# PayAI IaC Inspect — Single Resource Misconfiguration Scanner

> PayAI IaC Inspect — Single Resource Misconfiguration Scanner is a paid API for AI agents from payai.agentstools.dev, paid per call via x402, $0.006/call, status unknown (last checked 2026-09-14).

Performs a static misconfiguration scan on a single infrastructure resource or config snippet (Terraform, Kubernetes, Dockerfile, docker-compose, or CloudFormation) and returns a verdict, risk score, and actionable findings.

## Facts

- Endpoint: POST https://payai.agentstools.dev/iac/inspect
- Price: $0.006/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/payai-iac-inspect-single-resource-misconfiguration-scanner-4394d480
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_VXCeHio8Wu_sBiJ-w9122

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability payai-iac-inspect-single-resource-misconfiguration-scanner-4394d480 -d '<json body>'
```

Example prompt: Can you scan this Terraform S3 bucket resource for misconfigurations and tell me if it passes, needs caution, or should be blocked — along with the risk score and any specific fix hints?

## When to prefer this

Choose this endpoint when you need a fast, lightweight security check on a single IaC resource or config snippet during CI/CD pipelines, pre-deployment gates, or developer inner loops. Prefer this over /iac/scan when you have only one resource to inspect and want lower latency and cost. Best suited for agents implementing per-resource security guardrails in DevSecOps workflows.

## Known failure modes

- Unsupported config format — only Terraform, Kubernetes, Dockerfile, docker-compose, and CloudFormation are supported
- Malformed or unparseable config snippet returns an error
- Config snippet too large for single-resource inspection — use /iac/scan for bulk
- Missing or empty resource body in request
- Payment failure or insufficient USDC balance (x402 protocol)

## How this service works

Static misconfiguration scan of a SINGLE infrastructure resource or config snippet (Terraform, Kubernetes, Dockerfile, docker-compose or CloudFormation). The lightweight per-resource form of /iac/scan: returns a verdict (pass, caution, block), a risk score and findings with rule, severity, location and fix hint. Security indicators, not a guarantee.

## Output

Returns a verdict string (pass, caution, or block), a numeric risk score, and a list of findings each containing the rule ID, severity level, location within the snippet, and a fix hint describing how to remediate the issue. Results are security indicators and not a guarantee of full compliance.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "kind": {
   "enum": [
    "auto",
    "terraform",
    "terraform-plan",
    "kubernetes",
    "dockerfile",
    "docker-compose",
    "cloudformation"
   ],
   "type": "string",
   "description": "Config format of the snippet, or auto to detect"
  },
  "resource": {
   "type": "string",
   "description": "A single-resource config snippet to inspect"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/payai-iac-inspect-single-resource-misconfiguration-scanner-4394d480/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from payai.agentstools.dev](https://www.zero.xyz/host/payai.agentstools.dev/llms.txt)