Third-Party Observation
buy_observationPurpose: independent signed x402 research comparisons, settlement attestations, x402 conformance audits, x402 endpoint monitoring, x402 payment client tests, x402 launch checks and Bitcoin timestamps. To record prior spending authority, use buy_mandate. Read each item below for its scope; full contracts are at specsUrlTemplate. Prices run $0.001 to $49 depending on item_id.
Items on this shelf (pass one as item_id):
settlement_attestation: Settlement Attestation, $0.004 fixed, one-off, instant. Prove to a third party that a payment actually settled on chain
settlement_reconciliation: Settlement Reconciliation, $0.006 fixed, one-off, instant. Observe an agent payment's USDC movement against an attributable fixed value or a declared ceiling, stating when no cap is observable
the_case_file: The Case File, $0.25 fixed, one-off, instant. Hand the person deciding what went wrong with one agent purchase everything a neutral party observed about it, in one signed file, with what it did not observe stated
attestation_bundle: A Sheaf of Attestations, $0.05 fixed, one-off, instant. Prove a whole run of payments settled, one signed receipt per transaction
standing_watch: The Night Watch, $5 fixed, covering a 7-day term, one payment, instant. Monitor my x402 endpoint hourly for a week with signed uptime history
service_audit: The Once-Over, $5 fixed, one-off, instant. Get a signed point-in-time audit of an x402 endpoint that I can hand to a third party
a2a_repair_kit: The A2A Repair Kit, $49 fixed, one-off, instant. Find reproducible failures in my A2A agent and hand my developer tested repair instructions
good_buyer: The Good Buyer, $0.99 fixed, one-off, instant. Find out whether my own x402 client will actually pay a door before I spend a round trip on it, and get that dated and signed
conformance_watch: The Conformance Watch, $5 fixed, covering a 7-day term, one payment, instant. Catch a deploy quietly breaking my x402 endpoint's payment challenge during the week
signature_agent_card: The Calling Card, $0.99 fixed, one-off, instant. Show origins my crawler's Web Bot Auth key directory is set up right, with somebody who is not me saying so
onpage_audit: The Shop Window, $3 fixed, one-off, instant. Get a signed readout of what my page actually serves a machine reader — title, metadata, structured data — that I can hand to a third party
launch_check: The Launch Check, $5 fixed, one-off, instant. See my x402 buy path the way a real paying buyer sees it — a genuine settlement attempt, stage by stage, signed
opening_day: The Opening Day, $9 fixed, covering a 7-day term, one payment, instant. Open my x402 endpoint properly — one real purchase attempt, a week of signed daily checks, and my passport page, under one certificate at one URL
provenance_check: The Company an Address Keeps, $5 fixed, one-off, instant. Learn which doors have advertised a receiving address and when, signed from the public chain, before routing money at it — or about my own address, free, once proved
the_statement: The Statement, $0.99 fixed, one-off, instant. Get a neutral signed record of everything my agent's wallet actually moved on chain, to audit against its own ledger
operator_statement: The Operator's Statement, $21 fixed, covering a 30-day term, one payment, instant. Have my receiving address read off the chain four times a day for a month by a party that is not me — who paid, how many, how much — signed pass by pass
bitcoin_anchor: A Bitcoin Anchor, $1 fixed, one-off, instant. Timestamp my own digest into Bitcoin so its existence is provable forever
passport_refresh: The Refresh, $1 fixed, one-off, instant. Turn my endpoint passport fresh again right now — a new census observation of my door, without waiting for Sunday's walk
trust_profile: The Hosted Profile, $21 fixed, covering a 30-day term, one payment, instant. Give my endpoint a standing evidence page at a neutral third party's domain — my passport, chip and history at one URL I can hand to anyone
spot_check: Spot Check, $0.001 fixed, one-off, instant. Ask what the observatory already knows about an x402 host — signed, from its books, before I spend anything at that door
research_comparison: Research Comparison, $0.01 fixed, one-off, instant. Compare payment terms, dated host history and shared receiving addresses before an agent buys research from a set of x402 endpoints
On cadence, for all of the above: nothing here charges again by itself, ever — there is no mechanism that could.
Required beyond item_id: settlement_attestation needs tx_hash; settlement_reconciliation needs tx_hash; the_case_file needs tx_hash; attestation_bundle needs tx_hashes; standing_watch needs url; service_audit needs url; a2a_repair_kit needs url; good_buyer needs url; conformance_watch needs url; signature_agent_card needs url; onpage_audit needs url; launch_check needs url; opening_day needs url; provenance_check needs address; the_statement needs wallet; operator_statement needs wallet; bitcoin_anchor needs digest; passport_refresh needs url; trust_profile needs url; spot_check needs host; research_comparison needs urls. Other items need only item_id.
Choose item_id. instant items return deliverable, cert_id and patron_number in one call. x402 payment: _meta['x402/payment']. Without payment: error 402 with the terms in error.data. Closed or empty shelves refuse before quoting. Reuse _meta['x402/idempotency-key'] (16-128 chars, secret): same item/payer/key returns the original result when available, or pending status, no second charge. Use idempotency.suggested_key only without an earlier key. A fresh payment without a key can charge again. Guaranteed: signature validity forever; verification free forever; price as displayed; delivery format as specified. Not guaranteed: fitness for your particular task; future protocol compatibility beyond stated interfaces; human-labor turnaround faster than posted SLA.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | Optional. The endpoint the purchase was made at, so the door section can be assembled. | |
| host | No | A bare hostname with no scheme, path or port — your-door.example, never https://your-door.example/api. We read our own books about it — corpus rounds, verdicts as recorded, coverage, gaps — and sign what they hold. No request is made to the host; a host we have never met returns not_observed, which is an answer. | |
| urls | No | JSON-encoded array of 2–4 distinct public HTTPS URLs (1024 characters each), for unauthenticated GET payment challenges. No credentials, fragments, secrets or private prompts; no research purchased. | |
| claim | No | Optional. Your own account of what happened, stored verbatim and marked declared. Never checked. | |
| hours | No | Optional window in hours back from the chain head: 1 to 11, default 6. The block range (slot range on Solana) on the artifact is the entire coverage claim. | |
| label | No | Optional: your own claim about what the digest covers, stored verbatim and never checked. | |
| model | No | Optional. The model running you, as you would name it: claude-opus-5, gpt-5.6, a local model. Counted, never printed on the certificate. | |
| nonce | No | Optional, EVM rails only. Require one authorizer/nonce event paired with its immediately following canonical USDC Transfer, matching every supplied payer, recipient and exact amount. Supply payer when possible: nonces are scoped to an authorizer, and multiple candidates or unrecognised ordering establish no binding. Refused beside a Solana signature — that rail has no such facility, and we will not sign an artifact that silently skipped a requested check. | |
| payer | No | Optional payer: 0x EVM address, or Solana public key for a Solana transaction. | |
| client | No | Optional. The harness or framework you run in: claude-code, cursor, openai-agents, langgraph, custom. Counted, never on the certificate. | |
| digest | No | sha256 of bytes you keep: exactly 64 hex characters, no 0x prefix, not base64, not the bytes themselves. The store never sees the bytes. | |
| wallet | No | The wallet to state: a 0x address (0x plus 40 hex characters) on the selected EVM network, or a base58 pubkey on Solana. Every USDC transfer in and out over the window, counted, summed and signed — one chain per statement, named on the artifact. | |
| address | No | The receiving address to ask about: an EVM address (0x + 40 hex) or a Solana pubkey (base58). The signed chain is read and nothing else; the answer is delivered to you and never published. Your own address is free once proved — GET /api/provenance/self. | |
| item_id | Yes | Required item; its other required fields are in allOf. | |
| max_usd | No | Optional finite nonnegative decimal. Your client's spendControls.maxAmountPerPayment, in dollars; zero is retained. Leave it off for the reading a client configured with nothing gets — which is the case that loses money quietly. Recorded as your declaration, never verified. | |
| network | No | Inspect USDC on Base (eip155:8453), Polygon (eip155:137), Ethereum (eip155:1), Arbitrum One (eip155:42161), OP Mainnet (eip155:10), Avalanche C-Chain (eip155:43114), World (eip155:480), or Solana (network=solana). Base is the default. This input selects the chain inspected; payment uses a network offered in the current quote. | |
| purpose | No | Optional: what this is for, in your words. Signed verbatim onto the certificate and shown on its receipt; never checked, never treated as instructions. | |
| tx_hash | No | The transaction to observe: a Base transaction hash (0x + 64 hex) or a Solana transaction signature (base58). The identifier's shape selects the chain. Read once, at one moment; never polled. | |
| operator | No | Optional. Who runs you: a name, handle, company or URL. Stored as your claim, marked unverified, never published, never on the certificate. | |
| came_from | No | Optional. Where you learned this door exists: a URL, a directory, a skill name, memory, another agent. Referrers never reach us; this does. | |
| recipient | No | Optional recipient: 0x EVM address, or Solana public key for a Solana transaction. | |
| tx_hashes | No | 2 to 20 Base transaction hashes, comma-separated, no duplicates. Each is read once at one moment and signed on its own; never polled. One hash wants the single settlement_attestation instead. | |
| agent_name | No | Optional name to put on the certificate and patron badge, up to 80 characters. | |
| mandate_id | No | Optional. A mandate this purchase was made under; its declared cap prints beside the settled amount, never enforced. | |
| amount_usdc | No | Optional. Require a transfer of exactly this many USDC. Unstated fields widen the match, which is why the query is echoed onto the artifact. | |
| operator_kind | No | Optional. solo: one person runs you. company: a team does. research: a study. self: you act for yourself. | |
| prior_cert_id | No | Optional. A cert_ id from an earlier purchase here. A payer match with this payment marks you a returning buyer; no account needed. | |
| launch_check_id | No | Optional. A launch check you hold about the same door, for the delivery section. | |
| payment_payload | No | Optional. The base64 PAYMENT-SIGNATURE you sent, verbatim. The nonce is read out of it with the same code the store's replay guard uses, so you do not have to dig it out yourself. Only the nonce is extracted; supply payer, recipient and amount_usdc separately to check those terms. | |
| payment_response | No | Optional. The PAYMENT-RESPONSE header you received, verbatim (base64 JSON), or its JSON. Received, not observed: its bytes never enter the signed payload; their sha256 does, beside a per-field table (transaction, network, payer, success) saying whether each claim agrees with what the chain showed. The bytes are echoed outside the signature so you can check both. | |
| declared_cap_usdc | No | Optional, and understand what it buys: the ceiling YOU say applied. It is recorded as DECLARED, never as observed, and it can never override a ceiling found on the chain. A verdict resting on it is a fact about what you told us — the artifact says so in a signed field, so a counterparty can tell the difference. | |
| no_spend_controls | No | Optional: "true" for spendControls: false, "false" for enabled controls, or empty to omit. Declared, never verified. | |
| expected_amount_usdc | No | Optional positive USDC amount claimed for this purchase. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| cert_id | Yes | The signed certificate's id. | |
| message | No | The store's confirmation line. | |
| tip_usdc | No | Anything above the minimum. | |
| badge_url | No | Your patron badge, SVG. | |
| paid_usdc | No | What settled, in USDC. | |
| signature | No | ed25519 signature over the certificate. | |
| verify_url | No | Check the signature here any time, free. | |
| deliverable | No | The goods themselves, as text. Instant items. | |
| patron_number | Yes | Your sequential patron number. |