{"x402Version": 2, "name": "Cian Endpoint Audit", "description": "5 paid audit resources on one host: HTTP endpoint health, Python static analysis, CSV data quality, DNS/email authentication, and a multi-target suite. On Base: 0.05 USDC each for /v1/audit, /v1/py-audit, /v1/csv-audit, /v1/dns-audit and 0.08 USDC for /v1/suite.", "resources": [{"url": "https://cian-x402.netlify.app/v1/audit", "method": "GET", "price": {"amount": "50000", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "network": "eip155:8453", "scheme": "exact", "decimals": 6}, "payTo": "0x7373E88368378052EB5a449d2eBC95aD7E5f2bEF", "mimeType": "application/json", "description": "HTTP endpoint health audit for one URL: status and redirect chain, latency p50/p95 over repeated samples, TLS certificate expiry and issuer, the response headers that matter, and a list of detected anomalies (missing HSTS/CSP/X-Content-Type-Options, expiring cert, weak TLS, CORS wildcard, insecure cookies, version disclosure, slow p95, redirect loops). Private, loopback and link-local targets are refused.", "tags": ["http", "monitoring", "security", "tls", "audit"], "queryParams": {"url": "https://example.com"}, "extensions": {"bazaar": {"info": {"input": {"type": "http", "method": "GET", "discoverable": true, "queryParams": {"url": "https://example.com"}}, "output": {"type": "json", "example": {"audited_url": "https://example.com", "final_url": "https://example.com", "final_status": 200, "redirect_chain": [{"url": "https://example.com", "status": 200, "latency_ms": 98.8}], "latency_ms": {"samples": [106.1, 126.4, 92.2], "p50": 106.1, "p95": 126.4, "max": 126.4}, "tls": {"protocol": "TLSv1.3", "cipher": "TLS_AES_256_GCM_SHA384", "not_after": "Dec 25 22:56:35 2026 GMT", "days_to_expiry": 63.3, "issuer": "SSL Corporation", "subject": "example.com", "san_count": 2, "hostname_verified": true}, "headers": {"server": "cloudflare", "content-type": "text/html; charset=utf-8"}, "anomaly_count": 2, "anomalies": [{"id": "missing_strict_transport_security", "detail": "header absent on final hop"}, {"id": "missing_content_security_policy", "detail": "header absent on final hop"}], "audited_at": "2026-10-23T16:46:10Z"}}}, "schema": {"type": "object", "required": ["input"], "properties": {"input": {"type": "object", "required": ["type", "method"], "properties": {"type": {"const": "http"}, "method": {"const": "GET"}, "discoverable": {"const": true}, "queryParams": {"type": "object", "additionalProperties": {"type": "string"}}, "headers": {"type": "object", "additionalProperties": {"type": "string"}}}, "additionalProperties": false}, "output": {"type": "object", "required": ["type"], "properties": {"type": {"type": "string"}, "example": {"type": "object"}}}}}}}}, {"url": "https://cian-x402.netlify.app/v1/py-audit", "method": "POST", "price": {"amount": "50000", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "network": "eip155:8453", "scheme": "exact", "decimals": 6}, "payTo": "0x7373E88368378052EB5a449d2eBC95aD7E5f2bEF", "mimeType": "application/json", "description": "Static audit of one Python source file, computed with the standard library `ast` module and no model. Returns machine-readable findings with stable ids - bare_except, broad_except, mutable_default, unclosed_file, undefined_name, float_money, mutable_class_attr, string_format_in_sql, assert_in_production, shadowed_builtin, open_without_encoding, parameter_mutated_and_returned, todo_marker - each with line, column, severity, detail and a fix_hint. Also returns syntax_ok and, for unparseable input, the error position. No style opinions: every finding is a mechanism. Body cap 64 KiB.", "tags": ["python", "static-analysis", "code-review", "security", "linter", "audit"], "bodyFields": {"source": "python source text, at most 64 KiB", "filename": "optional name used for test-file detection"}, "extensions": {"bazaar": {"info": {"input": {"type": "http", "method": "GET", "discoverable": true, "queryParams": {"source": "aW1wb3J0IG9zCgpkZWYgZihwPVtdKToKICAgIHJldHVybiBvcGVuKHApCg==", "filename": "example.py"}, "description": "GET with the Python source base64url encoded in ?source=. POST with a JSON body of the same text also works and is unchanged."}, "output": {"type": "json", "example": {"filename": "example.py", "syntax_ok": true, "lines": 14, "bytes": 251, "findings": [{"line": 4, "col": 30, "severity": "medium", "id": "mutable_default", "detail": "default value for `tags` is a mutable literal, evaluated once at function definition and shared across every call", "fix_hint": "use None as the default and build the container inside the body"}, {"line": 5, "col": 9, "severity": "low", "id": "open_without_encoding", "detail": "open() without encoding= decodes with the platform's preferred encoding, which is ASCII under LC_ALL=C with UTF-8 mode off", "fix_hint": "pass encoding='utf-8' explicitly"}, {"line": 5, "col": 9, "severity": "medium", "id": "unclosed_file", "detail": "open() outside a `with` block and no matching .close() in the same scope, so the handle is only closed if the interpreter refcounts it away", "fix_hint": "use `with open(...) as f:` so the handle is closed on every path"}, {"line": 10, "col": 12, "severity": "medium", "id": "float_money", "detail": "arithmetic on money-like name `price` uses a float literal, so the result is a binary float with representation error", "fix_hint": "use decimal.Decimal (from str(price)) or integer minor units"}, {"line": 14, "col": 25, "severity": "high", "id": "string_format_in_sql", "detail": "SQL passed to `execute()` is built with an f-string, so a value that contains SQL becomes part of the statement", "fix_hint": "pass parameters to the driver instead of formatting them in"}], "finding_count": 5, "counts_by_id": {"float_money": 1, "mutable_default": 1, "open_without_encoding": 1, "string_format_in_sql": 1, "unclosed_file": 1}, "counts_by_severity": {"high": 1, "medium": 3, "low": 1}, "detectors": ["assert_in_production", "bare_except", "broad_except", "float_money", "mutable_class_attr", "mutable_default", "open_without_encoding", "parameter_mutated_and_returned", "shadowed_builtin", "string_format_in_sql", "todo_marker", "unclosed_file", "undefined_name"]}}}, "schema": {"type": "object", "required": ["input"], "properties": {"input": {"type": "object", "required": ["type", "method"], "properties": {"type": {"const": "http"}, "method": {"const": "GET"}, "discoverable": {"const": true}, "queryParams": {"type": "object", "additionalProperties": {"type": "string"}, "description": "the query parameter holding the Python source, base64url encoded"}}, "additionalProperties": false}, "output": {"type": "object", "required": ["type"], "properties": {"type": {"type": "string"}, "example": {"type": "object"}}}}}}}}, {"url": "https://cian-x402.netlify.app/v1/csv-audit", "method": "POST", "price": {"amount": "50000", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "network": "eip155:8453", "scheme": "exact", "decimals": 6}, "payTo": "0x7373E88368378052EB5a449d2eBC95aD7E5f2bEF", "mimeType": "application/json", "description": "Data-quality report on one CSV document, standard library only. Returns rows, columns, per-column null_count / blank_count / distinct_count / duplicate_value_count, type_inference (int, float, date, email, url, text by a documented 80% majority rule), type_inconsistent_rows with example values, duplicate_rows with row numbers, ragged rows, duplicate header names, encoding_anomalies (BOM, non-ASCII count, control characters, CRLF vs LF mix, missing trailing newline) and quoted_field_anomalies. Handles BOM, CRLF, quoted commas and embedded newlines. Pass key_column for duplicates_by_key. Body cap 1 MiB.", "tags": ["csv", "data-quality", "data-validation", "etl", "audit"], "bodyFields": {"csv": "csv document text, at most 1 MiB", "key_column": "optional column name to check for duplicates"}, "extensions": {"bazaar": {"info": {"input": {"type": "http", "method": "GET", "discoverable": true, "queryParams": {"csv": "aWQsbmFtZSxhbW91bnQKMSxBZGEsMTAuNTAKMSxBZGEsMTAuNTAK", "key_column": "id"}, "description": "GET with the CSV document base64url encoded in ?csv=. POST with a JSON body of the same text also works and is unchanged."}, "output": {"type": "json", "example": {"rows": 7, "columns": ["email", "name", "amount", "note", "created"], "column_count": 5, "column_detail": [{"name": "email", "index": 1, "null_count": 1, "blank_count": 0, "distinct_count": 5, "duplicate_value_count": 1, "type_inference": "email", "type_match_ratio": 1.0, "type_match_ratios": {"int": 0.0, "float": 0.0, "date": 0.0, "email": 1.0, "url": 0.0}, "type_inconsistent_count": 0, "type_inconsistent_rows": []}, {"name": "name", "index": 2, "null_count": 0, "blank_count": 0, "distinct_count": 6, "duplicate_value_count": 1, "type_inference": "text", "type_match_ratio": null, "type_match_ratios": {"int": 0.0, "float": 0.0, "date": 0.0, "email": 0.0, "url": 0.0}, "type_inconsistent_count": 0, "type_inconsistent_rows": []}, {"name": "amount", "index": 3, "null_count": 0, "blank_count": 0, "distinct_count": 6, "duplicate_value_count": 1, "type_inference": "float", "type_match_ratio": 0.8571, "type_match_ratios": {"int": 0.0, "float": 0.8571, "date": 0.0, "email": 0.0, "url": 0.0}, "type_inconsistent_count": 1, "type_inconsistent_rows": [{"row": 8, "value": "n/a"}]}, {"name": "note", "index": 4, "null_count": 1, "blank_count": 0, "distinct_count": 5, "duplicate_value_count": 1, "type_inference": "text", "type_match_ratio": null, "type_match_ratios": {"int": 0.0, "float": 0.0, "date": 0.0, "email": 0.0, "url": 0.0}, "type_inconsistent_count": 0, "type_inconsistent_rows": []}, {"name": "created", "index": 5, "null_count": 0, "blank_count": 0, "distinct_count": 6, "duplicate_value_count": 1, "type_inference": "date", "type_match_ratio": 1.0, "type_match_ratios": {"int": 0.0, "float": 0.0, "date": 1.0, "email": 0.0, "url": 0.0}, "type_inconsistent_count": 0, "type_inconsistent_rows": []}], "blank_lines": {"count": 1, "rows": [6]}, "ragged_rows": {"count": 1, "rows": [4], "examples": [{"row": 4, "fields": 2, "expected": 5}]}, "duplicate_rows": {"count": 1, "rows": [3], "examples": [{"row": 3, "first_seen_at": 1}]}, "duplicate_header_names": [], "encoding_anomalies": {"bom_present": true, "non_ascii_count": 4, "control_chars": {"count": 1, "codepoints": {"U+0007": 1}}, "line_endings": {"style": "mixed", "crlf": 9, "lf": 1, "cr": 0, "mixed": true}, "trailing_newline": false}, "quoted_field_anomalies": {"fields_with_embedded_comma": {"count": 2, "rows": [1, 3]}, "fields_with_embedded_newline": {"count": 1, "rows": [2]}, "fields_with_escaped_quote": {"count": 1, "rows": [5]}}, "key_column": {"name": "email", "index": 1, "comparison": "trimmed and case-folded", "blank_key_rows": 1, "duplicates_by_key": {"count": 1, "rows": [3], "examples": [{"row": 3, "first_seen_at": 1, "value": "ada@example.com"}]}}, "issue_count": 9}}}, "schema": {"type": "object", "required": ["input"], "properties": {"input": {"type": "object", "required": ["type", "method"], "properties": {"type": {"const": "http"}, "method": {"const": "GET"}, "discoverable": {"const": true}, "queryParams": {"type": "object", "additionalProperties": {"type": "string"}, "description": "the query parameter holding the CSV text, base64url encoded"}}, "additionalProperties": false}, "output": {"type": "object", "required": ["type"], "properties": {"type": {"type": "string"}, "example": {"type": "object"}}}}}}}}, {"url": "https://cian-x402.netlify.app/v1/dns-audit", "method": "GET", "price": {"amount": "50000", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "network": "eip155:8453", "scheme": "exact", "decimals": 6}, "payTo": "0x7373E88368378052EB5a449d2eBC95aD7E5f2bEF", "mimeType": "application/json", "description": "DNS and email-authentication audit for one domain: A/AAAA presence, NS count and whether the nameservers share a /24, MX (including a null MX), SPF (missing, multiple, +all, ~all, ?all), DMARC (missing, p=none, no rua, partial pct), a DKIM selector probe, CAA, and whether the zone is DNSSEC-signed. Read entirely over DNS-over-HTTPS, so nothing is sent to the target host. Every finding carries a stable id, a severity and a fix.", "tags": ["dns", "email", "spf", "dmarc", "security", "audit", "monitoring"], "queryParams": {"domain": "example.com"}, "extensions": {"bazaar": {"info": {"input": {"type": "http", "method": "GET", "discoverable": true, "queryParams": {"domain": "example.com"}}, "output": {"type": "json", "example": {"domain": "example.com", "checked": ["A", "AAAA", "NS", "MX", "TXT", "DMARC", "DKIM", "CAA", "DNSSEC"], "finding_count": 3, "severity_counts": {"low": 2, "info": 1}, "findings": [{"id": "dmarc_no_rua", "severity": "low", "detail": "DMARC has no rua= aggregate-report address: you are blind to forgeries", "fix": "add rua=mailto:dmarc@example.com"}, {"id": "no_caa", "severity": "low", "detail": "no CAA record: any public CA may issue a certificate for this domain", "fix": "publish CAA: 0 issue \"letsencrypt.org\""}, {"id": "null_mx", "severity": "info", "detail": "a null MX is published: the domain explicitly accepts no mail"}], "evidence": {"a": ["104.20.23.154", "172.66.147.243"], "ns": ["a.iana-servers.net.", "b.iana-servers.net."], "mx": ["0 ."], "txt": ["v=spf1 -all"], "dmarc": ["v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s"], "caa": [], "dkim_selectors_found": [], "dnssec_ad": true}, "audited_at": "2026-10-23T17:20:32Z"}}}, "schema": {"type": "object", "required": ["input"], "properties": {"input": {"type": "object", "required": ["type", "method"], "properties": {"type": {"const": "http"}, "method": {"const": "GET"}, "discoverable": {"const": true}, "queryParams": {"type": "object", "additionalProperties": {"type": "string"}}}, "additionalProperties": false}, "output": {"type": "object", "required": ["type"], "properties": {"type": {"type": "string"}, "example": {"type": "object"}}}}}}}}, {"url": "https://cian-x402.netlify.app/v1/suite", "method": "GET", "price": {"amount": "80000", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "network": "eip155:8453", "scheme": "exact", "decimals": 6}, "payTo": "0x7373E88368378052EB5a449d2eBC95aD7E5f2bEF", "mimeType": "application/json", "description": "Multi-target suite: for each of up to three public http or https targets, the HTTP endpoint audit (final status, redirect chain, latency p50/p95, TLS expiry and issuer, response headers, anomalies) and the DNS and email-authentication audit for that target's host (NS, MX, SPF, DMARC, a DKIM selector probe, CAA, DNSSEC). One JSON document holding every per-target result, a `checked` list of the operations actually run, and a `summary` counting findings by severity. Refuses private, loopback and link-local targets before doing any work, and returns what it has with `partial: true` rather than running past its time budget.", "tags": ["audit", "monitoring", "dns", "http", "security", "batch"], "queryParams": {"url": "https://example.com", "urls": "https://example.org,https://example.net"}, "extensions": {"bazaar": {"info": {"input": {"type": "http", "method": "GET", "discoverable": true, "queryParams": {"url": "https://example.com", "urls": "https://example.org,https://example.net"}}, "output": {"type": "json", "example": {"suite": "http_audit+dns_audit", "targets": [{"url": "https://example.com", "host": "example.com", "http": {"final_status": 200, "latency_ms": {"p50": 103.9, "p95": 105.2, "max": 105.2}, "tls": {"days_to_expiry": 58.9, "issuer": "SSL Corporation"}, "anomaly_count": 4, "anomalies": [{"id": "missing_cache_control", "detail": "no Cache-Control on final hop"}]}, "dns": {"domain": "example.com", "finding_count": 3, "severity_counts": {"low": 2, "info": 1}}}], "checked": ["http_audit", "dns_audit"], "partial": false, "summary": {"targets_requested": 1, "http_anomalies": 4, "dns_findings": 3, "severity_counts": {"critical": 0, "high": 0, "medium": 0, "low": 2, "info": 1}, "worst_severity": "low"}}}}, "schema": {"type": "object", "required": ["input"], "properties": {"input": {"type": "object", "required": ["type", "method"], "properties": {"type": {"const": "http"}, "method": {"const": "GET"}, "discoverable": {"const": true}, "queryParams": {"type": "object", "additionalProperties": {"type": "string"}, "description": "url holds the first target; urls holds at most two more, comma separated"}}, "additionalProperties": false}, "output": {"type": "object", "required": ["type"], "properties": {"type": {"type": "string"}, "example": {"type": "object"}}}}}}}}]}