{ "info": { "name": "x402 Marketplace", "description": "**x402 Marketplace — 97 scenarios (21 compliant + 76 quirks)**\n\nEvery scenario is a runnable request that surfaces the 402 Payment Required challenge. Each request includes a test script that automatically verifies the expected unpaid behavior — no wallet, no secret, no signing step required.\n\n**How to use:**\n1. Fork or import this collection into Postman.\n2. The `baseUrl` collection variable already points to the live deployment. Change it to test against a local or alternative server.\n3. Run the full collection in the **Collection Runner** or with **Newman** (`newman run x402.postman_collection.json`) — every test should pass.\n4. To complete an actual payment, use `radius-cli` as shown in each request description.\n\n**Network:** eip155:72344 (chain 72344) | **Asset:** 0x33ad9e4BD16B69B5BFdED37D8B5D9fF9aba014Fb | **Facilitator:** https://facilitator.testnet.radiustech.xyz\n\nGenerated live from the catalog at `https://grug402.dev/api/x402/catalog` — never drifts from the real endpoints. Built by people at Radius (https://radiustech.xyz) — Built for Radius workshop. Stablecoin-native settlement infrastructure for the agentic internet.", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json" }, "variable": [ { "key": "baseUrl", "value": "http://127.0.0.1:8080", "type": "string", "description": "Base URL of the x402 API server. Change this to point the collection at a local or alternative deployment." } ], "item": [ { "name": "Happy Path", "description": "15 fully-compliant endpoints. Tests assert HTTP 402 plus a valid PAYMENT-REQUIRED challenge with x402Version, non-empty accepts[], and all required requirement fields.", "item": [ { "name": "Canonical GET (real verify and settle)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/compliant-get", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "compliant-get" ] }, "description": "**Expected behavior:** The textbook x402 flow: an unpaid GET gets a 402 with a PAYMENT-REQUIRED challenge, then the server runs a real /verify and /settle against the Radius testnet facilitator.\n\n**What to watch:** Returns 200 with a PAYMENT-RESPONSE header carrying a real testnet txHash.\n\n**Status:** Compliant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/compliant-get\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Canonical POST with body", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/x402/compliant-post", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "compliant-post" ] }, "description": "**Expected behavior:** The same compliant flow as the canonical GET, for a POST that carries a JSON body.\n\n**What to watch:** The body is echoed back, and the payment really settles.\n\n**Status:** Compliant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 post http://127.0.0.1:8080/api/x402/compliant-post -H 'Content-Type: application/json' -d '{\"query\":\"radius\"}'\n```", "body": { "mode": "raw", "raw": "{\n \"query\": \"radius\"\n}", "options": { "raw": { "language": "json" } } } }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Body-primary GET challenge", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/compliant-body-get", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "compliant-body-get" ] }, "description": "**Expected behavior:** Returns a valid x402 challenge in the response body only (no PAYMENT-REQUIRED header). Clients that read the challenge from the JSON body rather than decoding the base64 header must handle this path.\n\n**What to watch:** Returns 402 with the full PaymentRequired object as JSON body. No PAYMENT-REQUIRED header is set. Pay with radius-cli to confirm the body-reading path works end-to-end.\n\n**Status:** Compliant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/compliant-body-get\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"No PAYMENT-REQUIRED header (body-primary delivery)\", function () {", " pm.expect(pm.response.headers.has(\"payment-required\"), \"header must be absent\").to.be.false;", "});", "", "pm.test(\"Body contains a valid x402 challenge\", function () {", " const body = pm.response.json();", " pm.expect(body, \"body is an object\").to.be.an(\"object\");", " pm.expect(body.x402Version, \"x402Version present\").to.exist;", " pm.expect(body.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = body.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Body-primary POST challenge", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/x402/compliant-body-post", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "compliant-body-post" ] }, "description": "**Expected behavior:** The body-primary happy path for a POST endpoint. Challenge is delivered in the JSON response body only, no PAYMENT-REQUIRED header.\n\n**What to watch:** Returns 402 with the full PaymentRequired object as JSON body. No PAYMENT-REQUIRED header is set.\n\n**Status:** Compliant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 post http://127.0.0.1:8080/api/x402/compliant-body-post -H 'Content-Type: application/json' -d '{\"query\":\"radius\"}'\n```", "body": { "mode": "raw", "raw": "{\n \"query\": \"radius\"\n}", "options": { "raw": { "language": "json" } } } }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"No PAYMENT-REQUIRED header (body-primary delivery)\", function () {", " pm.expect(pm.response.headers.has(\"payment-required\"), \"header must be absent\").to.be.false;", "});", "", "pm.test(\"Body contains a valid x402 challenge\", function () {", " const body = pm.response.json();", " pm.expect(body, \"body is an object\").to.be.an(\"object\");", " pm.expect(body.x402Version, \"x402Version present\").to.exist;", " pm.expect(body.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = body.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Minimal price (1 atomic unit)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/cheapest", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "cheapest" ] }, "description": "**Expected behavior:** A compliant endpoint priced at the smallest atomic unit, 0.000001 SBC.\n\n**What to watch:** Settles a micro-payment without rounding the amount down to zero.\n\n**Status:** Compliant\n**Price:** 0.000001 SBC (1 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/cheapest\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Single testnet accepts entry", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/multi-accepts", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "multi-accepts" ] }, "description": "**Expected behavior:** Advertises one testnet requirement that a correct client selects by matching its network.\n\n**What to watch:** The client picks the eip155:72344 entry rather than blindly taking accepts[0].\n\n**Status:** Compliant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/multi-accepts\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Correct idempotency (cached retry)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/idempotent-retry", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "idempotent-retry" ] }, "description": "**Expected behavior:** Caches the result by payment id, so retrying the same payment returns the cached 200 without charging twice.\n\n**What to watch:** A second call with the same payment returns Idempotent-Replay: true and does not re-settle.\n\n**Status:** Compliant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/idempotent-retry\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Weather API (pay-per-call)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/weather-now", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "weather-now" ] }, "description": "**Expected behavior:** A themed but fully compliant data endpoint, gated by a real settlement.\n\n**What to watch:** Behaves like a genuine paid API: real verify and settle, then 200.\n\n**Status:** Compliant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/weather-now\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "FX rate API (pay-per-call)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/fx-rate", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "fx-rate" ] }, "description": "**Expected behavior:** A themed compliant endpoint that returns an exchange rate after settlement.\n\n**What to watch:** Real verify and settle before the rate is returned.\n\n**Status:** Compliant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/fx-rate\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Haiku generator (POST, paid)", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/x402/haiku-generator", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "haiku-generator" ] }, "description": "**Expected behavior:** A compliant POST endpoint that returns generated content after settlement.\n\n**What to watch:** The body is accepted and the payment settles before content is returned.\n\n**Status:** Compliant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 post http://127.0.0.1:8080/api/x402/haiku-generator -H 'Content-Type: application/json' -d '{\"topic\":\"x402\"}'\n```", "body": { "mode": "raw", "raw": "{\n \"topic\": \"x402\"\n}", "options": { "raw": { "language": "json" } } } }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Joke API (pay-per-call)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/joke-api", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "joke-api" ] }, "description": "**Expected behavior:** A compliant GET that returns a joke after a real settlement.\n\n**What to watch:** Real verify and settle, then 200 with a PAYMENT-RESPONSE.\n\n**Status:** Compliant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/joke-api\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Dictionary API (pay-per-call)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/dictionary-api", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "dictionary-api" ] }, "description": "**Expected behavior:** A compliant GET that returns a definition after settlement.\n\n**What to watch:** Behaves like a genuine paid lookup.\n\n**Status:** Compliant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/dictionary-api\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Quote API (pay-per-call)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/quote-api", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "quote-api" ] }, "description": "**Expected behavior:** A compliant GET that returns a quote after settlement.\n\n**What to watch:** Real verify and settle before the quote is returned.\n\n**Status:** Compliant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/quote-api\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "MPP push happy path (EIP-3009)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/mpp/mpp-push-happy", "host": [ "{{baseUrl}}" ], "path": [ "api", "mpp", "mpp-push-happy" ] }, "description": "**Expected behavior:** Compliant MPP push flow: server issues WWW-Authenticate: Payment challenge, client submits EIP-3009 authorization credential, server validates structure and returns 200 with Payment-Receipt.\n\n**What to watch:** Returns 200 with Payment-Receipt header. Submit Authorization: Payment credential=\"\" to pass.\n\n**Status:** Compliant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/mpp/mpp-push-happy\n```" }, "response": [], "event": [] }, { "name": "MPP permit happy path (EIP-2612)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/mpp/mpp-permit-happy", "host": [ "{{baseUrl}}" ], "path": [ "api", "mpp", "mpp-permit-happy" ] }, "description": "**Expected behavior:** Compliant MPP permit flow: challenge requests an EIP-2612 permit credential. Client submits signed permit in Authorization: Payment, server validates and returns 200.\n\n**What to watch:** Returns 200 with Payment-Receipt. Credential must have type:\"permit\" with owner/spender/value/deadline/nonce/v/r/s fields.\n\n**Status:** Compliant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/mpp/mpp-permit-happy\n```" }, "response": [], "event": [] } ] }, { "name": "402 / Challenge Construction", "description": "29 quirk endpoints — each deviates from the x402 spec in exactly one documented way. Tests assert the specific deviation is present in the unpaid response.", "item": [ { "name": "Returns 401 instead of 402", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/status-401", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "status-401" ] }, "description": "**Expected behavior:** Gates the resource with 401 Unauthorized instead of 402 Payment Required.\n\n**What to watch:** Clients that key on a 402 never start the payment flow.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/status-401\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 401\", function () {", " pm.response.to.have.status(401);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Returns 403 instead of 402", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/status-403", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "status-403" ] }, "description": "**Expected behavior:** Gates the resource with 403 Forbidden instead of 402.\n\n**What to watch:** Looks like a hard authorization failure, so the client never sees a payment challenge.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/status-403\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 403\", function () {", " pm.response.to.have.status(403);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Returns 400 instead of 402", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/status-400", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "status-400" ] }, "description": "**Expected behavior:** Gates the resource with 400 Bad Request instead of 402.\n\n**What to watch:** A valid call looks malformed, so the client never starts paying.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/status-400\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 400\", function () {", " pm.response.to.have.status(400);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Returns 200 with content (no gate)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/status-200-leak", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "status-200-leak" ] }, "description": "**Expected behavior:** Serves the protected content for free with a 200 and no payment gate.\n\n**What to watch:** A total bypass — paid content is leaked to non-payers.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/status-200-leak\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", function () {", " pm.response.to.have.status(200);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", "});" ] } } ] }, { "name": "402 without PAYMENT-REQUIRED header", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/missing-payment-required", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "missing-payment-required" ] }, "description": "**Expected behavior:** Returns a 402 but omits the PAYMENT-REQUIRED header entirely.\n\n**What to watch:** The client is told to pay but has no requirements to sign against.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/missing-payment-required\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"No PAYMENT-REQUIRED header (documented deviation)\", function () {", " const h = pm.response.headers.get(\"payment-required\");", " pm.expect(h, \"PAYMENT-REQUIRED must be absent\").to.not.exist;", "});", "// Deviation: Returns 402 but omits PAYMENT-REQUIRED header entirely; client has no challenge to sign against." ] } } ] }, { "name": "PAYMENT-REQUIRED is raw JSON (not base64)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/header-raw-json", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "header-raw-json" ] }, "description": "**Expected behavior:** Sends the PAYMENT-REQUIRED requirements as raw JSON instead of base64.\n\n**What to watch:** Strict base64 decoders fail to parse the header.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/header-raw-json\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED is present and is raw JSON (not base64) — deviation\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header present\").to.be.a(\"string\").and.not.empty;", " let isRawJson = false;", " try { JSON.parse(raw); isRawJson = true; } catch (_) {}", " pm.expect(isRawJson, \"value is parseable as raw JSON (not base64-encoded)\").to.be.true;", "});" ] } } ] }, { "name": "PAYMENT-REQUIRED is invalid base64", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/header-bad-base64", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "header-bad-base64" ] }, "description": "**Expected behavior:** The PAYMENT-REQUIRED header value is not valid base64.\n\n**What to watch:** The client throws at the decode step, before it can read the requirements.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/header-bad-base64\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED is present but fails base64 decode — deviation\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header present\").to.be.a(\"string\").and.not.empty;", " let threw = false;", " try { atob(raw); } catch (_) { threw = true; }", " pm.expect(threw, \"atob() must throw on invalid base64\").to.be.true;", "});" ] } } ] }, { "name": "Base64 decodes to non-JSON", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/header-base64-not-json", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "header-base64-not-json" ] }, "description": "**Expected behavior:** The PAYMENT-REQUIRED header is valid base64 but decodes to bytes that are not JSON.\n\n**What to watch:** JSON parsing fails after a successful base64 decode.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/header-base64-not-json\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED base64-decodes but is not valid JSON — deviation\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header present\").to.be.a(\"string\").and.not.empty;", " let decoded;", " try { decoded = atob(raw); } catch (_) { pm.expect.fail(\"Expected valid base64 — the deviation is in JSON parsing, not base64 decoding.\"); }", " let jsonThrew = false;", " try { JSON.parse(decoded); } catch (_) { jsonThrew = true; }", " pm.expect(jsonThrew, \"JSON.parse must throw on non-JSON bytes\").to.be.true;", "});" ] } } ] }, { "name": "Atomic amount as a JSON number", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/amount-as-number", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "amount-as-number" ] }, "description": "**Expected behavior:** Emits the atomic amount as a JSON number instead of a string.\n\n**What to watch:** A number-typed amount can silently lose precision; the spec requires a string.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/amount-as-number\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " pm.expect(typeof challenge.accepts[0].amount, \"amount is typeof number (deviation)\").to.equal(\"number\");", "});" ] } } ] }, { "name": "Missing x402Version", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/missing-x402-version", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "missing-x402-version" ] }, "description": "**Expected behavior:** The PAYMENT-REQUIRED body omits the x402Version field.\n\n**What to watch:** The client cannot confirm which protocol version it is negotiating.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/missing-x402-version\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Legacy v1 headers (X-PAYMENT)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/legacy-v1-headers", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "legacy-v1-headers" ] }, "description": "**Expected behavior:** Emits the legacy v1 X-PAYMENT header instead of the v2 PAYMENT-REQUIRED challenge.\n\n**What to watch:** v2-only clients ignore it and see no payment prompt.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/legacy-v1-headers\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"X-PAYMENT (v1 legacy) header present; no PAYMENT-REQUIRED (deviation)\", function () {", " pm.response.to.have.header(\"x-payment\");", " pm.expect(pm.response.headers.get(\"payment-required\"), \"v2 PAYMENT-REQUIRED must be absent\").to.not.exist;", "});" ] } } ] }, { "name": "Empty accepts array", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/empty-accepts", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "empty-accepts" ] }, "description": "**Expected behavior:** The PAYMENT-REQUIRED challenge advertises an empty accepts array.\n\n**What to watch:** The client has no payment option to select.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/empty-accepts\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is empty (deviation)\").to.be.an(\"array\").that.is.empty;", "});" ] } } ] }, { "name": "Unsupported payment scheme", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/unsupported-scheme", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "unsupported-scheme" ] }, "description": "**Expected behavior:** Advertises a payment scheme the facilitator does not support.\n\n**What to watch:** The client cannot construct a matching payment payload.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/unsupported-scheme\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " pm.expect(challenge.accepts[0].scheme, \"scheme is not 'exact' (deviation)\").to.not.equal(\"exact\");", "});" ] } } ] }, { "name": "Advertises mainnet, settles on testnet", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/wrong-network-mainnet", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "wrong-network-mainnet" ] }, "description": "**Expected behavior:** Advertises a mainnet network id while the facilitator runs on testnet.\n\n**What to watch:** Testnet wallets find no matching network, so verify fails.\n\n**Status:** Quirk — responsible party if it misbehaves: Network / Chain\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/wrong-network-mainnet\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", " pm.expect(challenge.accepts[0].network, \"network is deviation value\").to.equal(\"eip155:723487\");", "});" ] } } ] }, { "name": "Wrong token contract address", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/wrong-token", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "wrong-token" ] }, "description": "**Expected behavior:** Advertises an asset contract address that is not SBC.\n\n**What to watch:** Verification fails on an asset mismatch.\n\n**Status:** Quirk — responsible party if it misbehaves: Token Issuer\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/wrong-token\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", " pm.expect((challenge.accepts[0].asset || \"\").toLowerCase(), \"asset is deviation value\").to.equal(\"0xdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef\");", "});" ] } } ] }, { "name": "Wrong decimals (18 instead of 6)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/wrong-decimals", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "wrong-decimals" ] }, "description": "**Expected behavior:** Expresses the amount with 18 decimals for a token that has 6.\n\n**What to watch:** Overcharges by roughly a trillion times.\n\n**Status:** Quirk — responsible party if it misbehaves: Token Issuer\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/wrong-decimals\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", " // Wrong-decimals: amount string should be >> 8 digits for a 18-decimal representation of a 6-decimal token price.", " pm.expect(String(challenge.accepts[0].amount).length, \"amount length indicates wrong-decimal encoding (deviation)\").to.be.above(8);", "});" ] } } ] }, { "name": "Wrong payTo address", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/wrong-payto", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "wrong-payto" ] }, "description": "**Expected behavior:** Advertises a payTo address that is not the merchant's wallet.\n\n**What to watch:** A successful settlement would route funds to the wrong recipient.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/wrong-payto\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", " pm.expect((challenge.accepts[0].payTo || \"\").toLowerCase(), \"payTo is deviation value\").to.equal(\"0x00000000000000000000000000000000deadbeef\");", "});" ] } } ] }, { "name": "Missing resource URL", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/missing-resource", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "missing-resource" ] }, "description": "**Expected behavior:** The PAYMENT-REQUIRED challenge omits the resource object.\n\n**What to watch:** The payment cannot be bound to the specific request.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/missing-resource\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", " pm.expect(challenge.resource, \"resource is absent (deviation)\").to.not.exist;", "});" ] } } ] }, { "name": "Already-expired quote (timeout 0)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/expired-quote", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "expired-quote" ] }, "description": "**Expected behavior:** Sets maxTimeoutSeconds to 0, so the quote is dead on arrival.\n\n**What to watch:** The signature expires before it can be used.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/expired-quote\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", " pm.expect(challenge.accepts[0].maxTimeoutSeconds, \"maxTimeoutSeconds is 0 (deviation)\").to.equal(0);", "});" ] } } ] }, { "name": "Overlong validity window (1 year)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/overlong-validity", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "overlong-validity" ] }, "description": "**Expected behavior:** Sets maxTimeoutSeconds to a full year, widening the replay window.\n\n**What to watch:** A signed quote stays usable for far too long.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/overlong-validity\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", " pm.expect(challenge.accepts[0].maxTimeoutSeconds, \"maxTimeoutSeconds > 86400 (deviation)\").to.be.above(86400);", "});" ] } } ] }, { "name": "Price changes every request", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/changing-price", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "changing-price" ] }, "description": "**Expected behavior:** Increases the advertised amount on every request.\n\n**What to watch:** The quote a client signs may no longer match the server at settle time.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/changing-price\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Dollar-string price ($0.0001)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/dollar-string-price", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "dollar-string-price" ] }, "description": "**Expected behavior:** Advertises the amount as a human dollar string instead of atomic units.\n\n**What to watch:** Atomic-unit parsers reject the value.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/dollar-string-price\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " pm.expect(String(challenge.accepts[0].amount), \"amount starts with '$' (deviation)\").to.match(/^\\$/);", "});" ] } } ] }, { "name": "Sensitive data in metadata", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/sensitive-metadata", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "sensitive-metadata" ] }, "description": "**Expected behavior:** Leaks fake PII into the resource description before any payment.\n\n**What to watch:** The facilitator and on-chain observers see sensitive intent.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/sensitive-metadata\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", " pm.expect(challenge.resource && challenge.resource.description, \"resource.description contains expected deviation text\").to.include(\"patient\");", "});" ] } } ] }, { "name": "Wrong asset transfer method", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/wrong-transfer-method", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "wrong-transfer-method" ] }, "description": "**Expected behavior:** Sets extra.assetTransferMethod to something other than permit2, so the facilitator can't move funds.\n\n**What to watch:** Verification fails on a transfer-method mismatch.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/wrong-transfer-method\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", " const xferMethod = challenge.accepts[0].extra && challenge.accepts[0].extra.assetTransferMethod;", " pm.expect(xferMethod, \"assetTransferMethod is deviation value\").to.equal(\"erc20-transferFrom\");", "});" ] } } ] }, { "name": "Advertises a zero price but still gates", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/zero-price-gated", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "zero-price-gated" ] }, "description": "**Expected behavior:** Advertises an amount of 0 yet still demands a payment header.\n\n**What to watch:** The client signs a zero-value permit that settles nothing.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0 SBC (0 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/zero-price-gated\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", " pm.expect(String(challenge.accepts[0].amount), \"amount is 0 (deviation)\").to.equal(\"0\");", "});" ] } } ] }, { "name": "MPP challenge returns 401 instead of 402", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/mpp/mpp-wrong-status", "host": [ "{{baseUrl}}" ], "path": [ "api", "mpp", "mpp-wrong-status" ] }, "description": "**Expected behavior:** Issues the MPP payment challenge with HTTP 401 Unauthorized instead of the required 402 Payment Required.\n\n**What to watch:** Clients that key on status 402 to start the MPP flow never see the payment prompt.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/mpp/mpp-wrong-status\n```" }, "response": [], "event": [] }, { "name": "MPP 402 without WWW-Authenticate", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/mpp/mpp-missing-authenticate", "host": [ "{{baseUrl}}" ], "path": [ "api", "mpp", "mpp-missing-authenticate" ] }, "description": "**Expected behavior:** Returns 402 but omits the WWW-Authenticate: Payment header entirely. The client receives a payment signal but no challenge to respond to.\n\n**What to watch:** Client stalls — no challenge means no credential can be constructed.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/mpp/mpp-missing-authenticate\n```" }, "response": [], "event": [] }, { "name": "WWW-Authenticate challenge is raw JSON (not Payment scheme)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/mpp/mpp-raw-json-authenticate", "host": [ "{{baseUrl}}" ], "path": [ "api", "mpp", "mpp-raw-json-authenticate" ] }, "description": "**Expected behavior:** Emits WWW-Authenticate with the challenge embedded as raw JSON instead of the \"Payment method=\\\"evm/charge\\\" challenge=\\\"\\\"\" format.\n\n**What to watch:** Strict MPP parsers reject the malformed auth-scheme and cannot extract the challenge.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/mpp/mpp-raw-json-authenticate\n```" }, "response": [], "event": [] }, { "name": "WWW-Authenticate uses Bearer instead of Payment scheme", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/mpp/mpp-bearer-authenticate", "host": [ "{{baseUrl}}" ], "path": [ "api", "mpp", "mpp-bearer-authenticate" ] }, "description": "**Expected behavior:** Returns WWW-Authenticate: Bearer realm=\"...\" — the OAuth scheme — instead of the Payment scheme. MPP clients have no credential type to submit.\n\n**What to watch:** An OAuth client might initiate a token flow; an MPP client sees no payment challenge.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/mpp/mpp-bearer-authenticate\n```" }, "response": [], "event": [] } ] }, { "name": "Verification Gaps", "description": "5 quirk endpoints — each deviates from the x402 spec in exactly one documented way. Tests assert the specific deviation is present in the unpaid response.", "item": [ { "name": "Skips /verify, settles directly", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/skip-verify", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "skip-verify" ] }, "description": "**Expected behavior:** Goes straight to /settle without a /verify pre-check.\n\n**What to watch:** Bad payloads are only caught at settle time.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/skip-verify\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Grants on /verify, never settles", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/verify-only-no-settle", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "verify-only-no-settle" ] }, "description": "**Expected behavior:** Grants access once /verify succeeds and never calls /settle.\n\n**What to watch:** The service is delivered but the merchant is never paid.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/verify-only-no-settle\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "No verification at all", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/no-facilitator-check", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "no-facilitator-check" ] }, "description": "**Expected behavior:** Grants access on the mere presence of a PAYMENT-SIGNATURE header.\n\n**What to watch:** Any non-empty header unlocks the resource.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/no-facilitator-check\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Trusts client-supplied result", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/trust-client-response", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "trust-client-response" ] }, "description": "**Expected behavior:** Believes a client-asserted payment result without checking the facilitator.\n\n**What to watch:** A client can fabricate a 'paid' claim.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/trust-client-response\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Fails open when the facilitator is down", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/fail-open-timeout", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "fail-open-timeout" ] }, "description": "**Expected behavior:** Serves the resource anyway when the facilitator is unreachable.\n\n**What to watch:** An availability failure turns into free access.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/fail-open-timeout\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] } ] }, { "name": "Replay / Idempotency / Race", "description": "2 quirk endpoints — each deviates from the x402 spec in exactly one documented way. Tests assert the specific deviation is present in the unpaid response.", "item": [ { "name": "Replay after success (no binding)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/replay-after-success", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "replay-after-success" ] }, "description": "**Expected behavior:** Once a payment settles, the same payload re-serves the resource forever with no re-settle.\n\n**What to watch:** Pay once, fetch many — call it twice with the same wallet.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/replay-after-success\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Serves before settlement (verify/settle gap)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/serve-before-settle", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "serve-before-settle" ] }, "description": "**Expected behavior:** Returns 200 immediately and settles in the background.\n\n**What to watch:** The resource leaves before the charge is confirmed.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/serve-before-settle\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] } ] }, { "name": "Web / HTTP Layer", "description": "2 quirk endpoints — each deviates from the x402 spec in exactly one documented way. Tests assert the specific deviation is present in the unpaid response.", "item": [ { "name": "CORS hides payment headers", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/cors-hides-headers", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "cors-hides-headers" ] }, "description": "**Expected behavior:** Does not expose the PAYMENT-REQUIRED and PAYMENT-RESPONSE headers via CORS.\n\n**What to watch:** Browser clients cannot read the challenge or the receipt.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/cors-hides-headers\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "HEAD reveals paid metadata", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/head-leak", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "head-leak" ] }, "description": "**Expected behavior:** A HEAD request returns 200 with a leak header and no payment.\n\n**What to watch:** Try curl -I against this path.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/head-leak\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] } ] }, { "name": "Schemes (exact / upto / batch)", "description": "3 compliant and 5 quirk endpoints. Compliant tests assert a full valid challenge; quirk tests assert the specific documented deviation.", "item": [ { "name": "upto: settles actual usage", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/x402/upto-correct", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "upto-correct" ] }, "description": "**Expected behavior:** Authorizes a maximum but settles only the actual usage (~60%).\n\n**What to watch:** settledAmount is below the authorized max.\n\n**Status:** Compliant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 post http://127.0.0.1:8080/api/x402/upto-correct -H 'Content-Type: application/json' -d '{\"tokens\":600}'\n```", "body": { "mode": "raw", "raw": "{\n \"tokens\": 600\n}", "options": { "raw": { "language": "json" } } } }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "upto: always charges the max", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/x402/upto-charges-max", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "upto-charges-max" ] }, "description": "**Expected behavior:** Settles the full authorized max even when usage is lower.\n\n**What to watch:** The buyer overpays for light usage.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 post http://127.0.0.1:8080/api/x402/upto-charges-max -H 'Content-Type: application/json' -d '{\"tokens\":10}'\n```", "body": { "mode": "raw", "raw": "{\n \"tokens\": 10\n}", "options": { "raw": { "language": "json" } } } }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "upto: override exceeds the max", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/x402/upto-override-exceeds-max", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "upto-override-exceeds-max" ] }, "description": "**Expected behavior:** Sets the settlement amount above the authorized maximum.\n\n**What to watch:** The server tries to take more than the client allowed.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 post http://127.0.0.1:8080/api/x402/upto-override-exceeds-max -H 'Content-Type: application/json' -d '{\"tokens\":5000}'\n```", "body": { "mode": "raw", "raw": "{\n \"tokens\": 5000\n}", "options": { "raw": { "language": "json" } } } }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "upto: settles zero (free)", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/x402/upto-zero-free", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "upto-zero-free" ] }, "description": "**Expected behavior:** A settlement override of 0 gives the service away by accident.\n\n**What to watch:** A paid scheme yields zero revenue.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 post http://127.0.0.1:8080/api/x402/upto-zero-free -H 'Content-Type: application/json' -d '{\"tokens\":600}'\n```", "body": { "mode": "raw", "raw": "{\n \"tokens\": 600\n}", "options": { "raw": { "language": "json" } } } }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "batch-settlement: deposit, then reconcile usage", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/x402/batch-settlement-correct", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "batch-settlement-correct" ] }, "description": "**Expected behavior:** Advertises the batch-settlement scheme: the client authorizes a 5x deposit, and the server settles only the actual (much lower) usage.\n\n**What to watch:** settledAmount is far below authorizedDeposit, and reconciled is true.\n\n**Status:** Compliant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 post http://127.0.0.1:8080/api/x402/batch-settlement-correct -H 'Content-Type: application/json' -d '{\"calls\":3}'\n```", "body": { "mode": "raw", "raw": "{\n \"calls\": 3\n}", "options": { "raw": { "language": "json" } } } }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "batch-settlement: settles beyond the deposit", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/x402/batch-settlement-overcharge-deposit", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "batch-settlement-overcharge-deposit" ] }, "description": "**Expected behavior:** Settles more than the deposit the client authorized under the batch scheme.\n\n**What to watch:** Settlement exceeds authorizedDeposit — the facilitator should reject the overcharge.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 post http://127.0.0.1:8080/api/x402/batch-settlement-overcharge-deposit -H 'Content-Type: application/json' -d '{\"calls\":3}'\n```", "body": { "mode": "raw", "raw": "{\n \"calls\": 3\n}", "options": { "raw": { "language": "json" } } } }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "batch-settlement: never reconciles down", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/x402/batch-settlement-never-reconciles", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "batch-settlement-never-reconciles" ] }, "description": "**Expected behavior:** Holds the full authorized deposit and never settles the lower real usage.\n\n**What to watch:** settledAmount equals authorizedDeposit and reconciled is false — the buyer overpays.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 post http://127.0.0.1:8080/api/x402/batch-settlement-never-reconciles -H 'Content-Type: application/json' -d '{\"calls\":1}'\n```", "body": { "mode": "raw", "raw": "{\n \"calls\": 1\n}", "options": { "raw": { "language": "json" } } } }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "exact: canonical scheme identifier (client sends the wrong one)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/client-scheme-mismatch", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "client-scheme-mismatch" ] }, "description": "**Expected behavior:** A fully compliant exact endpoint. The scheme identifier in the payment payload MUST be the canonical \"exact\" — a client that instead sends a non-canonical name like \"exact-evm\" is rejected by the facilitator with invalid_exact_evm_scheme even though its signature recovers a valid payer.\n\n**What to watch:** Pay with the canonical scheme \"exact\" and it settles. Send scheme:\"exact-evm\" and the facilitator returns 402 with PAYMENT-RESPONSE invalidReason \"invalid_exact_evm_scheme\" and the recovered payer — the fix is on the client.\n\n**Status:** Compliant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/client-scheme-mismatch\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] } ] }, { "name": "Multi-Network Selection (MCP)", "description": "2 compliant and 1 quirk endpoints. Compliant tests assert a full valid challenge; quirk tests assert the specific documented deviation.", "item": [ { "name": "Genuine multi-entry accepts (match by network)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/multi-network-accepts", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "multi-network-accepts" ] }, "description": "**Expected behavior:** Advertises two EVM entries — Base Sepolia first, Radius testnet second — so the client must match by network instead of taking accepts[0].\n\n**What to watch:** A correct client skips accepts[0] (Base Sepolia) and pays the eip155:72344 entry.\n\n**Status:** Compliant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/multi-network-accepts\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "SVM-only requirement (solana:*)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/svm-requirement", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "svm-requirement" ] }, "description": "**Expected behavior:** Advertises only a Solana (solana:*) requirement, which an EVM testnet client cannot satisfy.\n\n**What to watch:** An EVM wallet finds no compatible entry; surfaces SVM network selection.\n\n**Status:** Quirk — responsible party if it misbehaves: Network / Chain\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/svm-requirement\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", " pm.expect(challenge.accepts[0].network, \"network starts with 'solana:' (deviation)\").to.match(\"^solana:\");", "});" ] } } ] }, { "name": "Cross-VM accepts (EVM and SVM together)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/cross-vm-accepts", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "cross-vm-accepts" ] }, "description": "**Expected behavior:** Advertises a Solana entry and a Radius testnet EVM entry together, forcing the client to select the VM and network it can settle on.\n\n**What to watch:** A correct client picks the EVM eip155:72344 entry and ignores the solana:* one.\n\n**Status:** Compliant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/cross-vm-accepts\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] } ] }, { "name": "Client Policy Gate (MCP)", "description": "4 quirk endpoints — each deviates from the x402 spec in exactly one documented way. Tests assert the specific deviation is present in the unpaid response.", "item": [ { "name": "Overpriced vs per-call cap", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/overpriced-vs-cap", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "overpriced-vs-cap" ] }, "description": "**Expected behavior:** Advertises a price far above a sane per-call cap that an MCP policy gate would enforce.\n\n**What to watch:** A max-amount policy check rejects this before signing; a capless client overpays.\n\n**Status:** Quirk — responsible party if it misbehaves: Client\n**Price:** 1 SBC (1000000 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/overpriced-vs-cap\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Resource host mismatch", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/resource-host-mismatch", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "resource-host-mismatch" ] }, "description": "**Expected behavior:** The advertised resource origin differs from the server actually being called.\n\n**What to watch:** An expected-resource-server policy check rejects the mismatched origin before signing.\n\n**Status:** Quirk — responsible party if it misbehaves: Client\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/resource-host-mismatch\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", " pm.expect(challenge.resource && challenge.resource.url, \"resource.url contains 'unrelated-host.example.com' (deviation)\").to.include(\"unrelated-host.example.com\");", "});" ] } } ] }, { "name": "Tool / operation mismatch", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/tool-operation-mismatch", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "tool-operation-mismatch" ] }, "description": "**Expected behavior:** The requirement authorizes a different, more privileged tool than the one being requested.\n\n**What to watch:** A tool-name binding check rejects the requirement before signing.\n\n**Status:** Quirk — responsible party if it misbehaves: Client\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/tool-operation-mismatch\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", " pm.expect(challenge.resource && challenge.resource.description, \"resource.description contains expected deviation text\").to.include(\"admin.deleteAllRecords\");", "});" ] } } ] }, { "name": "Session price escalation", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/session-price-escalation", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "session-price-escalation" ] }, "description": "**Expected behavior:** The price climbs call over call (1x, 2x, 3x...) to defeat a per-session spend limit.\n\n**What to watch:** Each call may slip under a per-call cap, but a per-session budget check catches the running total.\n\n**Status:** Quirk — responsible party if it misbehaves: Client\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/session-price-escalation\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] } ] }, { "name": "Facilitator Dependency", "description": "12 quirk endpoints — each deviates from the x402 spec in exactly one documented way. Tests assert the specific deviation is present in the unpaid response.", "item": [ { "name": "Dead facilitator URL", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/dead-facilitator", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "dead-facilitator" ] }, "description": "**Expected behavior:** Points /verify and /settle at a facilitator host that does not exist.\n\n**What to watch:** Returns 502 — the payment can never complete.\n\n**Status:** Quirk — responsible party if it misbehaves: Facilitator\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/dead-facilitator\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Facilitator can't support the network", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/unsupported-network-facilitator", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "unsupported-network-facilitator" ] }, "description": "**Expected behavior:** Advertises a network the facilitator does not handle.\n\n**What to watch:** Verify fails with an unsupported-network error.\n\n**Status:** Quirk — responsible party if it misbehaves: Facilitator\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/unsupported-network-facilitator\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", " pm.expect(challenge.accepts[0].network, \"network is deviation value\").to.equal(\"eip155:999999\");", "});" ] } } ] }, { "name": "Facilitator rate-limits /verify (429 → misclassified 402)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/facilitator-rate-limited", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "facilitator-rate-limited" ] }, "description": "**Expected behavior:** The facilitator returns 429 during /verify; the merchant misclassifies it as a payment failure and returns 402 instead of 503 + Retry-After.\n\n**What to watch:** The client sees 402 and thinks its payment is invalid — it cannot tell a rate limit from a real rejection.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/facilitator-rate-limited\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Facilitator temporarily unavailable (503)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/facilitator-soft-down-503", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "facilitator-soft-down-503" ] }, "description": "**Expected behavior:** The facilitator is reachable but returns 503 Service Unavailable — it is not a dead URL, just temporarily down.\n\n**What to watch:** Returns 502. Unlike a dead-facilitator connection error, the facilitator answered; it is temporarily unable to process payments.\n\n**Status:** Quirk — responsible party if it misbehaves: Facilitator\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/facilitator-soft-down-503\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Settle returns 500 (ambiguous paid state)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/facilitator-settle-500", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "facilitator-settle-500" ] }, "description": "**Expected behavior:** /verify succeeds but /settle returns 500 Internal Server Error, leaving it unknown whether the payment landed on-chain.\n\n**What to watch:** Returns 502. The client cannot safely retry with the same permit — the charge might already be confirmed on-chain.\n\n**Status:** Quirk — responsible party if it misbehaves: Facilitator\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/facilitator-settle-500\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Settle succeeds without txHash", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/facilitator-missing-txhash", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "facilitator-missing-txhash" ] }, "description": "**Expected behavior:** /settle reports success: true but omits every transaction-hash field; the PAYMENT-RESPONSE receipt carries no on-chain proof.\n\n**What to watch:** Returns 200 but the PAYMENT-RESPONSE header has no txHash — the client cannot verify the settlement on-chain.\n\n**Status:** Quirk — responsible party if it misbehaves: Facilitator\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/facilitator-missing-txhash\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Non-JSON facilitator response leaked in 402", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/facilitator-non-json-leaks", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "facilitator-non-json-leaks" ] }, "description": "**Expected behavior:** The facilitator returns an HTML maintenance page instead of JSON; the merchant forwards the raw HTML in the 402 response body, leaking internal infrastructure details.\n\n**What to watch:** The 402 body contains a raw HTML error page with internal build tags and server identifiers.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/facilitator-non-json-leaks\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Schema drift: valid vs isValid (loose check grants)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/facilitator-schema-drift", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "facilitator-schema-drift" ] }, "description": "**Expected behavior:** The facilitator returns { valid: true } instead of the spec's { isValid: true }; the merchant's loose field-name check grants access on the wrong key.\n\n**What to watch:** Returns 200 despite the field-name mismatch — a compliant client relying on isValid would have denied access.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/facilitator-schema-drift\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "No timeout on /verify (hangs indefinitely)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/facilitator-no-verify-timeout", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "facilitator-no-verify-timeout" ] }, "description": "**Expected behavior:** The merchant's /verify fetch has no AbortController or timeout; when the facilitator is slow the handler ties up the connection forever.\n\n**What to watch:** The request hangs — no response arrives. You will need to Ctrl+C or wait for your client's own timeout to fire.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/facilitator-no-verify-timeout\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Wrong payTo used at settle time", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/facilitator-wrong-payto-at-settle", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "facilitator-wrong-payto-at-settle" ] }, "description": "**Expected behavior:** The merchant calls /settle with a payTo address different from the one advertised in the challenge; the facilitator rejects it because the payment was signed for a different recipient.\n\n**What to watch:** Returns 402. The facilitator rejects the mismatched payTo — funds would have gone to the wrong address if the call had succeeded.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/facilitator-wrong-payto-at-settle\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Grants access despite settle failure", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/facilitator-already-settled-grants", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "facilitator-already-settled-grants" ] }, "description": "**Expected behavior:** When /settle returns a failure (e.g., already used), the merchant grants access anyway — a replay attacker can reuse any previously-rejected permit for free.\n\n**What to watch:** Returns 200 even though settle failed. The merchant is giving away the resource without confirmed payment.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/facilitator-already-settled-grants\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Concurrent settle race (second racer gets 402)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/facilitator-settle-concurrent-race", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "facilitator-settle-concurrent-race" ] }, "description": "**Expected behavior:** Two concurrent requests carry the same PAYMENT-SIGNATURE; without a per-permit lock the merchant lets both race to /settle. The facilitator accepts only one — the second racer is charged but gets a confusing 402.\n\n**What to watch:** Returns 402 with an 'already used' detail — the client paid but the second concurrent call lost the settle race.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/facilitator-settle-concurrent-race\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] } ] }, { "name": "Paid-but-Denied / Unpaid-Service", "description": "3 quirk endpoints — each deviates from the x402 spec in exactly one documented way. Tests assert the specific deviation is present in the unpaid response.", "item": [ { "name": "Settles, then the handler fails", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/settle-then-fail", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "settle-then-fail" ] }, "description": "**Expected behavior:** The payment settles on-chain, then the handler returns 500.\n\n**What to watch:** The buyer is charged but receives nothing — check the txHash.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/settle-then-fail\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Success without PAYMENT-RESPONSE", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/missing-payment-response", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "missing-payment-response" ] }, "description": "**Expected behavior:** Settles and returns 200 but omits the PAYMENT-RESPONSE header.\n\n**What to watch:** The client cannot read its settlement receipt.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/missing-payment-response\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "MPP paid-but-denied (403 after valid credential)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/mpp/mpp-paid-denied", "host": [ "{{baseUrl}}" ], "path": [ "api", "mpp", "mpp-paid-denied" ] }, "description": "**Expected behavior:** Accepts a structurally valid push credential but returns 403 Forbidden with a Payment-Receipt failure header. The payment credential was consumed without delivering the resource.\n\n**What to watch:** Returns 403 with Payment-Receipt even after a correct credential is submitted.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/mpp/mpp-paid-denied\n```" }, "response": [], "event": [] } ] }, { "name": "Edge / CDN Controls", "description": "1 compliant and 10 quirk endpoints. Compliant tests assert a full valid challenge; quirk tests assert the specific documented deviation.", "item": [ { "name": "Correct edge cache headers (compliant)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/edge-correct-headers", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "edge-correct-headers" ] }, "description": "**Expected behavior:** The 402 challenge is no-store; the paid 200 is private, no-store with Vary: PAYMENT-SIGNATURE — and it still does a real verify and settle.\n\n**What to watch:** curl -i: the 402 carries Cache-Control: no-store; the paid 200 is private and Vary.\n\n**Status:** Compliant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/edge-correct-headers\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Cacheable 402 challenge", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/edge-cacheable-challenge", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "edge-cacheable-challenge" ] }, "description": "**Expected behavior:** Sends the 402 with Cache-Control: public, max-age, so a shared cache stores and replays a stale challenge.\n\n**What to watch:** curl -i: the 402 carries public, max-age=300; the nonce, quote, and price go stale in cache.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/edge-cacheable-challenge\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});", "", "pm.test(\"Cache-Control includes \\\"max-age\\\" (deviation)\", function () {", " const cc = pm.response.headers.get(\"cache-control\") || \"\";", " pm.expect(cc, \"Cache-Control contains 'max-age'\").to.include(\"max-age\");", "});" ] } } ] }, { "name": "Cacheable paid response (shared cache)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/edge-cacheable-paid", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "edge-cacheable-paid" ] }, "description": "**Expected behavior:** Sends the paid 200 publicly cacheable, so a shared edge serves paid content to unpaid clients on the same URL.\n\n**What to watch:** curl -i: the paid 200 carries public, max-age — a paywall bypass via the CDN.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/edge-cacheable-paid\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Missing Vary on payment", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/edge-missing-vary", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "edge-missing-vary" ] }, "description": "**Expected behavior:** Caches the paid 200 but ignores the payment header in the cache key (no Vary), so one payer's response is served to another.\n\n**What to watch:** curl -i: public, max-age with NO Vary header on the paid 200.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/edge-missing-vary\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "stale-while-revalidate leak", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/edge-swr-leak", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "edge-swr-leak" ] }, "description": "**Expected behavior:** A stale-while-revalidate directive lets the edge serve cached protected content without payment during revalidation.\n\n**What to watch:** curl -i: the paid 200 carries stale-while-revalidate — protected content is served stale and unpaid.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/edge-swr-leak\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Oversized challenge header", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/edge-oversized-header", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "edge-oversized-header" ] }, "description": "**Expected behavior:** Pads the PAYMENT-REQUIRED header beyond common proxy header-size caps, so an edge truncates, drops, or 431s it.\n\n**What to watch:** curl -i: the PAYMENT-REQUIRED header is over 12KB — a proxy may strip it before the client sees it.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/edge-oversized-header\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED is present but fails base64 decode — deviation\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header present\").to.be.a(\"string\").and.not.empty;", " let threw = false;", " try { atob(raw); } catch (_) { threw = true; }", " pm.expect(threw, \"atob() must throw on invalid base64\").to.be.true;", "});" ] } } ] }, { "name": "Conditional 304 replay", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/edge-conditional-304", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "edge-conditional-304" ] }, "description": "**Expected behavior:** The paid resource carries an ETag, and a later conditional request is answered 304 from cache without re-payment.\n\n**What to watch:** The first paid call returns an ETag; a replay with -H 'If-None-Match: \"paid-resource-v1\"' (no payment) returns 304.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/edge-conditional-304\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Rate-limited before payment", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/edge-rate-limited", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "edge-rate-limited" ] }, "description": "**Expected behavior:** Returns 429 (short Retry-After, no challenge) before the 402, so a willing payer can't tell a rate limit from a paywall.\n\n**What to watch:** curl -i (no payment): 429 with Retry-After and no PAYMENT-REQUIRED header.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/edge-rate-limited\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 429\", function () {", " pm.response.to.have.status(429);", "});", "", "pm.test(\"No PAYMENT-REQUIRED header (documented deviation)\", function () {", " const h = pm.response.headers.get(\"payment-required\");", " pm.expect(h, \"PAYMENT-REQUIRED must be absent\").to.not.exist;", "});", "// Deviation: Returns 429 Too Many Requests before any 402 challenge; no PAYMENT-REQUIRED header." ] } } ] }, { "name": "WAF blocks the payment payload", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/edge-waf-blocks-payment", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "edge-waf-blocks-payment" ] }, "description": "**Expected behavior:** The large base64 PAYMENT-SIGNATURE trips a managed WAF rule and is rejected with 403 before the payment logic runs.\n\n**What to watch:** The paid call returns 403 (WAF) instead of verifying — the payment never reaches the origin logic.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/edge-waf-blocks-payment\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Body too large (413)", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/x402/edge-body-too-large", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "edge-body-too-large" ] }, "description": "**Expected behavior:** A paid POST is rejected by a small edge body cap with 413 before reaching the payment logic.\n\n**What to watch:** The paid POST returns 413 before any verify or settle — the edge body limit fires first.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 post http://127.0.0.1:8080/api/x402/edge-body-too-large -H 'Content-Type: application/json' -d '{\"query\":\"radius\"}'\n```", "body": { "mode": "raw", "raw": "{\n \"query\": \"radius\"\n}", "options": { "raw": { "language": "json" } } } }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] }, { "name": "Edge timeout during settle", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/x402/edge-timeout-settle", "host": [ "{{baseUrl}}" ], "path": [ "api", "x402", "edge-timeout-settle" ] }, "description": "**Expected behavior:** Settlement is slow and the edge returns 504 while the charge may have completed on-chain — an ambiguous paid state.\n\n**What to watch:** The paid call returns 504 after a valid verify — the charge may still settle on-chain.\n\n**Status:** Quirk — responsible party if it misbehaves: Merchant\n**Price:** 0.0001 SBC (100 atomic units)\n\nImporting this request demonstrates the endpoint and surfaces the 402 challenge. To actually pay and receive the 200 resource, run it with radius-cli (the only client that can sign an x402 payment):\n\n```\nradius-cli --network testnet wallet x402 get http://127.0.0.1:8080/api/x402/edge-timeout-settle\n```" }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 402\", function () {", " pm.response.to.have.status(402);", "});", "", "pm.test(\"PAYMENT-REQUIRED header is present\", function () {", " pm.response.to.have.header(\"payment-required\");", "});", "", "pm.test(\"Challenge decodes and has expected shape\", function () {", " const raw = pm.response.headers.get(\"payment-required\");", " pm.expect(raw, \"header value is a non-empty string\").to.be.a(\"string\").and.not.empty;", " let challenge;", " try { challenge = JSON.parse(atob(raw)); } catch (err) { pm.expect.fail(\"base64-decode + JSON.parse failed: \" + err); }", " pm.expect(challenge, \"decoded challenge is an object\").to.be.an(\"object\");", " pm.expect(challenge.x402Version, \"x402Version present\").to.exist;", " pm.expect(challenge.accepts, \"accepts is a non-empty array\").to.be.an(\"array\").that.is.not.empty;", " const req = challenge.accepts[0];", " [\"scheme\",\"network\",\"amount\",\"asset\",\"payTo\"].forEach(function (f) {", " pm.expect(req[f], \"requirement.\" + f + \" present\").to.exist;", " });", "});" ] } } ] } ] } ] }