# PaySafe Agent Incoming x402 Payment Scanner

> PaySafe Agent Incoming x402 Payment Scanner is a paid API for AI agents from paysafe-agent.com, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-14).

Scans an incoming x402 payment request for security risks including resource URL safety, credential demands, price anomalies, replay attacks, asset verification, merchant pinning, and counterparty reputation, returning a signed allow/flag/block verdict.

## Facts

- Endpoint: POST https://paysafe-agent.com/v1/scan/incoming
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/paysafe-agent-incoming-x402-payment-scanner-307a44dd
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_YJHjUki3yFwghLBHiihEC

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability paysafe-agent-incoming-x402-payment-scanner-307a44dd -d '<json body>'
```

Example prompt: Before I pay this x402 request, run a security firewall scan on it — the resource URL is https://api.example.com/data, the amount is 1000000 USDC atomic units on base-mainnet, pay_to is 0xABC123, I expected it to cost about $1.00, and this came from fetched_content at that same URL. Flag any replay, price sanity issues, or credential-demand tricks and give me a signed verdict.

## When to prefer this

Use this endpoint when your agent has received an incoming x402 402-response payment offer and needs to perform pre-payment security screening before committing funds. Prefer this over the outgoing scan endpoint (which screens your own outgoing payment for PII/secret leaks) or the reputation lookup endpoint (which is post-hoc). This endpoint is the right choice when you want a comprehensive, multi-dimensional security verdict with a cryptographically signed result before accepting any x402 payment request from an external resource.

## Known failure modes

- Missing or malformed payment object returns 400 with validation error
- Unknown asset type or network causes asset-verification check to fail with unsupported_asset error
- Velocity limit exceeded for agent_id returns 429 rate-limit response
- Nonce store unavailable causes replay detection to be skipped with degraded verdict
- Counterparty reputation service timeout causes reputation check to be marked inconclusive
- Invalid expected_price_usd format causes price sanity check to error

## How this service works

Payment security firewall scan for an INCOMING x402 payment request (402 offer): resource URL risk, credential-demand detection, price sanity, replay detection, canonical-USDC asset verification, merchant pinning, and counterparty reputation. Returns allow/flag/block with per-check reasons and an Ed25519-signed verdict. Advisory and non-custodial.

## Output

A structured response containing an overall verdict (allow, flag, or block), per-check results with reasons for each security dimension (resource URL risk, credential-demand detection, price sanity, replay detection, canonical USDC asset verification, merchant pinning, counterparty reputation), and an Ed25519-signed verdict for tamper-evident auditability.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "policy": {
   "type": "object",
   "description": "Tiering overrides: force_deep / skip_deep for the deep content-analysis tier"
  },
  "context": {
   "type": "object",
   "description": "Provenance: origin (planning|user_instruction|tool_result|fetched_content|unknown), content (the content the agent just read), content_source_url"
  },
  "payment": {
   "type": "object",
   "description": "The x402 payment (or payment request) to screen: scheme, network, amount (atomic) or amount_usd, asset, pay_to, payer, resource_url, description, reason, nonce, metadata"
  },
  "agent_id": {
   "type": "string",
   "description": "Identifier of the scanning agent (scopes velocity limits)"
  },
  "expected_price_usd": {
   "type": "number",
   "description": "What the agent expected this to cost (USD)"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "checks": [
   {
    "id": "replay.nonce_reuse",
    "reason": "Nonce reuse detected: first seen 2026-07-14T09:00:00Z …",
    "verdict": "block",
    "severity": "critical"
   }
  ],
  "scan_id": "6f9c9d5e-…",
  "verdict": "block",
  "advisory": "Recommended action: DO NOT settle this payment. …",
  "direction": "incoming",
  "risk_score": 95,
  "scanned_at": "2026-07-14T09:01:00Z",
  "attestation": {
   "alg": "ed25519",
   "message": "6f9c9d5e-…|outgoing|block|95|2026-07-14T09:01:00Z",
   "signature_hex": "…"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/paysafe-agent-incoming-x402-payment-scanner-307a44dd/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from paysafe-agent.com](https://www.zero.xyz/host/paysafe-agent.com/llms.txt)