{"slug":"api-zfinia-com-x402-v1-x402-resource-binding-audit-e03c45","title":"Check that every challenge you captured names the endpoint that served it","host":"api.zfinia.com","method":"POST","resource":"https://api.zfinia.com/x402/v1/x402-resource-binding-audit","category":"code","description":"Check that every challenge you captured names the endpoint that served it. A challenge naming a different resource would, if paid, satisfy a requirement for something else. A host mismatch is reported differently from a path mismatch, the first being the stronger signal. Also reports a non-https res","price_listed":0.12,"price_asked":null,"state":"no_terms","state_label":"Answers HTTP 429 without x402 payment terms","checks_7d":1,"answered_7d":0,"latency_ms_median":null,"reported_calls_30d":1,"reported_payers_30d":1,"networks":["eip155:8453"],"badge":"unverified","paid_checks_7d":0,"paid_ok_7d":0,"example_input":{"body":{"expected_host":"api.merchant.test","observations":[{"challenge":{"accepts":[{"amount":"5000","asset":"0x833589fcd6edb6e08f4c7c32d4f71b54bda02913","network":"eip155:8453","payTo":"0xa1b2c30000000000000000000000000000009f8e","scheme":"exact"}],"extensions":{"bazaar":{"schema":{"properties":{"input":{"type":"object"},"output":{"type":"object"}}}}},"resource":{"description":"Paid resource at https://api.merchant.test/v1/score","mimeType":"application/json","url":"https://api.merchant.test/v1/score"},"x402Version":2},"url":"https://api.merchant.test/v1/score"},{"challenge":{"accepts":[{"amount":"5000","asset":"0x833589fcd6edb6e08f4c7c32d4f71b54bda02913","network":"eip155:8453","payTo":"0xa1b2c30000000000000000000000000000009f8e","scheme":"exact"}],"extensions":{"bazaar":{"schema":{"properties":{"input":{"type":"object"},"output":{"type":"object"}}}}},"resource":{"description":"Paid resource at https://api.merchant.test/v1/score","mimeType":"application/json","url":"https://api.merchant.test/v1/score"},"x402Version":2},"url":"https://api.merchant.test/v1/enrich"},{"challenge":{"accepts":[{"amount":"5000","asset":"0x833589fcd6edb6e08f4c7c32d4f71b54bda02913","network":"eip155:8453","payTo":"0xffffffffffffffffffffffffffffffffffffffff","scheme":"exact"}],"resource":"http://collector.elsewhere.test/v1/hijacked","x402Version":2},"url":"https://api.merchant.test/v1/hijacked"}]},"bodyType":"json","method":"POST","type":"http"},"output_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"input":{"additionalProperties":false,"properties":{"body":{"additionalProperties":false,"properties":{"expected_host":{"maxLength":256,"type":"string"},"observations":{"items":{"additionalProperties":false,"properties":{"challenge":{},"url":{"maxLength":2048,"type":"string"}},"required":["url","challenge"],"type":"object"},"maxItems":200,"minItems":1,"type":"array"},"require_https":{"type":"boolean"}},"required":["observations"],"type":"object"},"bodyType":{"enum":["json","form-data","text"],"type":"string"},"method":{"enum":["POST"],"type":"string"},"type":{"const":"http","type":"string"}},"required":["type","method","bodyType","body"],"type":"object"},"output":{"properties":{"example":{"type":"object"},"type":{"type":"string"}},"required":["type"],"type":"object"}},"required":["input"],"type":"object"},"history":[{"day":"2026-10-04","reachable":true,"status":429,"valid_402":false,"asked_usdc":null,"price_match":null,"latency_ms":253,"error":null}],"description_full":"Check that every challenge you captured names the endpoint that served it. A challenge naming a different resource would, if paid, satisfy a requirement for something else. A host mismatch is reported differently from a path mismatch, the first being the stronger signal. Also reports a non-https resource and, under version 2, a bare string resource, where a client reading resource.url gets undefined and stops checking the binding. Nothing is fetched and nothing is paid.","last_updated":"2026-10-04T08:07:11.446Z","schemes":["exact"]}