On 2026-10-31 we ran POST /api/v1/x402-check ($0.01) against a public x402 endpoint,
https://sol.blockrun.ai/api/v1/chat/completions, exactly as an agent buyer would. The endpoint
returned HTTP 402 to an unpaid GET in 400 ms; the audit decoded its PAYMENT-REQUIRED header and
scored the challenge against the x402 v2 contract.
Score: 88 · compliant
| Check | Result |
|---|---|
| Reachability | HTTP 402 in 400 ms |
| Unpaid request returns 402 | pass |
Base64 JSON PAYMENT-REQUIRED header | present and decodable |
| x402 version | 2 |
| accepts entries | present, required fields complete |
| resource matches the requested URL | pass |
| discovery extension | present |
An agent decides whether it can pay before it pays: it reads the 402, checks the network, asset, amount, pay-to address and resource URL, and only then signs. A challenge that is missing a field, points at the wrong resource, or hides behind a broken CORS policy silently loses that buyer. A scored audit turns those failures into a checklist you can fix before listing your service in a directory.
curl -s -X POST https://scanpay-edge.alextaghiashvili.workers.dev/api/v1/x402-check -H 'Content-Type: application/json' -d '{"target":"https://your-service.example/api"}'
# unpaid -> 402 with x402 payment requirements (USDC on Base or Solana, $0.01)
Non-goals: the audit does not certify safety, uptime, or business legitimacy. It reports the observable x402 contract of the endpoint at the time of the request.