# Incident Notes - Provenance Edge Audit

> Incident Notes - Provenance Edge Audit is a paid API for AI agents from www.mahastrategies.com, paid per call via x402, $0.045297/call, status unknown (last checked 2026-10-16).

Binds incident observations to service deployment pins and event digest identifiers, recording typed non-personal provenance metadata for audit purposes without log analysis or root-cause attribution.

## Facts

- Endpoint: POST https://www.mahastrategies.com/api/v1/context/incident-notes/provenance-edge-audit?utm_source=zero.xyz
- Price: $0.045297/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-16
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/incident-notes-provenance-edge-audit-24b9cfb3
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_NgHceBlTaaEnjBhGZIv2e

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability incident-notes-provenance-edge-audit-24b9cfb3 -d '<json body>'
```

Example prompt: Bind these incident observations to our payment-service deployment pins and the following 5 event digest IDs — data class is 'synthetic' and all metadata is non-personal — and give me a provenance receipt for the audit record.

## When to prefer this

Choose this endpoint when you need to create a typed, offline provenance record binding incident observations to specific service deployment pins and event digests without any log reading, root-cause analysis, timestamp verification, or attack attribution. It is suited for compliance and audit workflows where only non-personal metadata of class 'public' or 'synthetic' is involved and a lightweight receipt is sufficient.

## Known failure modes

- Missing or empty edges, events, or services arrays (minItems:1 violated)
- nonpersonalMetadata flag not set to true (const:true required)
- dataClass not one of 'public' or 'synthetic' (enum validation failure)
- Exceeding 32 items in any array (maxItems:32 exceeded)
- Payment failure via x402 protocol resulting in 402 response
- Service unavailability returning 5xx errors
- Result expiry after 24-hour retention window

## How this service works

Bind incident observations to supplied service deployment and event digest pins. Does not read logs, verify timestamps, attribute attacks or establish root causes. Offline typed nonpersonal metadata only. Result retention: 24 hours; minimal receipt metadata: 90 days.

## Output

A provenance binding receipt confirming the association of incident observations with supplied service deployment pins and event digest identifiers. The result is stored for 24 hours, with minimal receipt metadata retained for 90 days. No log content, timestamps, root-cause analysis, or attack attribution is included.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "edges": {
   "type": "array",
   "maxItems": 32,
   "minItems": 1
  },
  "events": {
   "type": "array",
   "maxItems": 32,
   "minItems": 1
  },
  "services": {
   "type": "array",
   "maxItems": 32,
   "minItems": 1
  },
  "dataClass": {
   "enum": [
    "public",
    "synthetic"
   ],
   "type": "string"
  },
  "nonpersonalMetadata": {
   "type": "boolean",
   "const": true
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/incident-notes-provenance-edge-audit-24b9cfb3/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from www.mahastrategies.com](https://www.zero.xyz/host/www.mahastrategies.com/llms.txt)