{ "openapi": "3.1.0", "info": { "title": "Algate API", "version": "0.5.0", "description": "Deterministic, pay-per-call safety checks for autonomous agents. Six paid endpoints use x402 and settle $0.001 USDC per call on Algorand MainNet. Payment identifiers make retries idempotent. Every analysis performs local computation only and every successful result includes not_checked.\n\nBefore the first paid call, the payer account needs: (1) an Algorand keypair, whose mnemonic stays on the agent's machine and is never sent to Algate; (2) 0.21 ALGO, of which 0.2 stays locked as Algorand's minimum balance (0.1 per account plus 0.1 per asset held) and ~0.001 pays the opt-in fee; (3) an explicit opt-in to USDC ASA 31566704, without which any payment to the account fails; (4) USDC, where 1 USDC covers 1,000 calls. An agent cannot fund itself, so steps 2 and 4 require the account owner. After setup each call costs $0.001 USDC and 0 ALGO, because the facilitator sponsors the transaction fee. A payer holding ALGO but never opted in looks funded and fails every settlement." }, "servers": [ { "url": "https://algate-x402.up.railway.app", "description": "Production — Algorand MainNet" } ], "tags": [ { "name": "Checks", "description": "Paid deterministic checks protected by x402." }, { "name": "Free", "description": "Free discovery, demo, health, and settlement-statistics surfaces." } ], "x-x402": { "scheme": "exact", "price": "$0.001", "network": "algorand:wGHE2Pwdvd7S12BL5FaOP20EGYesN73ktiC1qzkkit8=", "asset": "USDC", "assetId": 31566704, "payTo": "2NBCPOTMFPE2IHA4RDANQDGIRPC2CQ3YVVB5F5W3EYSHTYRUN4EKT4NMLE", "facilitator": "https://facilitator.goplausible.xyz", "extensions": ["bazaar", "payment-identifier"] }, "paths": { "/v1/email": { "get": { "operationId": "checkEmail", "summary": "Check an email address or domain", "description": "Checks syntax, known disposable providers, role mailboxes, consumer providers, risky TLDs, and other deterministic signals. Does not verify mailbox existence, SMTP delivery, DNS, or reputation.", "tags": ["Checks"], "parameters": [ { "$ref": "#/components/parameters/QueryInput" } ], "security": [ { "x402Payment": [] } ], "x-x402": { "$ref": "#/x-x402" }, "responses": { "200": { "description": "Email or domain analysis", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmailResult" } } } }, "400": { "$ref": "#/components/responses/MissingInput" }, "402": { "$ref": "#/components/responses/PaymentRequired" }, "409": { "$ref": "#/components/responses/IdempotencyConflict" }, "425": { "$ref": "#/components/responses/IdempotencyPending" }, "413": { "$ref": "#/components/responses/InputTooLarge" } } } }, "/v1/pii": { "get": { "operationId": "scanPii", "summary": "Detect personal data and secrets", "description": "Scans text or a serialized payload, masks detected values, and returns a redacted copy. Mathematical validation is used where available, including Luhn, IBAN mod-97, and Algorand checksums.", "tags": ["Checks"], "parameters": [ { "$ref": "#/components/parameters/QueryInput" } ], "security": [ { "x402Payment": [] } ], "x-x402": { "$ref": "#/x-x402" }, "responses": { "200": { "description": "PII and secret analysis", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PiiResult" } } } }, "400": { "$ref": "#/components/responses/MissingInput" }, "402": { "$ref": "#/components/responses/PaymentRequired" }, "409": { "$ref": "#/components/responses/IdempotencyConflict" }, "425": { "$ref": "#/components/responses/IdempotencyPending" }, "413": { "$ref": "#/components/responses/InputTooLarge" } } } }, "/v1/url": { "get": { "operationId": "checkUrl", "summary": "Assess a URL before visiting it", "description": "Checks brand impersonation, punycode and confusable characters, embedded credentials, IP literals, suspicious structure, and other offline-computable signals. The destination is never fetched.", "tags": ["Checks"], "parameters": [ { "$ref": "#/components/parameters/QueryInput" } ], "security": [ { "x402Payment": [] } ], "x-x402": { "$ref": "#/x-x402" }, "responses": { "200": { "description": "URL analysis", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UrlResult" } } } }, "400": { "$ref": "#/components/responses/MissingInput" }, "402": { "$ref": "#/components/responses/PaymentRequired" }, "409": { "$ref": "#/components/responses/IdempotencyConflict" }, "425": { "$ref": "#/components/responses/IdempotencyPending" }, "413": { "$ref": "#/components/responses/InputTooLarge" } } } }, "/v1/injection": { "get": { "operationId": "scanPromptInjection", "summary": "Scan content for prompt-injection patterns", "description": "Checks instruction overrides, role rewrites, exfiltration orders, forged delimiters, invisible characters, and related deterministic signals. This endpoint is pattern-based and does not call a model.", "tags": ["Checks"], "parameters": [ { "$ref": "#/components/parameters/QueryInput" } ], "security": [ { "x402Payment": [] } ], "x-x402": { "$ref": "#/x-x402" }, "responses": { "200": { "description": "Prompt-injection analysis", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InjectionResult" } } } }, "400": { "$ref": "#/components/responses/MissingInput" }, "402": { "$ref": "#/components/responses/PaymentRequired" }, "409": { "$ref": "#/components/responses/IdempotencyConflict" }, "425": { "$ref": "#/components/responses/IdempotencyPending" }, "413": { "$ref": "#/components/responses/InputTooLarge" } } } }, "/v1/transaction": { "post": { "operationId": "checkAlgorandTransaction", "summary": "Check an unsigned Algorand transaction before signing", "description": "Decodes one unsigned transaction or a complete atomic group locally. Detects rekeys, account and asset closes, clawbacks, dangerous transaction types, invalid groups, excessive fees, and mismatches with the agent declared intent. Notes and application arguments are not returned.", "tags": ["Checks"], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TransactionInput" } } } }, "security": [ { "x402Payment": [] } ], "x-x402": { "$ref": "#/x-x402" }, "responses": { "200": { "description": "Pre-signing transaction analysis", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TransactionResult" } } } }, "400": { "description": "Malformed JSON body", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "402": { "$ref": "#/components/responses/PaymentRequired" }, "409": { "$ref": "#/components/responses/IdempotencyConflict" }, "425": { "$ref": "#/components/responses/IdempotencyPending" }, "413": { "$ref": "#/components/responses/InputTooLarge" } } } }, "/v1/gate": { "post": { "operationId": "runPreActionGate", "summary": "Get one decision before an agent acts", "description": "Runs the local checks relevant to the selected action profile and returns one allow, review, or block decision plus a machine-actionable next step. The pay_x402 profile binds PAYMENT-REQUIRED metadata to the actual HTTP request, enforces spending policy, and can compare a prepared Algorand transaction with the selected payment requirement.", "tags": ["Checks"], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GateInput" } } } }, "security": [ { "x402Payment": [] } ], "x-x402": { "$ref": "#/x-x402" }, "responses": { "200": { "description": "Normalized pre-action decision with detailed check results", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GateResult" } } } }, "400": { "description": "Malformed JSON body", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "402": { "$ref": "#/components/responses/PaymentRequired" }, "409": { "$ref": "#/components/responses/IdempotencyConflict" }, "425": { "$ref": "#/components/responses/IdempotencyPending" }, "413": { "$ref": "#/components/responses/InputTooLarge" } } } }, "/demo": { "get": { "operationId": "runFreeDemo", "summary": "Run a free, rate-limited check", "description": "Runs the same deterministic engine as a paid route. Limited to 20 requests per minute per IP.", "tags": ["Free"], "parameters": [ { "name": "route", "in": "query", "required": false, "description": "Engine to run. Defaults to /v1/email.", "schema": { "type": "string", "enum": ["/v1/email", "/v1/pii", "/v1/url", "/v1/injection"], "default": "/v1/email" } }, { "$ref": "#/components/parameters/QueryInput" } ], "responses": { "200": { "description": "Result from the selected engine", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/EmailResult" }, { "$ref": "#/components/schemas/PiiResult" }, { "$ref": "#/components/schemas/UrlResult" }, { "$ref": "#/components/schemas/InjectionResult" } ] } } } }, "400": { "description": "Missing input or unknown route", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "$ref": "#/components/responses/InputTooLarge" }, "429": { "description": "Demo rate limit exceeded", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } }, "post": { "operationId": "runFreeStructuredDemo", "summary": "Run a free, rate-limited structured check", "description": "Runs /v1/gate or /v1/transaction without payment. Send the same JSON body as the paid route. Limited to 20 requests per minute per IP.", "tags": ["Free"], "parameters": [ { "name": "route", "in": "query", "required": false, "description": "Structured engine to run. Defaults to /v1/gate.", "schema": { "type": "string", "enum": ["/v1/gate", "/v1/transaction"], "default": "/v1/gate" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/GateInput" }, { "$ref": "#/components/schemas/TransactionInput" } ] } } } }, "responses": { "200": { "description": "Result from the selected structured engine", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/GateResult" }, { "$ref": "#/components/schemas/TransactionResult" } ] } } } }, "400": { "description": "Malformed body or unknown route", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "$ref": "#/components/responses/InputTooLarge" }, "429": { "description": "Demo rate limit exceeded", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/health": { "get": { "operationId": "getHealth", "summary": "Inspect service status and configuration", "tags": ["Free"], "responses": { "200": { "description": "Healthy service", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Health" } } } } } } }, "/stats": { "get": { "operationId": "getSettlementStats", "summary": "Read cached on-chain settlement statistics", "description": "Returns immediately from cache. This display-only endpoint is the only Algate surface that reads external network data.", "tags": ["Free"], "responses": { "200": { "description": "Settlement snapshot, or a not-ready response during initial startup", "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/Stats" }, { "$ref": "#/components/schemas/StatsNotReady" } ] } } } } } } }, "/llms.txt": { "get": { "operationId": "getLlmsText", "summary": "Read the concise agent-facing service guide", "tags": ["Free"], "responses": { "200": { "description": "Agent-facing documentation", "content": { "text/plain": { "schema": { "type": "string" } } } } } } }, "/openapi.json": { "get": { "operationId": "getOpenApi", "summary": "Read this OpenAPI specification", "tags": ["Free"], "responses": { "200": { "description": "OpenAPI 3.1 document", "content": { "application/json": { "schema": { "type": "object" } } } } } } } }, "components": { "securitySchemes": { "x402Payment": { "type": "apiKey", "in": "header", "name": "PAYMENT-SIGNATURE", "description": "Make an initial request without this header to receive HTTP 402 and PAYMENT-REQUIRED. Algate advertises payment-identifier; keep one ID per logical operation and reuse it with the signed payment payload on retries." } }, "parameters": { "QueryInput": { "name": "q", "in": "query", "required": true, "description": "Input to analyze. Maximum length: 32,000 characters. Submitted values are never logged.", "schema": { "type": "string", "minLength": 1, "maxLength": 32000 } } }, "responses": { "MissingInput": { "description": "The q query parameter is missing or empty", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "PaymentRequired": { "description": "x402 payment is required before the route executes", "headers": { "PAYMENT-REQUIRED": { "description": "Base64-encoded x402 payment requirements, including Algorand network, USDC asset, amount, recipient, Bazaar metadata, and the payment-identifier declaration.", "schema": { "type": "string" } } } }, "IdempotencyConflict": { "description": "The payment identifier is already bound to a different request fingerprint", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "IdempotencyPending": { "description": "The original request using this payment identifier is still being processed; retry with the same identifier", "headers": { "Retry-After": { "schema": {"type": "integer", "minimum": 1} } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "InputTooLarge": { "description": "Input exceeds 32,000 characters", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "schemas": { "NotChecked": { "type": "array", "description": "Authoritative list of checks outside this result's scope.", "items": { "type": "string" } }, "EmailResult": { "type": "object", "required": [ "input", "kind", "valid_syntax", "domain", "local_part", "checks", "risk_score", "verdict", "reasons", "not_checked" ], "properties": { "input": { "type": "string" }, "kind": { "type": "string", "enum": ["email", "domain"] }, "valid_syntax": { "type": "boolean" }, "domain": { "type": ["string", "null"] }, "local_part": { "type": ["string", "null"] }, "checks": { "type": "object", "required": [ "disposable", "role_account", "free_provider", "subaddressed", "suspicious_local_part", "risky_tld" ], "properties": { "disposable": { "type": "boolean" }, "role_account": { "type": "boolean" }, "free_provider": { "type": "boolean" }, "subaddressed": { "type": "boolean" }, "suspicious_local_part": { "type": "boolean" }, "risky_tld": { "type": "boolean" } }, "additionalProperties": false }, "risk_score": { "$ref": "#/components/schemas/RiskScore" }, "verdict": { "type": "string", "enum": ["accept", "review", "reject"] }, "reasons": { "$ref": "#/components/schemas/Reasons" }, "not_checked": { "$ref": "#/components/schemas/NotChecked" } } }, "PiiFinding": { "type": "object", "required": ["type", "severity", "preview", "start", "end", "verified"], "properties": { "type": { "type": "string" }, "severity": { "type": "string", "enum": ["critical", "high", "medium", "low"] }, "preview": { "type": "string", "description": "Masked preview. Raw detected values are not returned." }, "start": { "type": "integer", "minimum": 0 }, "end": { "type": "integer", "minimum": 0 }, "verified": { "type": "boolean", "description": "True when a mathematical checksum or equivalent validation confirmed the finding." } } }, "PiiResult": { "type": "object", "required": [ "input_length", "findings", "counts_by_type", "highest_severity", "risk_score", "verdict", "redacted", "not_checked" ], "properties": { "input_length": { "type": "integer", "minimum": 0 }, "findings": { "type": "array", "items": { "$ref": "#/components/schemas/PiiFinding" } }, "counts_by_type": { "type": "object", "additionalProperties": { "type": "integer", "minimum": 0 } }, "highest_severity": { "type": ["string", "null"], "enum": ["critical", "high", "medium", "low", null] }, "risk_score": { "$ref": "#/components/schemas/RiskScore" }, "verdict": { "type": "string", "enum": ["clean", "review", "blocked"] }, "redacted": { "type": "string" }, "not_checked": { "$ref": "#/components/schemas/NotChecked" } } }, "UrlResult": { "type": "object", "required": [ "input", "parsed", "scheme", "host", "registrable_domain", "checks", "impersonated_brand", "risk_score", "verdict", "reasons", "not_checked" ], "properties": { "input": { "type": "string" }, "parsed": { "type": "boolean" }, "scheme": { "type": ["string", "null"] }, "host": { "type": ["string", "null"] }, "registrable_domain": { "type": ["string", "null"] }, "checks": { "type": "object", "required": [ "not_https", "ip_literal_host", "credentials_in_url", "punycode", "confusable_characters", "brand_lookalike", "brand_affix", "brand_in_subdomain", "excessive_subdomains", "nonstandard_port", "risky_tld", "disposable_domain" ], "properties": { "not_https": { "type": "boolean" }, "ip_literal_host": { "type": "boolean" }, "credentials_in_url": { "type": "boolean" }, "punycode": { "type": "boolean" }, "confusable_characters": { "type": "boolean" }, "brand_lookalike": { "type": "boolean" }, "brand_affix": { "type": "boolean" }, "brand_in_subdomain": { "type": "boolean" }, "excessive_subdomains": { "type": "boolean" }, "nonstandard_port": { "type": "boolean" }, "risky_tld": { "type": "boolean" }, "disposable_domain": { "type": "boolean" } }, "additionalProperties": false }, "impersonated_brand": { "type": ["string", "null"] }, "risk_score": { "$ref": "#/components/schemas/RiskScore" }, "verdict": { "type": "string", "enum": ["ok", "suspicious", "dangerous"] }, "reasons": { "$ref": "#/components/schemas/Reasons" }, "not_checked": { "$ref": "#/components/schemas/NotChecked" } } }, "InjectionSignal": { "type": "object", "required": ["type", "severity", "excerpt", "position"], "properties": { "type": { "type": "string" }, "severity": { "type": "string", "enum": ["critical", "high", "medium", "low"] }, "excerpt": { "type": "string" }, "position": { "type": "integer", "minimum": 0 } } }, "InjectionResult": { "type": "object", "required": [ "input_length", "signals", "counts_by_type", "risk_score", "verdict", "reasons", "not_checked" ], "properties": { "input_length": { "type": "integer", "minimum": 0 }, "signals": { "type": "array", "items": { "$ref": "#/components/schemas/InjectionSignal" } }, "counts_by_type": { "type": "object", "additionalProperties": { "type": "integer", "minimum": 0 } }, "risk_score": { "$ref": "#/components/schemas/RiskScore" }, "verdict": { "type": "string", "enum": ["clean", "suspicious", "likely_injection"] }, "reasons": { "$ref": "#/components/schemas/Reasons" }, "not_checked": { "$ref": "#/components/schemas/NotChecked" } } }, "TransactionExpectation": { "type": "object", "description": "The agent declared intent. Any mismatch is a blocking finding.", "properties": { "network": { "type": "string", "enum": ["mainnet", "testnet"] }, "sender": { "type": "string", "description": "Expected Algorand sender address for every transaction." }, "receiver": { "type": "string", "description": "Expected recipient for every payment or asset transfer." }, "asset_id": { "oneOf": [ { "type": "integer", "minimum": 0 }, { "type": "string", "pattern": "^[0-9]+$" } ] }, "amount_base_units": { "description": "Expected total amount across matching transfers, in asset base units.", "oneOf": [ { "type": "integer", "minimum": 0 }, { "type": "string", "pattern": "^[0-9]+$" } ] }, "application_id": { "oneOf": [ { "type": "integer", "minimum": 0 }, { "type": "string", "pattern": "^[0-9]+$" } ] }, "max_total_fee_microalgos": { "oneOf": [ { "type": "integer", "minimum": 0 }, { "type": "string", "pattern": "^[0-9]+$" } ] }, "allowed_types": { "type": "array", "minItems": 1, "items": { "type": "string", "enum": ["pay", "keyreg", "acfg", "axfer", "afrz", "appl", "stpf", "hb"] } }, "max_group_size": { "type": "integer", "minimum": 1, "maximum": 16 } } }, "TransactionInput": { "type": "object", "description": "Provide exactly one of transaction or transactions. Only unsigned Algorand MessagePack is accepted.", "properties": { "transaction": { "type": "string", "description": "One unsigned Algorand transaction encoded as canonical standard base64." }, "transactions": { "type": "array", "minItems": 1, "maxItems": 16, "items": { "type": "string" }, "description": "Every member of an Algorand atomic group in signing order." }, "expected": { "$ref": "#/components/schemas/TransactionExpectation" } }, "oneOf": [ { "required": ["transaction"], "not": { "required": ["transactions"] } }, { "required": ["transactions"], "not": { "required": ["transaction"] } } ] }, "TransactionFinding": { "type": "object", "required": ["type", "severity", "transaction_index", "detail"], "properties": { "type": { "type": "string" }, "severity": { "type": "string", "enum": ["critical", "high", "medium", "low"] }, "transaction_index": { "type": ["integer", "null"], "minimum": 0 }, "detail": { "type": "string" } } }, "TransactionSummary": { "type": "object", "required": [ "index", "txid", "type", "sender", "receiver", "asset_id", "amount_base_units", "application_id", "on_complete", "fee_microalgos", "rekey_to", "close_to", "asset_sender" ], "properties": { "index": { "type": "integer", "minimum": 0 }, "txid": { "type": "string" }, "type": { "type": "string" }, "sender": { "type": "string" }, "receiver": { "type": ["string", "null"] }, "asset_id": { "type": ["string", "null"] }, "amount_base_units": { "type": ["string", "null"] }, "application_id": { "type": ["string", "null"] }, "on_complete": { "type": ["string", "null"] }, "fee_microalgos": { "type": "string" }, "rekey_to": { "type": ["string", "null"] }, "close_to": { "type": ["string", "null"] }, "asset_sender": { "type": ["string", "null"] } } }, "TransactionChecks": { "type": "object", "required": [ "decoded", "group_complete", "group_id_valid", "network_known", "expectations_met", "no_rekey", "no_close", "no_clawback", "fee_within_limit" ], "properties": { "decoded": { "type": "boolean" }, "group_complete": { "type": "boolean" }, "group_id_valid": { "type": "boolean" }, "network_known": { "type": "boolean" }, "expectations_met": { "type": "boolean" }, "no_rekey": { "type": "boolean" }, "no_close": { "type": "boolean" }, "no_clawback": { "type": "boolean" }, "fee_within_limit": { "type": "boolean" } } }, "TransactionResult": { "type": "object", "required": [ "transaction_count", "network", "group_id", "transactions", "checks", "findings", "risk_score", "verdict", "reasons", "not_checked" ], "properties": { "transaction_count": { "type": "integer", "minimum": 0, "maximum": 16 }, "network": { "type": "string", "enum": ["mainnet", "testnet", "unknown", "conflicting"] }, "group_id": { "type": ["string", "null"] }, "transactions": { "type": "array", "items": { "$ref": "#/components/schemas/TransactionSummary" } }, "checks": { "$ref": "#/components/schemas/TransactionChecks" }, "findings": { "type": "array", "items": { "$ref": "#/components/schemas/TransactionFinding" } }, "risk_score": { "$ref": "#/components/schemas/RiskScore" }, "verdict": { "type": "string", "enum": ["allow", "review", "block"] }, "reasons": { "$ref": "#/components/schemas/Reasons" }, "not_checked": { "$ref": "#/components/schemas/NotChecked" } } }, "X402RequestContext": { "type": "object", "properties": { "url": { "type": "string", "format": "uri", "description": "Exact resource URL the agent requested." }, "method": { "type": "string", "description": "HTTP method the agent used." } } }, "X402Policy": { "type": "object", "properties": { "max_amount_usdc": { "oneOf": [{"type": "string"}, {"type": "number"}], "description": "Maximum USDC amount, with at most six decimal places." }, "max_amount_base_units": { "oneOf": [{"type": "string", "pattern": "^[0-9]+$"}, {"type": "integer", "minimum": 0}], "description": "Maximum payment amount in token base units. If both limits are present, the stricter one applies." }, "allowed_networks": { "type": "array", "minItems": 1, "items": {"type": "string"}, "description": "Allowed CAIP-2 networks. Defaults to Algorand MainNet." }, "allowed_assets": { "type": "array", "minItems": 1, "items": {"oneOf": [{"type": "string", "pattern": "^[0-9]+$"}, {"type": "integer", "minimum": 0}]}, "description": "Allowed Algorand asset IDs. Defaults to MainNet USDC ASA 31566704." }, "allowed_schemes": { "type": "array", "minItems": 1, "items": {"type": "string"}, "description": "Allowed x402 payment schemes. Defaults to exact." }, "allowed_pay_to": { "type": "array", "minItems": 1, "items": {"type": "string"}, "description": "Optional allowlist of Algorand payment recipients." }, "allowed_hosts": { "type": "array", "minItems": 1, "items": {"type": "string"}, "description": "Optional exact hostname allowlist for the requested resource." }, "require_https": { "type": "boolean", "default": true }, "require_payment_identifier": { "type": "boolean", "default": false, "description": "Block when the target does not advertise x402 payment-identifier retry protection." } } }, "X402Finding": { "type": "object", "required": ["code", "category", "severity", "detail"], "properties": { "code": {"type": "string"}, "category": {"type": "string", "enum": ["input", "request", "policy", "protocol"]}, "severity": {"type": "string", "enum": ["critical", "high", "medium", "low"]}, "detail": {"type": "string"} } }, "X402OptionSummary": { "type": "object", "required": ["index", "scheme", "network", "asset", "amount_base_units", "pay_to", "eligible", "violations"], "properties": { "index": {"type": "integer", "minimum": 0}, "scheme": {"type": "string"}, "network": {"type": "string"}, "asset": {"type": "string"}, "amount_base_units": {"type": "string"}, "pay_to": {"type": "string"}, "eligible": {"type": "boolean"}, "violations": {"type": "array", "items": {"type": "string"}} } }, "X402SelectedRequirement": { "type": "object", "required": ["index", "scheme", "network", "asset", "amount_base_units", "pay_to"], "properties": { "index": {"type": "integer", "minimum": 0}, "scheme": {"type": "string"}, "network": {"type": "string"}, "asset": {"type": "string"}, "amount_base_units": {"type": "string"}, "pay_to": {"type": "string"} } }, "X402CheckResult": { "type": "object", "required": ["x402_version", "resource_url", "advertised_method", "checks", "payment_identifier_supported", "payment_identifier_required", "retry_safety", "options", "selected_requirement", "transaction_expectation", "findings", "risk_score", "verdict", "reasons", "reason_codes", "policy_violations", "missing_inputs", "coverage_complete", "not_checked"], "properties": { "x402_version": {"type": ["integer", "null"]}, "resource_url": {"type": ["string", "null"]}, "advertised_method": {"type": ["string", "null"]}, "checks": {"type": "object", "additionalProperties": {"type": "boolean"}}, "payment_identifier_supported": {"type": "boolean"}, "payment_identifier_required": {"type": "boolean"}, "retry_safety": { "type": "string", "enum": ["protected", "unprotected", "unknown"], "description": "Protected means the target advertises payment-identifier; correct server-side persistence remains outside Algate's offline scope." }, "options": {"type": "array", "items": {"$ref": "#/components/schemas/X402OptionSummary"}}, "selected_requirement": { "oneOf": [ {"$ref": "#/components/schemas/X402SelectedRequirement"}, {"type": "null"} ] }, "transaction_expectation": { "oneOf": [ {"$ref": "#/components/schemas/TransactionExpectation"}, {"type": "null"} ] }, "findings": {"type": "array", "items": {"$ref": "#/components/schemas/X402Finding"}}, "risk_score": {"$ref": "#/components/schemas/RiskScore"}, "verdict": {"type": "string", "enum": ["allow", "review", "block"]}, "reasons": {"$ref": "#/components/schemas/Reasons"}, "reason_codes": {"type": "array", "items": {"type": "string"}}, "policy_violations": {"type": "array", "items": {"type": "string"}}, "missing_inputs": {"type": "array", "items": {"type": "string"}}, "coverage_complete": {"type": "boolean"}, "not_checked": {"$ref": "#/components/schemas/NotChecked"} } }, "GateInput": { "type": "object", "required": ["action"], "properties": { "action": { "type": "string", "enum": ["send_message", "open_url", "ingest_content", "pay_invoice", "pay_x402", "sign_transaction", "custom"] }, "email": { "type": "string", "description": "Recipient address or domain for the email check." }, "url": { "type": "string", "description": "Destination or source URL for the structural URL check." }, "content": { "type": "string", "description": "Inbound content for the prompt-injection scan." }, "outbound_data": { "type": "string", "description": "Data the agent is about to transmit, scanned for PII and secrets." }, "transaction": { "$ref": "#/components/schemas/TransactionInput" }, "request": { "$ref": "#/components/schemas/X402RequestContext" }, "payment_required": { "oneOf": [ {"type": "string", "description": "Base64 PAYMENT-REQUIRED header or serialized JSON object."}, {"type": "object", "additionalProperties": true, "description": "Decoded x402 PaymentRequired object."} ] }, "policy": { "$ref": "#/components/schemas/X402Policy" } } }, "GateCheck": { "type": "object", "required": [ "name", "decision", "verdict", "risk_score", "reasons", "not_checked", "result" ], "properties": { "name": { "type": "string", "enum": ["email", "pii", "url", "injection", "transaction", "x402"] }, "decision": { "type": "string", "enum": ["allow", "review", "block"] }, "verdict": { "type": "string" }, "risk_score": { "$ref": "#/components/schemas/RiskScore" }, "reasons": { "$ref": "#/components/schemas/Reasons" }, "not_checked": { "$ref": "#/components/schemas/NotChecked" }, "result": { "oneOf": [ { "$ref": "#/components/schemas/EmailResult" }, { "$ref": "#/components/schemas/PiiResult" }, { "$ref": "#/components/schemas/UrlResult" }, { "$ref": "#/components/schemas/InjectionResult" }, { "$ref": "#/components/schemas/TransactionResult" }, { "$ref": "#/components/schemas/X402CheckResult" } ] } } }, "GateResult": { "type": "object", "required": [ "action", "decision", "recommended_action", "risk_score", "reason_codes", "policy_violations", "missing_inputs", "coverage_complete", "retry_safety", "payment_identifier_supported", "checks_run", "checks", "reasons", "not_checked" ], "properties": { "action": { "type": "string", "enum": ["send_message", "open_url", "ingest_content", "pay_invoice", "pay_x402", "sign_transaction", "custom", "invalid"] }, "decision": { "type": "string", "enum": ["allow", "review", "block"] }, "recommended_action": { "type": "string", "enum": ["proceed", "pay", "ask_user", "abort"] }, "risk_score": { "$ref": "#/components/schemas/RiskScore" }, "reason_codes": { "type": "array", "items": {"type": "string"} }, "policy_violations": { "type": "array", "items": {"type": "string"} }, "missing_inputs": { "type": "array", "items": {"type": "string"} }, "coverage_complete": { "type": "boolean" }, "retry_safety": { "type": "string", "enum": ["protected", "unprotected", "unknown", "not_applicable"] }, "payment_identifier_supported": { "type": ["boolean", "null"] }, "checks_run": { "type": "array", "items": { "type": "string", "enum": ["email", "pii", "url", "injection", "transaction", "x402"] } }, "checks": { "type": "array", "items": { "$ref": "#/components/schemas/GateCheck" } }, "reasons": { "$ref": "#/components/schemas/Reasons" }, "not_checked": { "$ref": "#/components/schemas/NotChecked" } } }, "Health": { "type": "object", "required": [ "ok", "network", "price", "pay_to", "routes", "disposable_domains_loaded", "documentation", "idempotency", "version" ], "properties": { "ok": { "type": "boolean" }, "network": { "type": "string", "enum": ["testnet", "mainnet"] }, "price": { "type": "string" }, "pay_to": { "type": "string" }, "routes": { "type": "array", "items": { "type": "object", "required": ["method", "path", "name", "tags"], "properties": { "method": { "type": "string", "enum": ["GET", "POST"] }, "path": { "type": "string" }, "name": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" } } } } }, "disposable_domains_loaded": { "type": "integer", "minimum": 0 }, "documentation": { "type": "object", "required": ["llms_txt", "openapi"], "properties": { "llms_txt": { "type": "string" }, "openapi": { "type": "string" } } }, "idempotency": { "type": "object", "required": ["mode", "ready", "healthy", "ttl_seconds", "settled_entries", "pending_entries"], "properties": { "mode": {"type": "string", "enum": ["memory", "file"]}, "ready": {"type": "boolean"}, "healthy": {"type": "boolean"}, "ttl_seconds": {"type": "integer", "minimum": 60}, "settled_entries": {"type": "integer", "minimum": 0}, "pending_entries": {"type": "integer", "minimum": 0} } }, "version": { "type": "string" } } }, "Settlement": { "type": "object", "required": ["txid", "at", "usdc"], "properties": { "txid": { "type": "string" }, "at": { "type": "string", "format": "date-time" }, "usdc": { "type": "number", "minimum": 0 } } }, "Stats": { "type": "object", "required": [ "settlements", "recent", "usdc_settled", "first_settlement", "last_settlement", "merchant", "explorer", "updated_at", "stale" ], "properties": { "settlements": { "type": "integer", "minimum": 0 }, "recent": { "type": "array", "items": { "$ref": "#/components/schemas/Settlement" } }, "usdc_settled": { "type": "number", "minimum": 0 }, "first_settlement": { "type": ["string", "null"], "format": "date-time" }, "last_settlement": { "type": ["string", "null"], "format": "date-time" }, "merchant": { "type": "string" }, "explorer": { "type": "string", "format": "uri" }, "updated_at": { "type": "string", "format": "date-time" }, "stale": { "type": "boolean" } } }, "StatsNotReady": { "type": "object", "required": ["ready"], "properties": { "ready": { "type": "boolean", "const": false } } }, "RiskScore": { "type": "integer", "minimum": 0, "maximum": 100 }, "Reasons": { "type": "array", "items": { "type": "string" } }, "Error": { "type": "object", "required": ["error"], "properties": { "error": { "type": "string" }, "detail": { "type": "string" }, "reason": { "type": "string" }, "max_bytes": { "type": "integer" } } } } } }