# Synthex Forge x402 Authorized Red Team Scan

> Synthex Forge x402 Authorized Red Team Scan is a paid API for AI agents from x402.synthexforge.com, paid per call via x402, $0.25/call, status unknown (last checked 2026-10-23).

Executes a paid, authorized red team security scan against a target URL, returning a signed attestation of findings with Ed25519 + SHA-256 proof.

## Facts

- Endpoint: POST https://x402.synthexforge.com/v1/security/redteam/authorized-scan?utm_source=zero.xyz
- Price: $0.25/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-23
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/synthex-forge-x402-authorized-red-team-scan-591f0c06
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_okvHD_03WNYq3_vLqZqW5

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability synthex-forge-x402-authorized-red-team-scan-591f0c06 -d '<json body>'
```

Example prompt: Run an authorized red team scan on https://app.mycompany.com — include SQL injection and XSS tests, scope it to the login and checkout flows, and provide the authorization evidence from our signed engagement letter.

## When to prefer this

Choose this endpoint when you need not just a security scan but a cryptographically signed, attestable record of an authorized red team engagement — especially for compliance, SOC2, or governance requirements where proof of authorization and Ed25519-signed artifacts are mandatory. Prefer this over generic scanning tools when the auditability and blockchain-payment provenance of the engagement matter.

## Known failure modes

- Missing or invalid authorization_evidence causes rejection of the request
- target_url not reachable or out of scope returns an error
- Insufficient USDC balance or payment failure results in HTTP 402 with payment-required envelope
- Invalid authorized_tests values not recognized by the scan engine
- Scope description too vague causes scan to be rejected for governance reasons

## How this service works

Synthex Forge x402 Receive: 41 paid verification, attestation and governance endpoints (Ed25519 + SHA-256 signed artifacts) plus free verify/public-key/standard sibling routes. Paid routes answer HTTP 402 with an x402 v2 `payment-required` envelope (atomic USDC on Base mainnet, chain ID 8453). Free routes are declared with `security: []` per the x402scan discovery spec.

## Output

Returns a JSON object with an 'ok' boolean confirming the scan was accepted, along with a signed attestation artifact (Ed25519 + SHA-256) documenting the authorized scan execution, findings summary, and scope confirmation suitable for governance and compliance records.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "target_url": {
   "type": "string"
  },
  "authorized_tests": {
   "type": "array"
  },
  "scope_description": {
   "type": "string"
  },
  "authorization_evidence": {
   "type": "array"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/synthex-forge-x402-authorized-red-team-scan-591f0c06/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402.synthexforge.com](https://www.zero.xyz/host/x402.synthexforge.com/llms.txt)