# Paysafe Agent - Outgoing x402 Payment Security Scan

> Paysafe Agent - Outgoing x402 Payment Security Scan is a paid API for AI agents from paysafe-agent.com, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-14).

Screens an outgoing x402 payment for security risks including PII leaks, nonce replay, overpayment, prompt-injection triggers, asset authenticity, merchant pinning, velocity caps, and counterparty reputation, returning a signed allow/flag/block verdict.

## Facts

- Endpoint: POST https://paysafe-agent.com/v1/scan/outgoing
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/paysafe-agent-outgoing-x402-payment-security-scan-667039ab
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_agSrj-mZiQ9m-UROhHBDr

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability paysafe-agent-outgoing-x402-payment-security-scan-667039ab -d '<json body>'
```

Example prompt: Before I send this x402 USDC payment to merchant 0xABC...123 for $0.05 on base-sepolia — I expected it to cost $0.05 — can you run a full security scan on it using my agent ID 'agent-prod-7', checking that the payment description came from tool_result context and flagging any prompt injection, nonce replay, PII leaks, or overpayment risks?

## When to prefer this

Use this endpoint before executing any outgoing x402 payment from an AI agent, especially when the payment was triggered by fetched content, tool results, or user instructions that may have been manipulated. Prefer this over generic fraud checks when working specifically with x402 protocol payments on EVM networks with USDC, as it understands x402 semantics, canonical asset addresses, and agent-specific velocity limits.

## Known failure modes

- Payment object missing required fields returns validation error
- Unknown asset or non-canonical USDC address triggers block verdict
- Agent ID not provided may bypass velocity scoping
- Deep-tier scan may increase latency if force_deep is set
- Counterparty reputation database may not include newly registered merchants
- Nonce already seen returns replay-detected flag or block

## How this service works

Payment security firewall scan for an OUTGOING x402 payment: PII/secret leak detection in payment metadata, nonce replay detection, overpayment detection, prompt-injection-triggered payment analysis (fast + deep tiers), canonical-USDC asset verification, merchant pinning, velocity/spend caps, and counterparty reputation cross-check. Returns allow/flag/block with per-check reasons and an Ed25519-signed verdict. Advisory and non-custodial.

## Output

A JSON response containing an overall verdict of allow, flag, or block; per-check results with reasons for each security check (PII detection, nonce replay, overpayment, prompt injection, asset verification, merchant pinning, velocity/spend caps, counterparty reputation); and an Ed25519-signed verdict for tamper-proof auditability.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "policy": {
   "type": "object",
   "description": "Tiering overrides: force_deep / skip_deep for the deep content-analysis tier"
  },
  "context": {
   "type": "object",
   "description": "Provenance: origin (planning|user_instruction|tool_result|fetched_content|unknown), content (the content the agent just read), content_source_url"
  },
  "payment": {
   "type": "object",
   "description": "The x402 payment (or payment request) to screen: scheme, network, amount (atomic) or amount_usd, asset, pay_to, payer, resource_url, description, reason, nonce, metadata"
  },
  "agent_id": {
   "type": "string",
   "description": "Identifier of the scanning agent (scopes velocity limits)"
  },
  "expected_price_usd": {
   "type": "number",
   "description": "What the agent expected this to cost (USD)"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "checks": [
   {
    "id": "replay.nonce_reuse",
    "reason": "Nonce reuse detected: first seen 2026-07-14T09:00:00Z …",
    "verdict": "block",
    "severity": "critical"
   }
  ],
  "scan_id": "6f9c9d5e-…",
  "verdict": "block",
  "advisory": "Recommended action: DO NOT settle this payment. …",
  "direction": "outgoing",
  "risk_score": 95,
  "scanned_at": "2026-07-14T09:01:00Z",
  "attestation": {
   "alg": "ed25519",
   "message": "6f9c9d5e-…|outgoing|block|95|2026-07-14T09:01:00Z",
   "signature_hex": "…"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/paysafe-agent-outgoing-x402-payment-security-scan-667039ab/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from paysafe-agent.com](https://www.zero.xyz/host/paysafe-agent.com/llms.txt)