{"title":"The conformance desk","version":"v1","contract":"FROZEN. Fields in a v1 response are never removed and never change type; new ones may be added, and a reader that breaks on an unknown key was always going to break. Anything that cannot be done additively becomes /v2, and v1 keeps answering. Pin the versioned path if you are calling this from CI — an endpoint that quietly reshapes itself under a pipeline is worse than one that was never free.","rate_limit":"The offline path — supply public_key_hex — is unbounded, because checking a signature is microseconds of CPU. did:web resolution is budgeted, because it is an outbound request to a host you chose, held open up to three seconds. Past the budget nothing is denied: you get the shape and time checks with the signature unchecked and key_resolution: \"budget_exhausted\". No IP, cookie or identifier is used to do this; the budget is a plain global bucket, which means it bounds our cost rather than allocating fairly between callers, and that trade is deliberate.","summary":"Send an x402 signed offer or receipt; get back a structured verdict on whether it is well-formed, correctly signed and unexpired. Free, no wallet, no account, no rate card. Works on any issuer's artifacts, including issuers we compete with.","method":"POST","url":"https://scvd.store/api/conformance/v1","request":{"artifact":"REQUIRED. The compact JWS: three base64url segments, dot-separated.","kind":"Optional, \"offer\" or \"receipt\". Inferred from the payload when omitted.","public_key_hex":"Optional. Supply it and the check runs entirely offline — no network request is made in your name.","resolve_key":"Optional, defaults true when no public_key_hex is given. Set false to refuse did:web resolution and get a shape-and-time verdict only.","check_anchor":"Optional, default false. Asks whether the signing key appears in the issuer's ANCHORED key history at /.well-known/anchor-log.json — an append-only hash chain whose digests are submitted to OpenTimestamps. That answers \"was this key theirs at the time, provably un-rewritten\" rather than only \"does this signature verify against a key I chose to trust.\" One extra outbound request, reported in its own block and never folded into the verdict, because almost no issuer publishes one and absence is not a fault."},"what_it_checks":["The JWS parses into three segments with JSON header and payload.","alg is EdDSA. Nothing else is accepted, and `none` is not a special case here because it never reaches the signature step.","The payload carries every required field for its kind.","The signature verifies against the key named in the kid.","Optionally (check_anchor), whether the key appears in the issuer's externally anchored key history — a different and harder question than signature validity, reported in its own block.","Whether the offer is still live — reported separately as `live`, never folded into the verdict, because an expired offer is a valid artifact you simply cannot pay against."],"required_fields":{"offer":["version","resourceUrl","scheme","network","asset","payTo","amount","validUntil"],"receipt":["version","network","resourceUrl","payer","issuedAt"]},"what_it_cannot_tell_you":["THIS IS THE ARTIFACT YOU GAVE US, not the artifact an issuer served. We did not fetch it from their origin and cannot say they ever published it. A well-formed forgery of a schema is still well-formed.","CONFORMANCE IS NOT ENDORSEMENT. A passing offer says the document is shaped correctly and signed by the key it names. It says nothing about whether the seller delivers, prices honestly, or exists tomorrow.","WE CHECK STRUCTURE, SIGNATURE AND TIME. Not the goods, not the settlement, not whether the amount matches what was charged.","THE KEY WAS READ NOW, AND THE ARTIFACT WAS SIGNED THEN. A did:web document shows only today's key. If the issuer rotated since signing, a genuine artifact fails here, and if they rotated after a compromise, a fraudulent one could pass. Issuers who publish key history with each handover signed by the OUTGOING key close that gap; most do not, and we cannot tell you which case you are in."],"our_conflict_of_interest":"WE COMPETE WITH SOME OF THE ISSUERS YOU MIGHT SEND US. This store sells x402 goods; a verdict about a rival's artifact from us is worth exactly as much as the method behind it. That method is MIT-licensed, zero-dependency and identical to the file this endpoint runs — so the correct amount of trust to place in this response is none, and the correct thing to do with a verdict that matters is reproduce it offline.","run_it_yourself":"https://github.com/seancrecord/scvd-general-store-repo/tree/main/verifier — same code, runs on your machine, no network needed if you supply the public key. If this endpoint and that file ever disagree, the file is right and we want to hear about it at /api/letter.","why_it_is_free":"Because the useful version of a conformance check is one an agent reaches for without a decision, and a price is a decision. It also keeps us honest: a paid verdict has a customer, and a customer for a verdict is how verdicts start bending.","mailbox":"https://scvd.store/api/letter"}