{"title":"The x402 endpoint preflight","version":"v1","summary":"Send a URL; we GET it once and report whether it answers a well-formed x402 v2 payment challenge: a 402 status, a parseable base64 PAYMENT-REQUIRED header, accepts entries a client can actually sign against, and structurally valid signed offers if declared. Free, no account. One probe, one moment — a shape check, never an uptime claim.","method":"POST","url":"https://scvd.store/api/preflight/v1","request":{"url":"REQUIRED. The https URL a buyer would GET expecting your 402 — your buy endpoint, not your homepage."},"rate_limit":"Two ceilings, both ours: a strict per-isolate bucket and a global best-effort cap of 60 probes/minute across all callers. Past either you get a 429 that says the budget is our cost bound, not a fact about your endpoint. The global cap is eventually-consistent, so it can run slightly generous — never tighter than stated. This endpoint makes one outbound GET per call to a host you chose; the cap is what keeps it a checker rather than a relay.","what_it_checks":["The endpoint answers 402 Payment Required (a 200 is the 'listed but functionally absent' failure; a redirect is refused, because payment clients refuse it too).","PAYMENT-REQUIRED header present and base64-JSON parseable — x402 v2 clients read the challenge there, not from the body.","x402Version is 2.","Every accepts entry carries scheme, network, amount, asset, payTo as strings — the same fields this store's own till refuses to sign offers without.","extensions.bazaar, if declared, carries a parseable info block (what discovery ingestion actually reads).","extensions['offer-receipt'] signed offers, if present, are structurally valid JWS. Their signatures are NOT verified here — that needs a second request to the issuer's did:web, which this probe refuses to make in your name. The conformance desk does it free."],"common_failures_this_catches":{"stuck_repeating_402":"A client that keeps getting 402 after attaching PAYMENT-SIGNATURE is very often paying against the wrong network: accepts offering eip155:84532 (Base Sepolia) or another testnet while the buyer is on Base mainnet, eip155:8453. The probe flags known testnets as an advisory.","listed_but_functionally_absent":"A directory lists your URL as an x402 endpoint but it answers 200, 404 or 500 instead of a 402. Independent probing found the majority of one directory's listings in this state. This is check one.","unparseable_challenge":"PAYMENT-REQUIRED header missing or not base64 JSON — surfaces client-side as 'Invalid payment header format' or a silent parse failure.","amount_units":"Amounts are ATOMIC units (USDC: 6 decimals, $0.005 = \"5000\"). A decimal point in an accepts amount usually means dollar-typed pricing, off by a factor of a million; the probe flags it.","after_verify_failures":"Facilitator codes like invalid_exact_evm_payload_signature or settle_exact_failed_onchain happen AFTER the challenge stage, at verify/settle time, and depend on the specific payment attempt — a preflight cannot catch them and this one does not pretend to. For the artifact half (do the signed offers verify against the issuer's published key), use POST https://scvd.store/api/conformance/v1."},"what_it_cannot_check":["Delivery. Whether anything real happens after payment is a fact about the world; the paid behavioral rung of this ladder is standing_watch.","Reliability. One probe is one moment; this is not a monitor and its output is not an uptime claim.","Verify/settle-time failures — wallet state, signatures over a specific payment, on-chain conditions. Those belong to the payment attempt, not the endpoint's shape."],"the_ladder":{"artifact":"https://scvd.store/api/conformance/v1 — any issuer's signed offer or receipt, verified free.","endpoint":"https://scvd.store/api/preflight/v1 — this tool.","this_moment_signed":"https://scvd.store/api/buy/service_audit — these exact checks, signed and bound into a certificate, served at a permanent report URL: for when you need to hand somebody the readout rather than run it.","across_a_week":"https://scvd.store/api/buy/conformance_watch — these exact checks once a day for seven days, each day signed alone: for catching a deploy that quietly breaks the challenge mid-week.","behavior":"https://scvd.store/api/buy/standing_watch — a paid, signed week of out-of-band hourly probes, for evidence rather than a readout."},"try_it_against_a_live_endpoint":"Any of this store's own buy URLs is a permanent, free, working example of what a passing challenge looks like — GET one and compare. We cannot probe our own hostname from inside the Worker (the platform forbids self-fetch), so CI proves the store passes these exact checks on every build instead, and you are encouraged to probe us from your side rather than take that on faith."}