x402 resource binding audit derived
api.zfinia.comMarket dataderived
POST https://api.zfinia.com/x402/v1/x402-resource-binding-audit
passabsent from every registry#7 by calls of 15 on this host
0.12 USDC
per call, as the listing declares it on eip155:
Compare with anotherEvery figure as JSONCite this page
the price, as of 2026-10-04 21:22 UTC · method
- Validation state
- pass
- Uptime, 7 / 30 / 90 days
- — / 100% / 100%
- Calls, trailing 30 days
- 1
- Unique payers, trailing 30 days
- 1
- Last called
- 2026-10-04 08:07 UTC
- First observed by TOLLderived
- 2026-10-04
- Pricederived
- 0.12 USDC
- Networks
- 1
How big is this endpoint among the ones like it?
No trace is drawn of this endpoint’s own volume. Its counters have changed 1 time across 2 observations, and 3 changes are the fewest this site will draw a trace through, because two points and a guess are not a series. Every observation is in the JSON.
x402 resource binding audit is one of 15 listed endpoints on api.zfinia.com, tied 7th by calls with 9 others among them.
x402 resource binding audit takes a json body with the fields observations and expected_host.
A response from x402 resource binding audit, as declared, includes limits, passed, complete, findings, all_bound, request_id and 2 others.
x402 resource binding audit drew a single call from a single payer in the trailing 30 days.
The last call to x402 resource binding audit came 9 days before the snapshot, 2026-10-04.
On Base, x402 resource binding audit asks 0.12 USDC per call.
It accounts for 4% of the calls counted across the host.
TOLL files x402 resource binding audit under market data: a POST endpoint on api.zfinia.com, listed in neither registry at the last pull.
x402 resource binding audit answered the sweep of 2026-10-04 with a valid 402, as at every sweep since 2026-10-04.
Closest in price to x402 resource binding audit within market data: send token at keyring-agent.blockchhub.link and distribution balance exchanges relative at x402.glassnode.com.
x402 resource binding audit is near the top of prices in market data; 96% of comparable listings are cheaper.
The wallet paid by x402 resource binding audit is the payee of 179 endpoints across 5 hosts.
Seller tags: x402, machine payments, resource binding and integrity.
x402 resource binding audit was missing from the Coinbase registry at the pull of 2026-10-05, confirmed at the pull of 2026-10-05; that is registry presence, not liveness.
Where the sentences above compare this endpoint with others, the comparison is against the index as it stands now, live; the figures above are final.
the payment options, as of 2026-10-04 21:22 UTC · method
| registry | network | asset | amount | scheme | pay to |
|---|---|---|---|---|---|
| Coinbase | eip155: | USDC | 0.12 USDC | exact | 0x25e824…6a9608 |
the checks, as of 2026-10-04 13:12 UTC · methodendpoint answered HTTP 402
No named check failed.
Every sweep that observed this endpoint, newest first.
| observed, UTC | state | failed checks | sweep |
|---|---|---|---|
| 2026-10-04 13:12 UTC | pass | 0 | daily-2026-10-04 |
| 2026-10-04 12:41 UTC | pass | 0 | new-after-daily-2026-10-04 |
Presence in a registry, not liveness of the service (method). Newest first.
- absence from Coinbase confirmed, rule v1
- absent from Coinbase at this pull
- listed in Coinbase
From the registry record, not validated by TOLL.the declared schema, as of 2026-10-04 08:07 UTC · method
The input and output block
{
"input": {
"body": {
"observations": [
{
"url": "https://api.merchant.test/v1/score",
"challenge": {
"accepts": [
{
"asset": "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913",
"payTo": "0xa1b2c30000000000000000000000000000009f8e",
"amount": "5000",
"scheme": "exact",
"network": "eip155:8453"
}
],
"resource": {
"url": "https://api.merchant.test/v1/score",
"mimeType": "application/json",
"description": "Paid resource at https://api.merchant.test/v1/score"
},
"extensions": {
"bazaar": {
"schema": {
"properties": {
"input": {
"type": "object"
},
"output": {
"type": "object"
}
}
}
}
},
"x402Version": 2
}
},
{
"url": "https://api.merchant.test/v1/enrich",
"challenge": {
"accepts": [
{
"asset": "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913",
"payTo": "0xa1b2c30000000000000000000000000000009f8e",
"amount": "5000",
"scheme": "exact",
"network": "eip155:8453"
}
],
"resource": {
"url": "https://api.merchant.test/v1/score",
"mimeType": "application/json",
"description": "Paid resource at https://api.merchant.test/v1/score"
},
"extensions": {
"bazaar": {
"schema": {
"properties": {
"input": {
"type": "object"
},
"output": {
"type": "object"
}
}
}
}
},
"x402Version": 2
}
},
{
"url": "https://api.merchant.test/v1/hijacked",
"challenge": {
"accepts": [
{
"asset": "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913",
"payTo": "0xffffffffffffffffffffffffffffffffffffffff",
"amount": "5000",
"scheme": "exact",
"network": "eip155:8453"
}
],
"resource": "http://collector.elsewhere.test/v1/hijacked",
"x402Version": 2
}
}
],
"expected_host": "api.merchant.test"
},
"type": "http",
"method": "POST",
"bodyType": "json"
},
"output": {
"type": "json",
"example": {
"limits": {
"maxAssets": 100,
"maxAccepts": 20,
"maxFindings": 500,
"maxNetworks": 50,
"maxResources": 500,
"maxChallenges": 200
},
"passed": false,
"complete": true,
"findings": [
{
"url": "https://api.merchant.test/v1/enrich",
"code": "RESOURCE_PATH_DIFFERS",
"detail": "https://api.merchant.test/v1/enrich served a challenge naming https://api.merchant.test/v1/score. Paying it would satisfy a requirement for a different resource.",
"challenge": 1,
"declared_resource": "https://api.merchant.test/v1/score"
},
{
"url": "https://api.merchant.test/v1/hijacked",
"code": "RESOURCE_HOST_DIFFERS",
"detail": "https://api.merchant.test/v1/hijacked served a challenge naming http://collector.elsewhere.test/v1/hijacked, which is a different host entirely. Paying it would satisfy a requirement for a different r...",
"challenge": 2,
"declared_resource": "http://collector.elsewhere.test/v1/hijacked"
},
{
"url": "https://api.merchant.test/v1/hijacked",
"code": "RESOURCE_NOT_HTTPS",
"detail": "http://collector.elsewhere.test/v1/hijacked is not an https URL, so the requirement is not transport protected.",
"challenge": 2
}
],
"all_bound": false,
"request_id": "example-request",
"service_id": "x402_resource_binding_audit",
"assumptions": [
"Nothing is fetched and nothing is paid. Each observation is a URL the caller probed and the challenge it received.",
"A mismatch on the host is reported differently from a mismatch on the path, because the first is a stronger signal that the challenge did not come from where it claims.",
"x402 version 2 carries the resource as an object. A bare string under version 2 is named, because a client reading resource.url against a string gets undefined and silently stops checking the binding."
],
"bound_count": 1,
"limitations": [
"Binding between each supplied URL and the challenge supplied with it. Whether the challenge genuinely came from that URL rests on the caller having captured it correctly.",
"all_bound is true only when every observation decoded and every declared resource matched the URL it was served from."
],
"observed_at": "2026-10-02T00:00:00.000Z",
"not_examined": [],
"observations": [
{
"verdict": "bound",
"version": 2,
"probed_url": "https://api.merchant.test/v1/score",
"declared_resource": "https://api.merchant.test/v1/score",
"resource_is_object": true
},
{
"verdict": "mismatched",
"version": 2,
"probed_url": "https://api.merchant.test/v1/enrich",
"declared_resource": "https://api.merchant.test/v1/score",
"resource_is_object": true
},
{
"verdict": "mismatched",
"version": 2,
"probed_url": "https://api.merchant.test/v1/hijacked",
"declared_resource": "http://collector.elsewhere.test/v1/hijacked",
"resource_is_object": false
}
],
"payment_sent": false,
"finding_count": 5,
"service_version": "1.0.0",
"findings_by_code": {
"RESOURCE_NOT_HTTPS": 1,
"RESOURCE_HOST_DIFFERS": 1,
"RESOURCE_PATH_DIFFERS": 1,
"RESOURCE_NOT_AN_OBJECT": 1,
"RESOURCE_HOST_UNEXPECTED": 1
},
"examined_observation_count": 3,
"supplied_observation_count": 3
}
}
}Cite this page
This endpoint is delisted: the page is frozen at its last observation and its live URL is the stable one. Data reuse is under CC BY 4.0 (terms).
Plain text
TOLL, "x402 resource binding audit on api.zfinia.com". https://tollindex.com/e/api-zfinia-com-x402-v1-x402-resource-binding-audit-9a07f7. Accessed [access date].
BibTeX
@misc{toll-e-api-zfinia-com-x402-v1-x402-resource-binding-audit-9a07f7-2026-10-13,
author = {TOLL},
title = {x402 resource binding audit on api.zfinia.com},
howpublished = {\url{https://tollindex.com/e/api-zfinia-com-x402-v1-x402-resource-binding-audit-9a07f7}},
year = {2026},
month = {10},
note = {Frozen at its last observation, 2026-10-13 14:08 UTC. Accessed [access date].}
}None yet. Anything submitted through the form below is published here with its outcome.