# x402 Preflight Audit

> x402 Preflight Audit is a paid API for AI agents from x402.chikocorp.com, paid per call via x402, $0.05/call, status unknown (last checked 2026-10-10).

Inspects and validates an x402 payment-gated endpoint before an autonomous agent commits USDC, returning a trust score, payment details, CORS compliance, and per-check results.

## Facts

- Endpoint: POST https://x402.chikocorp.com/api/x402/preflight/audit?utm_source=zero.xyz
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-10
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/x402-preflight-audit-8481fd04
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_K7IvjlGmqZVbmqCcVspPd

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability x402-preflight-audit-8481fd04 -d '<json body>'
```

Example prompt: Before my agent pays, audit the x402 endpoint at https://example.com/api/resource using a GET request and flag anything suspicious — especially if the price or network looks wrong.

## When to prefer this

Use this endpoint whenever an autonomous agent is about to call an unknown or untrusted x402-gated resource and needs to verify legitimacy, confirm price and network, check CORS compatibility, and get a trust score before committing funds. Prefer this over calling the x402 endpoint directly when you want a read-only, no-payment inspection pass.

## Known failure modes

- Resource URL is not a valid HTTPS URL — returns validation error
- Target endpoint is not an x402 resource (no 402 response) — returns FAIL checks
- Network timeout reaching the target endpoint — returns UNKNOWN status checks
- max_price_usd mismatch causes score penalty or WARN decision
- expected_network mismatch between policy and observed network — FAIL check
- Malformed or missing payment headers on target — FAIL on payment checks
- CORS headers absent or misconfigured — browserAgentCompatible=false

## How this service works

Inspect and validate an x402 endpoint before an autonomous agent spends USDC.

## Output

Returns a structured audit report including: an integer trust score (0–100), a decision (ALLOW or WARN/DENY), detailed per-check results with PASS/WARN/FAIL/UNKNOWN status and evidence, payment metadata (asset address, payTo, price in USD, network, facilitator, x402 version), CORS header analysis with browser-agent compatibility flag, discovery metadata (llms.txt, openapi.json, x402.json, agent.json presence and validity), observed and expiry timestamps, and a list of issues flagged during inspection.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "bodyType",
    "body"
   ],
   "properties": {
    "body": {
     "type": "object",
     "required": [
      "resource_url"
     ],
     "properties": {
      "method": {
       "enum": [
        "GET",
        "HEAD",
        "POST"
       ],
       "type": "string",
       "default": "GET"
      },
      "resource_url": {
       "type": "string",
       "pattern": "^https://",
       "maxLength": 2048,
       "description": "Public HTTPS x402 resource to inspect without payment credentials."
      },
      "max_price_usd": {
       "type": "number",
       "maximum": 1000000,
       "minimum": 0
      },
      "expected_network": {
       "type": "string",
       "pattern": "^[a-z0-9]+:[A-Za-z0-9._-]+$",
       "maxLength": 100
      }
     },
     "additionalProperties": false
    },
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "POST"
     ],
     "type": "string"
    },
    "bodyType": {
     "enum": [
      "json",
      "form-data",
      "text"
     ],
     "type": "string"
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "required": [
      "profile",
      "decision",
      "score",
      "requestId",
      "observedAt",
      "expiresAt",
      "resource",
      "payment",
      "cors",
      "checks",
      "issues",
      "discovery",
      "operational",
      "evidence",
      "claimBoundary"
     ],
     "properties": {
      "cors": {
       "type": "object",
       "required": [
        "allowOrigin",
        "allowMethods",
        "allowHeaders",
        "exposeHeaders",
        "allowCredentials",
        "browserAgentCompatible"
       ],
       "properties": {
        "allowOrigin": {
         "type": [
          "string",
          "null"
         ]
        },
        "allowHeaders": {
         "type": "array",
         "items": {
          "type": "string"
         }
        },
        "allowMethods": {
         "type": "array",
         "items": {
          "type": "string"
         }
        },
        "exposeHeaders": {
         "type": "array",
         "items": {
          "type": "string"
   
… (truncated)
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "cors": {
   "allowOrigin": "*",
   "allowHeaders": [
    "CONTENT-TYPE",
    "PAYMENT-SIGNATURE"
   ],
   "allowMethods": [
    "POST",
    "OPTIONS"
   ],
   "exposeHeaders": [
    "PAYMENT-REQUIRED",
    "PAYMENT-RESPONSE"
   ],
   "allowCredentials": null,
   "browserAgentCompatible": true
  },
  "score": 100,
  "checks": [
   {
    "id": "payment.network_matches_policy",
    "status": "PASS",
    "evidence": "Published network is eip155:8453.",
    "severity": "info"
   }
  ],
  "issues": [],
  "payment": {
   "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
   "payTo": "0x820a7bf90d944bb26bfD9b62Ab172Fc3A0829cB9",
   "bazaar": {
    "type": "http",
    "found": true,
    "valid": true,
    "method": "POST",
    "toolName": null,
    "description": null,
    "examplePresent": true,
    "inputSchemaPresent": true,
    "outputSchemaPresent": true
   },
   "scheme": "exact",
   "network": "eip155:8453",
   "detected": true,
   "priceUsd": 0.05,
   "facilitator": "https://facilitator.world.fun",
   "x402Version": 2,
   "amountAtomic": "50000",
   "challengeSource": "header",
   "maxTimeoutSeconds": 300
  },
  "profile": "audit",
  "decision": "ALLOW",
  "evidence": [
   {
    "id": "resource.response",
    "source": "https://example.com/api/resource",
    "observation": "HTTP 402 in 210 ms; 0 response bytes."
   }
  ],
  "resource": {
   "url": "https://example.com/api/resource",
   "method": "GET",
   "finalUrl": "https://example.com/api/resource",
   "latencyMs": 210,
   "statusCode": 402
  },
  "discovery": {
   "llmsTxt": {
    "url": "https://example.com/llms.txt",
    "valid": true,
    "present": true,
    "consistent": true,
    "statusCode": 200,
    "contentType": "text/plain"
   },
   "openapi": {
    "url": "https://example.com/openapi.json",
    "valid": true,
    "present": true,
    "consistent": true,
    "statusCode": 200,
    "contentType": "application/json"
   },
   "x402Metadata": {
    "url": "https://example.com/.well-known/x402.json",
    "valid": true,
    "present": true,
    "consistent": true,
    "statusCode": 200,
    "contentType": "application/json"
   },
   "agentMetadata": {
    "url": "https://example.com/.well-known/agent.json",
    "valid": true,
    "present": true,
    "consistent": true,
    "statusCode": 200,
    "contentType": "application/json"
   }
  },
  "expiresAt": "2026-08-06T00:15:00.000Z",
  "requestId": "req_example1234",
  "observedAt": "2026-08-06T00:00:00.000Z",
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/x402-preflight-audit-8481fd04/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402.chikocorp.com](https://www.zero.xyz/host/x402.chikocorp.com/llms.txt)