{"what_this_is":"The free conformance desk: POST any issuer's x402 signed offer or receipt and get a structured verdict. No account, no wallet, no 402 — and it checks a competitor's artifact exactly as readily as ours.","endpoint":"https://scvd.store/api/conformance/v1","endpoint_shape_check":"https://scvd.store/api/preflight/v1","census":"A census of every host on the public x402 discovery list (2026-08-03, one GET each, reproducible by anyone via the free checker at POST /api/preflight/v1) found 34 of 35 hosts serve no signed offers at all — and the one attempting them serves offers that fail JWS parsing before a verifier reads a single field.","why_it_matters":"A 402 without a signed offer asks the buyer to pay against terms nobody committed to. With one, the buyer holds a pre-payment commitment — price, asset, payTo, expiry — checkable against the issuer's published key by anyone, forever, without asking the issuer. In a market of autonomous buyers deciding whom to trust mechanically, that is the cheapest trust signal a seller can ship, and as of the census almost nobody ships it.","packages":{"x402-verify":{"what":"The desk's own method as a zero-dependency MIT npm package, so every verdict can be reproduced offline without trusting this store.","source":"https://github.com/seancrecord/scvd-general-store-repo/tree/main/verifier"},"x402-sign":{"what":"The other half: issue your own x402 signed offers and receipts, so your 402 carries a pre-payment commitment a buyer can verify.","source":"https://github.com/seancrecord/scvd-general-store-repo/tree/main/signer"}},"conformance_vectors":"https://scvd.store/.well-known/conformance/offer-receipt-vectors.json","desk":{"title":"The conformance desk","version":"v1","contract":"FROZEN. Fields in a v1 response are never removed and never change type; new ones may be added, and a reader that breaks on an unknown key was always going to break. Anything that cannot be done additively becomes /v2, and v1 keeps answering. Pin the versioned path if you are calling this from CI — an endpoint that quietly reshapes itself under a pipeline is worse than one that was never free.","rate_limit":"The offline path — supply public_key_hex — is unbounded, because checking a signature is microseconds of CPU. did:web resolution is budgeted, because it is an outbound request to a host you chose, held open up to three seconds. Past the budget nothing is denied: you get the shape and time checks with the signature unchecked and key_resolution: \"budget_exhausted\". No IP, cookie or identifier is used to do this; the budget is a plain global bucket, which means it bounds our cost rather than allocating fairly between callers, and that trade is deliberate.","summary":"Send an x402 signed offer or receipt; get back a structured verdict on whether it is well-formed, correctly signed and unexpired. Free, no wallet, no account, no rate card. Works on any issuer's artifacts, including issuers we compete with.","method":"POST","url":"https://scvd.store/api/conformance/v1","request":{"artifact":"REQUIRED. The compact JWS: three base64url segments, dot-separated.","kind":"Optional, \"offer\" or \"receipt\". Inferred from the payload when omitted.","public_key_hex":"Optional. Supply it and the check runs entirely offline — no network request is made in your name.","resolve_key":"Optional, defaults true when no public_key_hex is given. Set false to refuse did:web resolution and get a shape-and-time verdict only.","check_anchor":"Optional, default false. Asks whether the signing key appears in the issuer's ANCHORED key history at /.well-known/anchor-log.json — an append-only hash chain whose digests are submitted to OpenTimestamps. That answers \"was this key theirs at the time, provably un-rewritten\" rather than only \"does this signature verify against a key I chose to trust.\" One extra outbound request, reported in its own block and never folded into the verdict, because almost no issuer publishes one and absence is not a fault."},"what_it_checks":["The JWS parses into three segments with JSON header and payload.","alg is EdDSA. Nothing else is accepted, and `none` is not a special case here because it never reaches the signature step.","The payload carries every required field for its kind.","The signature verifies against the key named in the kid.","Optionally (check_anchor), whether the key appears in the issuer's externally anchored key history — a different and harder question than signature validity, reported in its own block.","Whether the offer is still live — reported separately as `live`, never folded into the verdict, because an expired offer is a valid artifact you simply cannot pay against."],"required_fields":{"offer":["version","resourceUrl","scheme","network","asset","payTo","amount","validUntil"],"receipt":["version","network","resourceUrl","payer","issuedAt"]},"what_it_cannot_tell_you":["THIS IS THE ARTIFACT YOU GAVE US, not the artifact an issuer served. We did not fetch it from their origin and cannot say they ever published it. A well-formed forgery of a schema is still well-formed.","CONFORMANCE IS NOT ENDORSEMENT. A passing offer says the document is shaped correctly and signed by the key it names. It says nothing about whether the seller delivers, prices honestly, or exists tomorrow.","WE CHECK STRUCTURE, SIGNATURE AND TIME. Not the goods, not the settlement, not whether the amount matches what was charged.","THE KEY WAS READ NOW, AND THE ARTIFACT WAS SIGNED THEN. A did:web document shows only today's key. If the issuer rotated since signing, a genuine artifact fails here, and if they rotated after a compromise, a fraudulent one could pass. Issuers who publish key history with each handover signed by the OUTGOING key close that gap; most do not, and we cannot tell you which case you are in."],"our_conflict_of_interest":"WE COMPETE WITH SOME OF THE ISSUERS YOU MIGHT SEND US. This store sells x402 goods; a verdict about a rival's artifact from us is worth exactly as much as the method behind it. That method is MIT-licensed, zero-dependency and identical to the file this endpoint runs — so the correct amount of trust to place in this response is none, and the correct thing to do with a verdict that matters is reproduce it offline.","run_it_yourself":"https://github.com/seancrecord/scvd-general-store-repo/tree/main/verifier — same code, runs on your machine, no network needed if you supply the public key. If this endpoint and that file ever disagree, the file is right and we want to hear about it at /api/letter.","why_it_is_free":"Because the useful version of a conformance check is one an agent reaches for without a decision, and a price is a decision. It also keeps us honest: a paid verdict has a customer, and a customer for a verdict is how verdicts start bending.","mailbox":"https://scvd.store/api/letter"}}