# HALOWERK x402werk — Replay Guard (Duplicate Payment Detector)

> HALOWERK x402werk — Replay Guard (Duplicate Payment Detector) is a paid API for AI agents from x402.halowerk.com, paid per call via x402, $0.002/call, status unknown (last checked 2026-09-14).

Checks whether an x402 payment nonce, payment ID, or payload hash has been seen before, returning a duplicate-detection recommendation to accept, reject, or review the payment.

## Facts

- Endpoint: POST https://x402.halowerk.com/guard/replay
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/halowerk-x402werk-replay-guard-duplicate-payment-detector-16eedb2b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_dn7yhJgfBTtOybxlapUUP

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability halowerk-x402werk-replay-guard-duplicate-payment-detector-16eedb2b -d '<json body>'
```

Example prompt: Check whether the x402 payment nonce 'abc123xyz' and payment ID 'pay_9f8e7d' have been seen before within the last 300 seconds, and record this check — what's the recommendation: accept, reject, or review?

## When to prefer this

Use this endpoint when you are operating an x402-gated API and need to detect replay attacks or double-spend attempts in real time. It is specifically designed for the x402 payment protocol on Base Mainnet with USDC, making it the right choice when your payments carry x402 nonces or payment IDs. Prefer it over generic idempotency checks when you need a structured accept/reject/review recommendation with evidence and when you want fingerprint storage without exposing raw payment data.

## Known failure modes

- Missing required fingerprint fields (nonce, payment_id, or payload_hash) result in incomplete checks with those fields listed in unavailable_fields
- Payment for the endpoint itself fails (x402 payment not included or rejected) — returns HTTP 402
- window_seconds set too broadly may yield false positives for legitimate recurring payments
- record=false prevents deduplication state from being updated, which may allow replays if all checks are dry-runs
- Fingerprints are retained only 24 hours; checks on older payments will not find prior sightings

## How this service works

A stateful duplicate check for agents that settle x402 payments. Supply any of payment_id, payload_hash and nonce; each is hashed with SHA-256 before storage, so the service keeps fingerprints and timestamps and never the values themselves, never a payload, never an address. The answer states for every supplied identifier whether it was seen before, when it was first and last seen, how often, and whether the first sighting falls inside window_seconds. The recommendation is ablehnen only for a re

## Output

Returns a JSON object with: a boolean is_duplicate flag, a boolean nonce_reused flag, a recommendation enum ('annehmen' = accept, 'ablehnen' = reject, 'pruefen' = review), the number of times the fingerprint has been seen (seen_count), the timestamp of first sighting (first_seen), age in milliseconds (age_ms), whether the sighting falls within the requested window (within_window), a duplicate_of object if a duplicate was found, evidence details, and a list of any unavailable_fields.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "nonce": {
   "type": "string",
   "maxLength": 512,
   "minLength": 1,
   "description": "Nonce of the signed payment authorisation. Stored only as a SHA-256 fingerprint."
  },
  "record": {
   "type": "boolean",
   "default": true,
   "description": "Whether this call is remembered. Set to false to check without writing, so repeated checks of the same payment do not report themselves as duplicates."
  },
  "payment_id": {
   "type": "string",
   "maxLength": 512,
   "minLength": 1,
   "description": "Payment identifier of the x402 payment-identifier extension, or any identifier your client treats as unique per payment. Stored only as a SHA-256 fingerprint."
  },
  "payload_hash": {
   "type": "string",
   "maxLength": 512,
   "minLength": 1,
   "description": "Hash of the request payload that was paid for. Stored only as a SHA-256 fingerprint of the value you send."
  },
  "window_seconds": {
   "type": "integer",
   "default": 3600,
   "maximum": 86400,
   "minimum": 1,
   "description": "How far back a sighting still counts as a duplicate for the recommendation. Fingerprints are kept for 24 hours regardless."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/halowerk-x402werk-replay-guard-duplicate-payment-detector-16eedb2b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402.halowerk.com](https://www.zero.xyz/host/x402.halowerk.com/llms.txt)