# The Once-Over

_one signed check of your x402 endpoint, at a permanent URL_


X402 conformance audit, signed, one endpoint at one moment.

## At a glance

- **Attests:** The whole report: the audited URL, the moment, the criteria version, the verdict, every check and advisory, and the report's evidence hash. The purchase certificate binds the same evidence hash in its attests field.
- **Input:** url (query parameters; input schema and checkout: https://scvd.store/menu/service_audit?view=compact)
- **Output:** A signed JSON audit report — verdict (ready, not_ready or unreachable), every check and advisory from the published preflight battery, dated, its evidence hash bound into the purchase certificate's attests field — plus a stable report URL serving the record free forever. Instant; one GET at one moment, never monitoring. Every artifact carries a cert_id and verifies free at https://scvd.store/api/verify/{cert_id}.
- **Cryptography:** ed25519 signature by this store's key, published at https://scvd.store/.well-known/scvd-signing-key and carried inside every 402
- **Verify:** GET https://scvd.store/api/verify/{cert_id} — free, no account, no rate limit, checkable offline with the published key
- **Price and fulfilment:** $5 USDC fixed, one-off; nothing here charges again by itself, ever — there is no mechanism that could; delivered instantly
- **Does not attest:** That the endpoint is endorsed, reliable, or up at any other moment. One GET against published criteria; an unreachable verdict is a fact about one network path at one moment.

## About this item

Name an x402 endpoint (the url query parameter) and the store probes it, runs the published preflight battery with additional rail and cross-surface reads, and signs the whole readout: the current verdict this series cites (the same battery the weekly census applies), the same probe scored under the frozen v1 battery beside it (the two can disagree, and the report says when they do), every check, every advisory, dated. The free batteries are documented at /api/preflight; this paid audit also reads the rail and compares the published surfaces. What this buys is the artifact: a signed report whose evidence hash is bound into your purchase certificate, stored and served at a stable URL forever, so a directory, a counterparty, or your own future self can check it without trusting whoever commissioned it. One bounded audit, against published criteria. Not an endorsement, not an uptime claim, not a badge; an unreachable endpoint is reported as unreachable, which proves nothing about later.

- **id:** `service_audit`
- **price:** $5 fixed, one-off; nothing here charges again by itself, ever — there is no mechanism that could
- **fulfillment:** delivered instantly
- **buy:** `GET https://scvd.store/api/buy/service_audit?url=<url>` (USDC over x402 v2 on Base, Polygon, Arbitrum, World, Solana, Arc (Circle Gateway), or USDC over MPP (evm/charge) on Base for every shelf item, every publication page and the commission desk)
- **required inputs:** `url` — fill the `<url>` slot above before paying. The bare door `GET https://scvd.store/api/buy/service_audit` quotes free and refuses the paid request without it; no money moves.
- **sample:** https://scvd.store/samples/once-over.json
- **does not prove:** That the endpoint is endorsed, reliable, or up at any other moment. One GET against published criteria; an unreachable verdict is a fact about one network path at one moment.

House rules: give the endpoint in the url query parameter: https, default port, on the public internet, the url a buyer would get expecting a 402; a bounded endpoint probe with rail and cross-surface reads, signed; never a monitor — the week-long look is the night watch; the cited criteria are preflight-v3 (get /api/preflight/v3), the same battery the weekly census applies; also_under carries the frozen v1 score. existing v1 and v2 reports keep their original criteria forever; we refuse our own hostname — an audit of ourselves signed by ourselves would be the instrument vouching for itself; the report url is free to read forever.

> Five dollars. The looking is free and always will be — what costs money is the part where somebody else has to believe you.

Optional next work: You run an x402 endpoint and need to see whether unfamiliar agents can find, understand and shop it. [Agent shopping audit — The Aura Walk — scope, price and free starting point](https://scvd.store/operators#shopping-audit).