# autobus — WBA Self-Check (Web Bot Auth Debugger)

> autobus — WBA Self-Check (Web Bot Auth Debugger) is a paid API for AI agents from witness.holoweave.org, paid per call via x402, $0.01/call, status down (last checked 2026-09-15).

Debugs why a signed bot HTTP request is rejected by verifying RFC 7638 key ID thumbprints, RFC 9421 Ed25519 signatures, and per-verifier acceptance rules, returning a signed attestation with a pass/fail verdict.

## Facts

- Endpoint: POST https://witness.holoweave.org/v1/wba-self
- Price: $0.01/call
- Payment: x402
- Status: down
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/autobus-wba-self-check-web-bot-auth-debugger-2b35f552
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_6ldvQbKQUEDkggCIK2hgF

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability autobus-wba-self-check-web-bot-auth-debugger-2b35f552 -d '<json body>'
```

Example prompt: My agent's signed requests keep getting rejected — can you run the WBA self-check against all known verifiers to show me exactly which part is failing, whether it's the thumbprint, the Ed25519 signature, or a specific verifier's acceptance rules?

## When to prefer this

Choose this endpoint when an AI agent is experiencing rejected signed HTTP requests and needs to pinpoint whether the failure is in the key ID thumbprint (RFC 7638), the Ed25519 message signature (RFC 9421), or a specific verifier's acceptance policy. It is purpose-built for the WBA (Web Bot Authentication) stack and returns a cryptographically signed attestation, making it more trustworthy than a generic HTTP debugging tool. Prefer it over manual inspection when you need an auditable, signed diagnosis rather than just logs.

## Known failure modes

- Key directory URL unreachable or returns non-JWK content — thumbprint check fails
- Ed25519 signature header malformed or missing — signature verdict fails
- Signature-Agent header absent — request cannot be evaluated for bot identity
- Specified verifier name unknown — verifier acceptance check skipped or errors
- Payment not included or insufficient — x402 payment required error before check runs

## How this service works

Web bot auth debugging for AI agents, priced per check at $0.01. RFC 7638 keyid thumbprint verification, RFC 9421 Ed25519 signature verification, and per-verifier acceptance rules. Signed attestations, published fixtures, sources with dates.

## Output

A signed attestation object containing a verdict ('pass' or 'fail'), the endpoint name, and a detailed evidence breakdown: the signed request headers used, individual sub-verdicts for signature validity, key ID thumbprint correctness, and acceptance by each named verifier (e.g. Cloudflare). The attestation itself is signed with the witness's Ed25519 key for independent verification.

## Response schema (JSON Schema)

```json
{
 "example": {
  "signature": {
   "alg": "ed25519",
   "value": "base64...",
   "key_id": "aw-attest-2026-08"
  },
  "attestation": {
   "verdict": "pass",
   "endpoint": "wba-self",
   "evidence": {
    "request": {
     "url": "https://witness.holoweave.org/v1/wba-self",
     "method": "POST",
     "signed_headers": [
      "signature",
      "signature-input",
      "signature-agent"
     ]
    },
    "verdicts": {
     "signature": "pass",
     "acceptance": "pass",
     "thumbprint": "pass"
    },
    "acceptance": {
     "cloudflare": {
      "result": "accept"
     }
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/autobus-wba-self-check-web-bot-auth-debugger-2b35f552/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from witness.holoweave.org](https://www.zero.xyz/host/witness.holoweave.org/llms.txt)