api-production-2800.up.railway.app · x402-risk

x402 endpoint risk preflight API by AgentSpendGuard for autonomous buyer agents before paying unknown x402 resources. Search keywords: x402 risk, x402 endpoint risk, agent payment guardrail, buyer agent spend guard, Bazaar discovery risk, API payment preflight. Checks CDP Bazaar discovery, unique payers, recent calls, price, metadata quality, network match, and returns strict JSON verdict allow/caution/block with score, reason codes, evidence, and alternatives.

Call it in 30 seconds

// npm i x402-fetch viem
import { wrapFetchWithPayment } from "x402-fetch";
import { createWalletClient, http } from "viem";
import { privateKeyToAccount } from "viem/accounts";
import { base } from "viem/chains";

const account = privateKeyToAccount(process.env.PRIVATE_KEY); // funds USDC on Base
const wallet = createWalletClient({ account, chain: base, transport: http() });
const fetchWithPay = wrapFetchWithPayment(fetch, wallet);

// Pays the $0.003 USDC automatically on the 402, then returns the real response:
const res = await fetchWithPay("https://api-production-2800.up.railway.app/v1/x402-risk", { method: "POST" });
console.log(await res.json());

# pip install x402 eth-account httpx
import os, asyncio
from eth_account import Account
from x402.clients.httpx import x402HttpxClient

account = Account.from_key(os.environ["PRIVATE_KEY"])  # funds USDC on Base

async def main():
    async with x402HttpxClient(account=account) as client:
        # x402 handles the 402 -> pay ($0.003 USDC) -> retry automatically
        r = await client.get("https://api-production-2800.up.railway.app/v1/x402-risk")
        print((await r.aread()).decode())

asyncio.run(main())

# 1) An unpaid request returns HTTP 402 with the exact payment terms:
curl -i -X POST "https://api-production-2800.up.railway.app/v1/x402-risk" \
  -H 'content-type: application/json' \
  -d '{"expectedMaxPriceUsd": 1, "expectedNetwork": "eip155:8453", "resourceUrl": "https://api.oatp.cc/tools/token_risk_scan"}'

# 2) Paying + retrying requires an x402 client that can sign the USDC
#    authorization (curl alone cannot). See the JS / Python tabs below.

New to x402? Read the 5-minute quickstart →