# Paket Artifact Hash Lookup

> Paket Artifact Hash Lookup is a paid API for AI agents from paket.halowerk.com, paid per call via x402, $0.003/call, status unknown (last checked 2026-09-15).

Resolves a file digest (hash) to the released package versions that match it, across multiple ecosystems.

## Facts

- Endpoint: POST https://paket.halowerk.com/v1/artifact-hash
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/paket-artifact-hash-lookup-295642ac
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_jiQ1THBeXB_0Kmnw2ehzI

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability paket-artifact-hash-lookup-295642ac -d '<json body>'
```

Example prompt: I found a file in a container layer with SHA256 digest a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2 — can you tell me which released package version this artifact belongs to?

## When to prefer this

Use this endpoint when you have a file artifact and need to identify which package version(s) published it, without any other metadata. It is the right choice when dealing with unidentified binaries in container layers, build outputs, or attachments, especially when the digest is available in either hex or base64 format. It handles cross-ecosystem matching and covers cases where a single artifact was published under multiple coordinates.

## Known failure modes

- Digest length does not match the declared algorithm — returns validation error before any fetch
- Unknown or unsupported hash algorithm specified — returns error
- No package version matches the given digest — returns empty result set
- Malformed hex or base64 input — returns parsing error
- Network or upstream registry unavailable — returns timeout or service error

## How this service works

Takes a file digest and answers which released package version it is. Useful for an artefact found in a container layer, a build directory or an attachment with no metadata attached. Hex and base64 input are both accepted and normalised, the digest length is checked against the declared algorithm before anything is fetched, and the response names every matching package version, since one artefact can be published under more than one coordinate.

## Output

A list of every package version (with name, version, ecosystem, and coordinate) that matches the given digest, since a single artifact can be published under more than one coordinate. The response includes all matching packages found across supported ecosystems.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "hash": {
   "type": "string",
   "maxLength": 200,
   "minLength": 16,
   "description": "The digest, hex or base64."
  },
  "algorithm": {
   "enum": [
    "SHA1",
    "SHA256",
    "SHA512",
    "MD5"
   ],
   "type": "string",
   "default": "SHA1",
   "description": "Digest algorithm. SHA1 is what most registries publish for archives."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/paket-artifact-hash-lookup-295642ac/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from paket.halowerk.com](https://www.zero.xyz/host/paket.halowerk.com/llms.txt)