# NetIntel RPKI Route-Origin Validator

> NetIntel RPKI Route-Origin Validator is a paid API for AI agents from payai.agentstools.dev, paid per call via x402, $0.008/call, status unknown (last checked 2026-09-15).

Validates whether an IPv4 prefix and origin AS pair is covered by a valid Route Origin Authorization (ROA), returning RFC 6811 RPKI status, covering ROA count, and matching ROA details.

## Facts

- Endpoint: GET https://payai.agentstools.dev/netintel/rpki
- Price: $0.008/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/netintel-rpki-route-origin-validator-3a11cbf9
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_AzQwJJrhUVzeHUCAXVrVx

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability netintel-rpki-route-origin-validator-3a11cbf9
```

Example prompt: Can you check the RPKI validation status of the prefix 1.1.1.0/24 with origin AS13335 — tell me if it's valid, how many ROAs cover it, and what the matching ROA details and trust anchors are?

## When to prefer this

Choose this endpoint when you need fast, standards-compliant RFC 6811 RPKI route-origin validation for a specific IPv4 prefix — especially when you need covering ROA details including trust anchors. Prefer over raw RPKI lookups when you want both the validation verdict and full matching ROA metadata in a single call without maintaining your own VRP dataset.

## Known failure modes

- Invalid CIDR notation or non-public IP prefix returns an error
- Unknown or private ASN may yield no matching ROAs (not-found status)
- If origin AS is omitted and IP-to-ASN resolution fails, validation may be incomplete
- Stale VRP dataset could cause mismatch with live RPKI state
- Non-IPv4 (IPv6) prefixes may not be supported

## How this service works

RPKI Route-Origin Validation for an IPv4 prefix and origin AS, computed per RFC 6811 from the bulk Validated ROA Payload set. Returns the ROA status, the covering ROA count and the matching ROAs with their origin, max length and trust anchor.

## Output

Returns the RFC 6811 RPKI validation state (valid, invalid, or not-found) for the queried prefix-origin pair, the number of ROAs that cover the prefix, and a list of matching ROAs each containing the authorized origin AS, maximum prefix length, and the trust anchor (e.g. ARIN, RIPE, APNIC).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "prefix"
     ],
     "properties": {
      "origin": {
       "type": "string",
       "description": "Optional origin AS number; if omitted it is resolved from the IP-to-ASN table"
      },
      "prefix": {
       "type": "string",
       "description": "Public IPv4 prefix in CIDR form or a bare address"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/netintel-rpki-route-origin-validator-3a11cbf9/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from payai.agentstools.dev](https://www.zero.xyz/host/payai.agentstools.dev/llms.txt)