pay_to_safe_receiver": true,
   "within_intended_spend": true,
   "structured_response_sane": true,
   "response_size_within_limit": true
  },
  "errors": [],
  "scheme": "exact",
  "network": "eip155:8453",
  "decision": "ALLOW",
  "warnings": [],
  "reachable": true,
  "latency_ms": 42,
  "x402_valid": true,
  "methodology": "live-security-v1",
  "reason_codes": [],
  "x402_version": 2,
  "payment_required": true,
  "quoted_price_usdc": 0.03,
  "intended_spend_usdc": 0.03,
  "quoted_price_atomic": "30000"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/arn-x402-payguard-payment-security-preflight-d66ecdc8/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from arn-x402-payguard-payment-security.rajdeep-dutta-in.workers.dev](https://www.zero.xyz/host/arn-x402-payguard-payment-security.rajdeep-dutta-in.workers.dev/llms.txt)