{"demo":true,"note":"Free fixed-input sample of real output. The paid route accepts your own input: /api/x402-check/deep ($0.03 per call via x402: USDC on Base, USDC on Solana, RLUSD on the XRP Ledger or USDC on Polygon; no signup or API key).","paid_endpoint":"https://horizonpulse.dev/api/x402-check/deep","price":"$0.03","fixed_input":"url=https://horizonpulse.dev/api/pulse (fixed; sample reused for 10 min)","sample_status":200,"sample":{"source":"x402-check-deep","priced":{"amountUsd":"$0.03","amountAtomic":"30000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","network":"base","payTo":"0x5b32c973596078a967562ca652761404f19be0e9"},"asOf":"2026-10-19T21:20:59.812Z","ok":true,"target":"https://horizonpulse.dev/api/pulse","finalUrl":"https://horizonpulse.dev/api/pulse","method":"GET","httpStatus":402,"isX402":true,"x402Version":2,"challengeSource":"header","resource":{"url":"https://horizonpulse.dev/api/pulse","description":"Crypto price API: BTC, ETH and SOL spot prices in USD in one GET, no parameters. Returns JSON: assets.BTC/ETH/SOL with priceUsd, change24hPct and momentum (bullish/bearish/neutral), plus overall momentum, sentiment (risk-on/risk-off/neutral), direction (up/down/flat), avgChange24hPct and asOf. Prices from Coinbase Exchange with CoinGecko fallback (source field). Labels are fixed rules on 24h change, not advice. Errors are not charged.","mimeType":"application/json"},"accepts":[{"scheme":"exact","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","assetLabel":"USDC (Base)","amountAtomic":"2000","amountUsd":"$0.002","payTo":"0x5b32c973596078a967562ca652761404f19be0e9","payToType":"eoa_7702","payToDelegate":"0x7702cb554e6bfb442cb743a7df23154544a7176c","maxTimeoutSeconds":300},{"scheme":"exact","network":"solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp","asset":"EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v","assetLabel":"USDC (Solana)","amountAtomic":"2000","amountUsd":"$0.002","payTo":"BjY98A6dS3GGLZdz2zHy8wK7XAwnQgNhCc66mfmBTRPz","payToType":null,"payToDelegate":null,"maxTimeoutSeconds":300},{"scheme":"exact","network":"xrpl:0","asset":"524C555344000000000000000000000000000000","assetLabel":"RLUSD (XRP Ledger)","amountAtomic":"0.002","amountUsd":"$0.002","payTo":"r3FbirL83RAB2CwnUdxE5pCohMkuo6LQcf","payToType":null,"payToDelegate":null,"maxTimeoutSeconds":300},{"scheme":"exact","network":"eip155:137","asset":"0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359","assetLabel":"USDC (Polygon)","amountAtomic":"2000","amountUsd":"$0.002","payTo":"0x5b32c973596078a967562ca652761404f19be0e9","payToType":null,"payToDelegate":null,"maxTimeoutSeconds":300}],"discovery":{"present":true,"method":"GET","hasInputSchema":true,"hasOutputExample":true},"tier":"deep","baseChecks":[{"id":"status_402","level":"pass","message":"Unpaid request returned HTTP 402."},{"id":"challenge","level":"pass","message":"x402 challenge parsed from PAYMENT-REQUIRED header."},{"id":"version","level":"pass","message":"x402 v2."},{"id":"payto_type","level":"info","message":"payTo 0x5b32c973596078a967562ca652761404f19be0e9 is an EOA with an EIP-7702 delegation to 0x7702cb554e6bfb442cb743a7df23154544a7176c: the account's private key still controls funds, and the delegate contract's code also runs for this account (e.g. a smart-wallet upgrade) (accepts[0])."},{"id":"discovery","level":"pass","message":"Discovery metadata present (method GET)."}],"tls":{"ok":true,"protocol":"TLSv1.3","authorized":true,"authorizationError":null,"validFrom":"Sep 19 17:49:24 2026 GMT","validTo":"Dec 18 17:49:23 2026 GMT","daysLeft":59,"issuer":"Let's Encrypt / YR2","subject":"horizonpulse.dev","san":["horizonpulse.dev"],"checked":true},"securityHeaders":{"status":402,"hsts":"max-age=63072000","contentTypeOptions":"nosniff","frameOptions":null,"csp":null,"referrerPolicy":null,"error":null},"cors":{"allowOrigin":null,"exposeHeaders":null,"allowCredentials":null,"paymentRequiredExposed":false},"publishedSources":[{"name":"well-known","url":"https://horizonpulse.dev/.well-known/x402","status":200,"addresses":[],"error":null},{"name":"openapi","url":"https://horizonpulse.dev/openapi.json","status":200,"addresses":["0x5b32c973596078a967562ca652761404f19be0e9","BjY98A6dS3GGLZdz2zHy8wK7XAwnQgNhCc66mfmBTRPz","r3FbirL83RAB2CwnUdxE5pCohMkuo6LQcf"],"error":null},{"name":"llms","url":"https://horizonpulse.dev/llms.txt","status":200,"addresses":["0x5b32c973596078a967562ca652761404f19be0e9"],"error":null}],"payToReports":[{"network":"eip155:8453","payTo":"0x5b32c973596078a967562ca652761404f19be0e9","payToType":"eoa_7702","published":"match","publishedIn":["openapi","llms","well-known"],"lookalikes":[]},{"network":"solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp","payTo":"BjY98A6dS3GGLZdz2zHy8wK7XAwnQgNhCc66mfmBTRPz","payToType":null,"published":"match","publishedIn":["openapi","well-known","llms"],"lookalikes":[]},{"network":"xrpl:0","payTo":"r3FbirL83RAB2CwnUdxE5pCohMkuo6LQcf","payToType":null,"published":"match","publishedIn":["openapi","well-known","llms"],"lookalikes":[]}],"drift":{"wellKnown":"listed","openapi":{"status":"consistent","detail":null},"bazaar":{"status":"consistent","networks":["base","solana","xrpl","polygon"],"detail":null}},"checks":[{"id":"tls","level":"pass","message":"TLS TLSv1.3 trusted, 59 days to expiry."},{"id":"hsts","level":"pass","message":"HSTS present (max-age >= 180 days)."},{"id":"nosniff","level":"pass","message":"X-Content-Type-Options: nosniff."},{"id":"frame_policy","level":"info","message":"No frame policy (X-Frame-Options or CSP frame-ancestors); low impact for a JSON API."},{"id":"referrer_policy","level":"info","message":"No Referrer-Policy header."},{"id":"cors","level":"info","message":"No Access-Control-Allow-Origin on the unpaid response (passive read, no Origin sent): browser-based agents on other origins cannot read the challenge; server-side agents are unaffected."},{"id":"payto_published","level":"pass","message":"payTo 0x5b32c973596078a967562ca652761404f19be0e9 (EIP-7702-delegated EOA) matches the address the payee publishes in openapi, llms, well-known."},{"id":"payto_published","level":"pass","message":"payTo BjY98A6dS3GGLZdz2zHy8wK7XAwnQgNhCc66mfmBTRPz matches the address the payee publishes in openapi, well-known, llms."},{"id":"payto_published","level":"pass","message":"payTo r3FbirL83RAB2CwnUdxE5pCohMkuo6LQcf matches the address the payee publishes in openapi, well-known, llms."},{"id":"drift_well_known","level":"pass","message":"URL is listed in the origin's /.well-known/x402."},{"id":"drift_openapi","level":"pass","message":"openapi.json operation is consistent with the live 402."},{"id":"drift_bazaar","level":"pass","message":"CDP Bazaar entry matches the live 402 (base, solana, xrpl, polygon)."}],"summary":{"pass":13,"warn":0,"fail":0},"elapsedMs":544,"methodology":{"base":"Includes the full /api/x402-check report (same code, same single unpaid probe).","tls":"One TLS handshake to the target host on 443 through the SSRF-guarded connect (https targets only): protocol, whether the chain is trusted, days to expiry.","headers":"One unpaid GET of the final URL, no redirects followed: Strict-Transport-Security, X-Content-Type-Options, frame policy (X-Frame-Options or CSP frame-ancestors), Content-Security-Policy, Referrer-Policy.","cors":"Read passively from that same response (no forged Origin, no preflight). A browser agent can read a v2 challenge cross-origin only if Access-Control-Allow-Origin allows it and PAYMENT-REQUIRED is in Access-Control-Expose-Headers.","published":"Unpaid GETs of the target origin's /.well-known/x402, /openapi.json and /llms.txt (6s, 200KB, 3 redirects each, SSRF-checked every hop). Addresses: payTo values in JSON, plus 0x addresses in llms.txt (known USDC contracts and the 402's own asset contracts excluded). A payTo also counts as published when it appears verbatim in any of the three. Comparison is per address family (EVM vs other rails): a Solana or XRPL payTo is only reported as unpublished when the listings publish other addresses of that family.","lookalike":"Each 402 payTo vs every other address the payee advertises. A different address with >=3 matching characters at both ends, or >=6 matching in total (prefix + suffix, EVM case-insensitive without 0x, XRPL without the leading r), is flagged as the address-poisoning lookalike pattern (same rule as /api/tx-guard).","drift":"Live 402 accepts (network, payTo, amount) vs the /.well-known/x402 listing for this URL, the openapi operation for this path (payTo per address family, stated USD price), and the Coinbase CDP Bazaar entry for this URL (public discovery API, /merchant by payTo).","limits":"Never pays or signs. SSRF-safe at every hop (private, loopback, link-local and cloud-metadata addresses blocked). Hosts on the web-checks opt-out list are never contacted (main probe, every redirect hop, TLS and listing fetches). 20s overall budget for the extra checks; a check that cannot finish is reported as unavailable.","billing":"Billed exactly like /api/x402-check: any HTTP answer from the target is a completed report. Bad input, blocked host, DNS/connection failure, timeout or too many redirects on the main probe return 400/502/504 and are not charged. Extra checks that fail are reported as unavailable inside a billed report.","notAdvice":"Describes what the endpoint and its listings serve right now. A pass is not a guarantee that paying is safe; a published-address match only shows consistency with the payee's own listings. If the payee's site or listings are compromised, they can all show the same wrong address; confirm the payee address through a separate channel before large payments."}}}