# x402lint API Scanner

> x402lint API Scanner is a paid API for AI agents from api.x402lint.dev, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-14).

Runs 25 compliance checks against an x402-enabled API origin and returns a grade, score, per-check results with fix instructions, and a shareable report URL.

## Facts

- Endpoint: POST https://api.x402lint.dev/v1/scan
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/x402lint-api-scanner-7cfb7790
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_KNPCbEV0g1egkvc8dkSyS

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability x402lint-api-scanner-7cfb7790 -d '<json body>'
```

Example prompt: Run an x402lint compliance scan on https://api.example.dev and tell me the grade, score, and what I need to fix to pass all 25 checks.

## When to prefer this

Use this endpoint when you need to validate that an HTTP origin correctly implements the x402 payment protocol across all 25 spec checks, including cases where the origin is down or broken. Prefer this over manual testing when you want structured per-check evidence and actionable fix instructions, or when you need a shareable compliance report URL. It covers read-only GET/HEAD probes so it is safe to run against production APIs.

## Known failure modes

- Origin is unreachable — returns a valid F-grade result rather than an error
- 504 timeout during processing — not charged, should be retried
- Invalid or malformed URL input — likely returns a 4xx error with description
- Cached result may be up to 24 hours stale for recently changed origins

## How this service works

Paid ($0.05). ALWAYS runs a fresh 25-check scan of the origin (non-settling GET/HEAD + benign empty-POST probes), bypassing the 24h cache — use free GET /v1/report to read the cached result. Concurrent requests for the same origin join the in-flight scan rather than double-scanning. Returns grade, score, per-check status + evidence + fix instructions, and a shareable report URL. Unreachable/broken origins are a valid graded result (F). 504 processing responses and errors are never charged.

## Output

Returns an overall compliance grade (A–F), a numeric score, the status of each of the 25 individual checks along with evidence collected and specific fix instructions, and a shareable report URL. Unreachable or broken origins receive a valid graded result (F). Results may be served from a cache up to 24 hours old. 504 responses and errors are never charged.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "description": "Origin to scan, e.g. https://api.example.dev"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "cache": "miss",
  "grade": "B",
  "score": 82,
  "origin": "https://api.example.dev",
  "results": [
   {
    "id": "P2",
    "status": "pass",
    "evidence": "/v1/thing bare GET → 402 with x402Version=2",
    "severity": "critical"
   }
  ],
  "reportUrl": "https://x402lint.dev/o/api.example.dev",
  "scannedAt": "2026-07-25T04:00:00Z",
  "checksVersion": "2026-07-25.1"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/x402lint-api-scanner-7cfb7790/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.x402lint.dev](https://www.zero.xyz/host/api.x402lint.dev/llms.txt)