Pay-per-call API utilities

Micro utilities for AI agents and apps, priced per call and paid in USDC over the x402 protocol. No signup, no API keys — call an endpoint, get a 402, pay, and get your result.

Endpoints

MethodPathPriceWhat it does
POST /v1/echo $0.001 Echoes back the JSON body you send, with a server timestamp. Useful for verifying your x402 client integration end to end.
{"msg":"hello farm"}
POST /v1/pdf $0.010 Render HTML or a public web page into a pixel-perfect PDF using a headless Chrome browser. Send inline `html` (invoices, receipts, reports, tickets) or a `url` to snapshot; control paper size, orientation, margins, background graphics and scale. Returns the raw application/pdf bytes — no signup, no browser to run, pay per document.
{"html":"<html><body><h1>Invoice #1042</h1><table><tr><td>Item</td><td>$20.00</td></tr></table></body></html>","format":"A4","printBackground":true}
POST /v1/screenshot $0.008 Capture a screenshot of any public web page with a headless Chrome browser. Set the viewport, grab the full scrollable page or just the fold, and choose PNG, JPEG or WebP with an optional quality. Returns the raw image bytes — ideal for link previews, thumbnails, visual monitoring and archiving. No browser to run, pay per capture.
{"url":"https://example.com","fullPage":true,"format":"png"}
POST /v1/og-image $0.003 Generate a polished Open Graph / social share image (PNG) from text — no browser, no design tools. Pick a template (article, product, stat), pass a title and optional subtitle, set your brand accent colour and light/dark theme, and get back a crisp 1200×630 PNG ready for og:image, Twitter cards, blog headers and launch posts. Rendered with Satori + resvg; fast and cheap.
{"template":"article","title":"Announcing the Monetization Gateway","subtitle":"Charge for any resource behind Cloudflare via x402","accent":"#2FBF71","theme":"dark"}
GET /v1/vat-check $0.002 Validate an EU VAT number against the official VIES registry before invoicing, onboarding or a reverse charge. Per-country syntax is checked locally first, so invalid formats never touch the network. Valid numbers return the registered company name and address when disclosed, plus an optional consultation number (requesterVat). Never a false 'invalid': if VIES is down you get a 503 and are not charged. ?attest=1 → Ed25519-signed.
{"vat":"IE6388047V"}
GET /v1/vat-rates $0.001 Look up current VAT rates for any EU member state — standard, reduced, super-reduced and parking rates plus the currency — from the European Commission's official figures. Filter to one rate category if you only need one. Ideal for pricing, invoicing and tax-calculation logic that must apply the right rate per country. Returns the source and date verified. ?attest=1 → Ed25519-signed.
{"country":"FR"}
GET /v1/iban-check $0.001 Validate an IBAN structurally before you pay or store it: ISO 7064 mod-97 check digits plus the official per-country length and BBAN layout (~90 countries), returning the bank/branch/account breakdown for FR, DE, ES, IT, BE and NL. Structural validation only — no BIC directory lookup (SWIFT's BIC registry is proprietary) and no proof the account exists. Local, instant. ?attest=1 → Ed25519-signed.
{"iban":"FR76 3000 6000 0112 3456 7890 189"}
POST /v1/qr $0.002 Generate a QR code as PNG or SVG from any text or URL. Pick the size, error-correction level (L/M/Q/H) and foreground/background colours; a 4-module quiet zone is always included so it scans reliably. Returns the raw image bytes. No logo overlay (compositing is out of scope).
{"data":"https://402utils.com","size":512,"ecLevel":"M"}
POST /v1/ics $0.002 Build a strictly RFC 5545-conformant .ics calendar file from a list of events: correct TEXT escaping, 75-octet line folding, generated UIDs, and unambiguous UTC timestamps (a per-event IANA timezone interprets naive wall-clock times). Supports all-day events, location, description and a passthrough RRULE. The fiddly conformance an agent shouldn't hand-roll.
{"calendarName":"Launch","events":[{"title":"402utils launch","start":"2026-07-10T14:00:00","end":"2026-07-10T15:00:00","timezone":"Europe/Paris","location":"Online"}]}
GET /v1/email-check $0.003 Validate an email address before you accept a signup or send to it: RFC 5322 syntax, whether the domain resolves and its MX records, whether it is a disposable/throwaway domain (community blocklist), and whether it is a role account (info@, support@…). DNS is checked over DoH. No SMTP probing (intrusive and spammy), so a true 'domainExists' does not guarantee the mailbox exists.
{"email":"user@example.com"}
GET /v1/rss-to-json $0.002 Fetch an RSS 2.0 or Atom feed and return clean JSON: feed title, link and description, plus items with title, link, ISO-8601 publishedAt, summary and author. Handles both formats and normalises the dates. The caller-supplied URL is SSRF-checked; the fetch is capped at 2 MB and 8 s.
{"url":"https://blog.cloudflare.com/rss/","limit":10}
POST /v1/pdf-extract $0.005 Extract text from a PDF: send the PDF bytes directly, or a JSON body with a public {url}. Returns the full text, per-page text, and metadata (page count, title, author). Text layer only — scanned/image-only PDFs return empty text with a no_text_layer warning (no OCR). Max 10 MB.
{"url":"https://example.com/document.pdf"}
POST /v1/image-optimize $0.004 Resize and convert an image (PNG, JPEG or WebP, up to 10 MB). Send the image bytes as the body and set options in the query: width, height, fit (contain or cover), format (webp/jpeg/png) and quality (JPEG). Returns the converted image bytes. WebP has no quality knob and AVIF is not supported (out of scope).
{"width":800,"format":"webp"}
POST /v1/csv-to-json $0.002 Convert CSV to JSON with a strict RFC 4180 parser: quoted fields, doubled quotes, delimiters and line breaks inside quotes, mixed CRLF/LF, BOM. Auto-detects comma, semicolon, tab or pipe (or set delimiter). First row becomes object keys; headers:false yields string arrays. Ragged rows and unterminated quotes are repaired and reported in errors[], never a crash. All values stay strings. Send raw CSV text or JSON {csv}. Max 5 MB.
{"csv":"name;city;signup\n\"Dupont, Jean\";Paris;2026-05-01\n\"Müller, Anna\";Berlin;2026-06-12","headers":true}
POST /v1/json-to-csv $0.002 Convert a JSON array of objects into a clean RFC 4180 CSV: header row, CRLF records, correct quoting and quote-doubling. Nested objects flatten to dot-notation columns (a.b.c), arrays are JSON-encoded into their cell, and you can select and order columns explicitly. Delimiter: comma, semicolon, tab or pipe. Caps: 100,000 rows, 5 MB body, 20 MB CSV out. Returns text/csv ready for Excel, Google Sheets or a data pipeline.
{"rows":[{"name":"Jeanne d'Arc","city":"Orléans","stats":{"score":9.5,"active":true}},{"name":"José","tags":["vip","beta"]}],"delimiter":","}
POST /v1/xml-to-json $0.002 Convert XML to clean JSON. POST raw XML (XML or text/plain Content-Type) or a JSON envelope {xml, alwaysArray}. Attributes land under "@_" keys, mixed-content text under "#text", repeated siblings become arrays, and alwaysArray forces arrays for listed tags even on a single occurrence. Numeric character references decode. DTD entities and DOCTYPE internal subsets rejected (anti-XXE / billion-laughs). Max 5 MB.
{"xml":"<order id=\"A-17\"><item sku=\"X1\">Café grinder</item><item sku=\"X2\">Filter</item></order>","alwaysArray":["item"]}
POST /v1/yaml $0.001 Convert between YAML and JSON in one call. to:"json" parses a YAML document (config files, docker-compose, Kubernetes manifests, CI pipelines) into a plain JSON value; to:"yaml" renders any JSON value as clean block-style YAML. Hardened: safe core schema (tags like !!js/function never execute), alias bombs rejected, one document per call, parse errors return line/column. YAML input up to 2 MB UTF-8.
{"to":"json","input":"services:\n web:\n image: nginx:1.29\n ports:\n - \"80:80\"\n"}
POST /v1/md-to-html $0.002 Convert Markdown to sanitized HTML that is safe to embed directly in a page, email or app. GFM supported: tables, task lists, strikethrough, fenced code. Output passes a strict tag/attribute allowlist: scripts, styles, iframes, event handlers and javascript: URLs are removed; links keep only http(s)/mailto targets, images only http(s) or base64 image data URIs. Send JSON {markdown} or a raw text/markdown body, max 2 MB. Returns {html}.
{"markdown":"# Release notes\n\n- [x] Ship the *v2* API\n- [ ] Update docs\n\n| Feature | Status |\n|:--------|-------:|\n| Auth | done |\n\n~~Old plan~~ — see [the docs](https://example.com/docs)."}
POST /v1/html-to-md $0.003 Convert raw HTML into clean GitHub-Flavored Markdown: ATX headings, fenced code, pipe tables, strikethrough, task lists; script/style/iframe text is always stripped. mode=article isolates the main article with Mozilla Readability (returns title, byline, excerpt; drops nav/footer boilerplate; resolves relative links), else converts the whole document. Converts provided HTML only — never fetches URLs. Max 5 MB.
{"html":"<h1>Q3 results</h1><p>Revenue grew <strong>18%</strong>.</p><table><thead><tr><th>Region</th><th>Growth</th></tr></thead><tbody><tr><td>EMEA</td><td>+21%</td></tr></tbody></table>","mode":"full"}
POST /v1/html-tables $0.002 Extract every table from HTML you provide into clean JSON — no fetching, send the markup itself as {html} or a raw text/html body. Returns per table: optional caption, headers[] (from thead or an all-th first row) and rectangular rows[][]. colspan/rowspan cells are grid-expanded with the value duplicated so rows align with the visual layout; nested tables are flattened into the outer cell's text. Caps: 5 MB HTML, 200 tables, 200k cells.
{"html":"<table><caption>Q2 revenue</caption><thead><tr><th>Product</th><th>Revenue</th></tr></thead><tbody><tr><td>Café filtre</td><td>€12,400</td></tr></tbody></table>"}
POST /v1/diff $0.002 Compute the diff between two texts (a → b) — no git needed. Returns a standard unified patch (line-oriented in both modes, applies with git apply or patch), added/removed counts, and in word mode a token-level change list for inline highlighting (capped at 2000 entries). CRLF line endings and missing trailing newlines are preserved byte-exactly. Caps: 1 MB UTF-8 per input; pathologically divergent inputs return 422 diff_too_complex.
{"a":"name: farm\nprice: 1 USDC\n","b":"name: farm\nprice: 2 USDC\n"}
GET /v1/timezone-convert $0.001 Convert a datetime between any two IANA time zones using the runtime's ICU tzdb — always current, DST-correct, half-hour zones included. A datetime without offset is read as wall time in `from` (ambiguous fall-back times resolve to the earlier instant; times skipped by spring-forward shift ahead, flagged in `note`). Returns both ISO datetimes with offsets and DST status per side. Unknown zone → 400 with a spelling suggestion.
{"datetime":"2026-07-14T09:30:00","from":"Europe/Paris","to":"Asia/Ho_Chi_Minh"}
GET /v1/cron-next $0.002 Next occurrences of a cron expression in any IANA time zone, DST-aware via the runtime's ICU tzdb (times skipped by DST shift forward by the gap; ambiguous times fire once). Dialect (croner): 5-7 fields with optional seconds and year, ranges, steps, lists, JAN-DEC/SUN-SAT names, L, W, #, ? and @daily-style aliases. Each occurrence is returned as local ISO with offset plus UTC. Bad expression → 400 naming the offending field.
{"expr":"*/15 9-17 * * 1-5","tz":"Europe/Paris","count":5}
GET /v1/holidays $0.002 Public and bank holidays for FR, DE, GB, US, ES, IT, NL, BE — years 2025-2027, each dataset verified against the country's official source (Etalab, Land statutes, gov.uk feed, OPM, BOE, normattiva, rijksoverheid, SPF Emploi). Movable feasts are computed (Gregorian computus), substitute days follow each country's official rule. Optional ?region= for sub-national holidays (German Länder, UK divisions, Alsace-Moselle).
{"country":"FR","year":2026}
GET /v1/business-days $0.002 Business-day math with real holiday calendars for FR, DE, GB, US, ES, IT, NL, BE (2025-2027, official sources — same datasets as /v1/holidays). Count working/weekend/holiday days in a date range (?from&to&country) or shift a date by N business days (?from&add=10&country). Weekend configurable (?weekend=fri,sat), optional ?region= for Länder/UK divisions. Holidays that suppress a working day are listed by name.
{"country":"FR","from":"2026-07-01","to":"2026-07-31"}
GET /v1/country-info $0.001 Country reference card by ISO code (alpha-2/alpha-3/numeric) or English name: ISO 3166 codes, official name, current ISO 4217 currency (Bulgaria = EUR since 2026-01-01), dialling prefix, IANA ccTLDs (incl. IDN), languages, EU/EEA/Schengen/euro-area membership and the EU VAT prefix (Greece = EL). 56 countries: EU-27, EEA/EFTA, GB, US + 24 majors. Compiled from ISO/IANA/ITU/europa.eu sources, dated `asOf`.
{"country":"FR"}
GET /v1/phone-check $0.002 Validate and normalize a phone number with full Google libphonenumber metadata: strict validity against each national numbering plan, E.164 / international / national formats, country detection (correct across shared codes like +1 and +44) and line type (mobile, fixed_line, toll_free, voip…) where the plan distinguishes it. Pass ?country=FR to parse national formats. Local. ?attest=1 → Ed25519-signed.
{"phone":"+442079460958"}
POST /v1/card-check $0.001 Structural card-number check before hitting a PSP: Luhn checksum, network detection from public IIN prefixes (visa, mastercard, amex, discover, jcb, diners, unionpay) and per-network length validation. POST body on purpose: the number never appears in a URL, so it stays out of request logs and x402 payment metadata — never stored, logged or echoed back. No BIN/issuer lookup (BIN databases are licensed): well-formed does not mean the card exists.
{"number":"4242 4242 4242 4242"}
GET /v1/rf-reference $0.001 ISO 11649 RF creditor reference (SEPA structured reference) — validate or generate. ?ref=RF18539007547034 checks the ISO 7064 mod 97-10 checksum and format (RF + 2 check digits + up to 21 alphanumerics); ?generate=539007547034 computes the check digits and returns the full RF reference with print formatting. Complements iban-check and vat-check for SEPA invoicing agents. Local, instant. ?attest=1 → Ed25519-signed.
{"ref":"RF18 5390 0754 7034"}
GET /v1/meta-extract $0.003 Link preview for any web page: fetches a URL and parses only the <head> (no JS, no rendering). Returns title, meta description, canonical URL, language, an always-absolute favicon, all Open Graph and Twitter Card tags, and RSS/Atom/JSON-feed links. Tolerant of messy real-world HTML and non-UTF-8 charsets. The caller-supplied URL is SSRF-checked; the fetch is capped at 5 MB and 8 s.
{"url":"https://blog.cloudflare.com/"}
GET /v1/link-check $0.002 Verify a link before you cite or use it: HTTP status, the full redirect chain, the final URL, latency, and the final Content-Type/Content-Length. Redirects are followed manually (max 10) with SSRF validation on every hop; probes with HEAD by default and falls back to GET automatically when a server rejects HEAD. A dead or broken target (404, 410, 500…) is a valid result, not an error. Response bodies are never downloaded.
{"url":"https://example.com/pricing","method":"HEAD"}
GET /v1/dns-lookup $0.001 Resolve DNS records for a domain over DNS-over-HTTPS: A, AAAA, MX, TXT, NS and CNAME, one or several types per call (type=A,MX). Records come back normalised — MX priority split out, trailing dots stripped, TXT quoting removed — each with its TTL. Cloudflare DoH with automatic Google DoH fallback for resilience; NXDOMAIN is reported explicitly instead of as an error.
{"domain":"example.com","type":"A,MX"}
GET /v1/robots-check $0.001 Robots.txt compliance check for polite crawlers and AI agents (GPTBot, ClaudeBot, ...). Pass a page URL and optionally your crawler's product token; returns whether the URL may be fetched, the winning Allow/Disallow rule, crawl-delay and sitemap URLs. Full RFC 9309 matching: wildcards, $ anchors, longest-match, merged groups. A 4xx robots.txt allows all; 5xx or unreachable hosts report disallowed. Cached per host for 1 hour.
{"url":"https://example.com/search?q=demo","userAgent":"GPTBot"}
GET /v1/sitemap-to-json $0.003 Turn any sitemap.xml into clean JSON: URL entries with loc, lastmod and priority, plus sitemap-index detection with the child sitemap list. Handles gzipped .gz sitemaps (magic-byte detection, zip-bomb guarded) and namespaced XML; pass follow=1 to also expand up to 3 child sitemaps of an index in one call. SSRF-checked fetches, 10 MB per document, up to 50,000 URLs with a truncated flag.
{"url":"https://example.com/sitemap.xml","follow":"1"}
GET /v1/domain-check $0.002 Domain availability and expiry intelligence via RDAP, the WHOIS successor. Queries the authoritative registry for any RDAP-enabled TLD: free domains return registered:false, taken ones return registrar, creation and expiry dates, nameservers and EPP status codes. TLDs without RDAP coverage return supported:false. Built for agents that buy, monitor or vet domains.
{"domain":"example.com"}
GET /v1/x402-probe $0.002 Quote an x402-paid API before you buy: probes a third-party endpoint with one unpaid GET (no payment is ever sent) and decodes its payment requirements — x402 v2 base64 PAYMENT-REQUIRED header or v1 JSON body. Returns normalised prices (atomic amount, asset, network, payTo), description, resource URL and Bazaar discovery metadata. Non-402 targets return {isX402:false, status}. SSRF-checked, 1 redirect max, 8 s timeout.
{"url":"https://402utils.com/v1/rss-to-json"}
GET /v1/fx-rates $0.001 Daily euro FX reference rates from the European Central Bank. ?base (default EUR), ?quote for a single rate, ?date=YYYY-MM-DD for history (last 90 ECB business days; older dates 404). Non-EUR bases are cross-rates derived via EUR (quote-per-EUR ÷ base-per-EUR). Weekend/holiday dates resolve to the last published ECB day — the date field says which. Published ~16:00 CET on ECB business days; informational rates, not for transaction pricing.
{"base":"EUR","quote":"USD"}
GET /v1/routing-check $0.001 Validate a US ABA routing number before initiating a transfer: the 3-7-1 checksum, the public structure rules (9 digits; assigned prefixes 00-12 primary, 21-32 thrift, 61-72 electronic, 80 traveler's cheque) and the implied Federal Reserve district. Checksum and structure only — no bank-name directory (the Fed's is redistribution-restricted) and no proof of assignment. ?attest=1 → Ed25519-signed.
{"routing":"021000021"}
GET /v1/us-tax-rates $0.002 US sales tax STATE-LEVEL base rates for the 50 states + DC, as statutory percent. ?state=CA for one state, omit for all. Returns the state-only rate, any mandatory statewide local add-on (CA/UT/VA) and their sum. STATE BASE RATE ONLY — optional city/county/district rates are EXCLUDED and can add several points; not tax advice. Compiled from state statutes, cross-checked against two dated published trackers (asOf field included).
{"state":"CA"}
POST /v1/xlsx-extract $0.005 Extract data from an .xlsx spreadsheet: send the bytes directly or a JSON body with a public {url}. Returns each sheet as rows (array-of-arrays) with its name and used range, plus workbook metadata. Query: sheet (name or 0-based index) for a single sheet, headers=true for array-of-objects. Formula cells return their cached computed value. Capped at 500000 cells. Max 10 MB.
{"url":"https://example.com/report.xlsx"}
POST /v1/docx-extract $0.005 Extract text from a .docx (Word) document: send the docx bytes directly, or a JSON body with a public {url}. Returns the plain text, a best-effort markdown rendering (headings, bold/italic and lists; tables are flattened to paragraphs), and metadata (title, author). Text layer only — no OCR of embedded images. Max 10 MB.
{"url":"https://example.com/contract.docx"}
POST /v1/zip-inspect $0.003 Inspect a ZIP archive safely: send the bytes directly or a JSON body with a public {url}. Returns the entry list (path, size, compressedSize, isDir); entries with path traversal (../), absolute or malformed paths are flagged suspicious:true and never interpreted. Add ?extract=exact/entry/path to get that one file back (max 5 MB decompressed). Zip bombs are refused. Max 20 MB.
{"url":"https://example.com/archive.zip"}
POST /v1/csv-profile $0.003 Profile a CSV before processing it: send the bytes directly or a JSON body with a public {url}. Returns per-column name, inferred type (string/int/float/bool/date/mixed), null and unique counts, min/max and samples, plus row count, detected delimiter and data-quality issues (malformed rows, inconsistent widths, duplicate headers). Query: delimiter (, ; tab |), header=false if row one is data. Max 10 MB.
{"url":"https://example.com/data.csv"}
GET /v1/wallet-name $0.002 Resolve a Basename or ENS name to an address, or an address to its primary name. Pass ?name=402utils.base.eth (name→address) or ?address=0x… (address→primary name). Basenames resolve on Base L2, other .eth names on Ethereum mainnet. Reverse results are forward-verified. ASCII names only; offchain (CCIP-read) resolvers like cb.id are not supported.
{"name":"vitalik.eth"}
GET /v1/donate you choose · $0.001–$0.05 Support 402utils — or use it as a parametric x402 payment-test endpoint: you set the price with ?amount= (USD, clamped to $0.001–$0.05) and the 402 demands exactly that, so you can assert a client pays the precise amount and the on-chain USDC tx matches. After payment returns {thanks, amount, message}. The amount is a pure function of ?amount, identical on the unpaid probe and the paid retry.
{"amount":"0.013"}
GET /v1/x402-lint $0.003 Lint an x402 endpoint before agents find it broken. Probes a third-party 402 (unpaid, SSRF-checked) and audits it: description ≥450 chars (CDP silently rejects at settle → 402 {} with no charge), missing Bazaar discovery or input/output schemas, resource.url host mismatch or *.workers.dev identity, x402Version 1 (frozen), non-CAIP-2 network, unparseable amount, unknown asset, odd maxTimeoutSeconds. Returns pass/warn/fail/info checks + summary.
{"url":"https://402utils.com/v1/rss-to-json"}
POST /v1/supplier-check $0.006 Vet a supplier in one paid call: give any of a VAT number, IBAN, domain and LEI and get VAT validity (VIES) + company name, IBAN structure (mod-97 + BBAN), domain status (RDAP), the GLEIF LEI record (legal name, status, parent) and the country — run in parallel, each with a per-field status. summary.allProvidedValid is true only if every provided check confirmed. All checks failing technically → 503, no charge. ?attest=1 → Ed25519-signed.
{"vat":"IE6388047V","iban":"IE29AIBK93115212345678","domain":"google.com"}
POST /v1/invoice-ready $0.004 Pre-flight a SEPA invoice's identifiers in one paid call: validate the customer VAT (VIES, with company name), the IBAN (ISO 7064 mod-97 + BBAN layout) and an ISO 11649 RF creditor reference, run together with a per-field status. summary.allProvidedValid is true only if every provided identifier checked out. If all provided checks fail technically you get a 503 and no charge. ?attest=1 → Ed25519-signed.
{"vat":"IE6388047V","iban":"IE29AIBK93115212345678","rfReference":"RF18539007547034"}
GET /v1/site-profile $0.007 Full profile of a web page in one paid call: <head> metadata (title, description, OpenGraph, favicon, feeds), DNS (A/AAAA/MX/NS), robots.txt crawl permission for your user-agent, domain registration/expiry (RDAP), and the site's llms.txt (agent-readiness) — fanned out in parallel, each section with its own status. Pass ?userAgent= to test a specific crawler. Fetches are SSRF-checked. If every section fails you get a 503 and no charge.
{"url":"https://blog.cloudflare.com/","userAgent":"GPTBot"}
POST /v1/batch Σ internal prices · ≤ $0.05 Run up to 10 internal calls in one payment: POST {calls:[{path,input}]} and pay the SUM of the internal prices (≤ $0.05 total), executed in parallel, results returned in order. Batchable endpoints are the local, deterministic ones (validators, format transforms, time/locale) — no browser, network, composite or dynamic endpoints. Each result carries {path, status, body}; a bad request (unknown path, >10 calls, over cap) is a 400, not charged.
{"calls":[{"path":"/v1/iban-check","input":{"iban":"FR7630006000011234567890189"}},{"path":"/v1/routing-check","input":{"routing":"021000021"}}]}
GET /v1/seller-report $0.010 On-chain + config reliability report for any x402 seller, public data only, computed live. Pass ?payTo=0x… or ?url= (a third-party x402 endpoint) → {onchain:{firstSeenAt,totalIncomingTransfers,uniqueSenders,last30dInflows,note}, config, liveness, discovery} plus factual flags (new_seller, single_sender, config_issues, unreachable). On-chain counts all incoming USDC transfers, not only x402 settlements. No score, no verdict; fails open.
{"payTo":"0xc55A2D530b53CBaD1001e4AfD4720B7E71f9C291"}
GET /v1/receipt-verify $0.003 Verify on-chain that a transaction is the USDC payment you expected. Pass ?tx=0x… plus optional ?expectedPayTo=0x… and ?expectedAmount=0.01 (USD); ?network defaults to the deployment chain (base or base-sepolia). Decodes the tx's USDC Transfer logs and returns {verified, actualPayTo, actualAmount, asset, blockTime, confirmations, mismatch}. Unknown/unmined tx → 503 (unbilled). Add ?attest=1 for a signed receipt.
{"tx":"0xf1b23e5bf6e35c9601b91198645fe541fde1a6379c8378707abde0f8626a2c05","expectedPayTo":"0xc55A2D530b53CBaD1001e4AfD4720B7E71f9C291","expectedAmount":"0.001"}
GET /v1/market-price $0.005 Live market price stats for a kind of x402 service, from the public Bazaar catalog. Pass ?category=vat or ?query=pdf extraction and get {sampleSize, priceUsd:{min,p25,median,max,p75}, networks, examples} in USD — is your price fair, what should you charge? Computed over a live sample of up to 1000 resources; <3 matches returns an honest 'insufficient market data'. Neutral: our own endpoints are never featured.
{"category":"vat"}
POST /v1/facturx-validate $0.005 Validate a Factur-X / ZUGFeRD invoice: send PDF bytes, JSON { url } or { pdfBase64 }, or raw CII { xml }. Returns a rule-based report — PDF/A-3 structure, EN 16931 CII anchors, arithmetic rules (BR-CO) and French PA « Flux 2 » checks (BR-FR) — with the detected profile. Structural + heuristic, not a certified conformance service. ?attest=1 → Ed25519-signed audit trail.
{"url":"https://example.com/invoice-facturx.pdf"}
POST /v1/facturx-generate $0.020 Generate a Factur-X invoice (PDF/A-3 + embedded EN 16931 CII XML) from structured data: send { invoice, profile }, get the PDF bytes (or JSON with base64 + conformity report via Accept: application/json). Targets EN 16931 and the French PA « Flux 2 » rules (payment mentions, business process, electronic addresses) ahead of the 2026-09 mandate. Technical artifact, not tax/legal advice; you remain responsible for data accuracy and PA transmission.
{"profile":"EN16931","invoice":{"number":"INV-2026-0042","issueDate":"2026-07-05","currency":"EUR","seller":{"name":"ACME Studio SARL","legalId":"552100554","vatId":"FR55552100554","address":{"line1":"12 rue de la Paix","city":"Paris","postcode":"75002","countryCode":"FR"},"electronicAddress":{"value":"billing@acme.example","scheme":"EM"}},"buyer":{"name":"Globex SAS","legalId":"444555666","address":{"line1":"9 avenue des Champs","city":"Lyon","postcode":"69002","countryCode":"FR"},"electronicAddress":{"value":"ap@globex.example","scheme":"EM"}},"lines":[{"id":"1","name":"Consulting day","quantity":3,"unitCode":"DAY","unitPrice":800,"vatCategory":"S","vatRate":20}],"payment":{"meansCode":"30","iban":"FR7630006000011234567890189","dueDate":"2026-08-04"},"operationCategory":"services"}}
POST /v1/facturx-extract $0.004 Read a Factur-X / ZUGFeRD invoice: send PDF bytes or a JSON { url }. Extracts the embedded EN 16931 CII into normalised data — seller, buyer, lines, VAT, totals, payment, dates, references — with the detected profile. The read side of e-invoicing (the FR mandate starts with reception). No embedded CII → { profile:"none", warning:"no_embedded_cii" }. ?attest=1 → Ed25519-signed.
{"url":"https://example.com/invoice-facturx.pdf"}
POST /v1/epc-qr $0.002 Generate an EPC QR code (SEPA Credit Transfer / « Girocode », EPC069-12) — the QR a banking app scans to pre-fill a transfer, the payment companion to an invoice. Body { name, iban, amount?, bic?, purpose?, remittance? | reference? (RF) }. Returns PNG (default), SVG, or the raw EPC text. IBAN + RF are validated; strict EPC encoding (order, lengths, ≤331 bytes, level M). EUR only. Not a payment initiation — just the encoded data.
{"name":"ACME Studio SARL","iban":"FR7630006000011234567890189","amount":3360,"reference":"RF18539007547034"}
GET /v1/late-payment $0.002 B2B late-payment interest + the €40 fixed indemnity for an overdue invoice. ?regime=fr (L441-10: ECB refinancing rate + 10 pts by default, or a contractual rate with the 3× legal floor) or ?regime=eu (Directive 2011/7: ECB reference + 8 pts). Params ?amount=&dueDate=&paidDate?=&regime=&rate?=. Returns daysLate, applicableRate, interest, fixedIndemnity, totalDue. Calculation aid on published rates — not legal advice; terms may differ.
{"amount":10000,"dueDate":"2026-06-01","regime":"fr"}
GET /v1/peppol-lookup $0.003 Look up a business in the public Peppol Directory — where to route an e-invoice (the BT-34/49 electronic address). ?id= (a Peppol id like 0225:992412536, or a value to search) or ?country=FR&name=. Returns { found, count, participants:[{peppolId, name, country, documentTypes[], schemes[]}] }. Unknown id → { found:false }. Directory down → 503, unbilled. Public source, 1h cache.
{"country":"FR","name":"orange"}
POST /v1/readability $0.003 Extract the main article from a web page with Mozilla Readability — drops nav, ads, sidebars and footer boilerplate. Send inline {html} or a public {url} to fetch (SSRF-checked). Returns the article title, byline, cleaned HTML content, plain textContent, excerpt, character length, language and site name. THE pre-processing step before sending a page to an LLM. Distinct from html-to-md (which renders Markdown). Max 5 MB.
{"url":"https://blog.cloudflare.com/how-we-built-workers"}
POST /v1/token-count $0.001 Count BPE tokens in a text with tiktoken (o200k_base = GPT-4o default, or cl100k_base). An agent can check content fits an LLM context window before paying for an expensive call. Returns token count, char count and encoding. Honest scope: an OpenAI-style estimate — no open-source Claude tokenizer exists (exact Claude counts need the Anthropic API), Gemini differs too. Provided text only; nothing is fetched. Max 1 MB.
{"text":"hello world","encoding":"cl100k_base"}
POST /v1/chunk $0.002 Split a long text into token-sized chunks for RAG ingestion. Chunks are measured in REAL tokens (tiktoken o200k_base/cl100k_base), honour a token overlap, and cut on sentence, paragraph or word boundaries (strategy). Returns each chunk text, its exact token count and char offsets. The natural composite of token-count; counts are OpenAI-style estimates (no Claude tokenizer exists). Provided text only; nothing is fetched. Over 1 MB is truncated.
{"text":"First sentence here. Second sentence follows. Third one too.","maxTokens":16,"overlap":4,"strategy":"sentence"}
POST /v1/lang-detect $0.001 Detect the language of a text with franc (pure-JS trigram model, 61 languages + CJK/Indic scripts). Returns the ISO 639-1 code (639-3 when no 2-letter code exists), language name, a separation-margin confidence (0=ambiguous, 1=unambiguous), a reliable flag, and ranked alternatives. The pre-sort step of any multilingual pipeline. Short/ambiguous text returns reliable:false honestly. Processes provided text only; nothing is fetched.
{"text":"Bonjour le monde, ceci est un test de détection de langue en français."}
POST /v1/extract-entities $0.002 Extract emails, http(s) URLs, international phone numbers, @mentions and #hashtags from provided text OR html — normalized and de-duplicated. From html, also reads href/src attributes and mailto: links. Emails are syntax-validated; phones use Google libphonenumber (international format). Pattern-based extraction, NOT ML named-entity recognition. What a crawl agent pulls from every page. Processes provided content only; nothing is fetched.
{"text":"Reach us at sales@acme.com or +1 415 555 0132. See https://acme.com/pricing. Follow @acme #saas"}
POST /v1/summarize-extractive $0.003 Extractive summary: selects the N most salient sentences via TextRank (TF-IDF cosine + PageRank) — a pure algorithm, no LLM, so deterministic and free of inference cost. Returns the summary and each chosen sentence with a salience score and index. Extractive (selects existing sentences), NOT abstractive/generative — that is the point: reproducible and model-free. Pre-condense a page before an LLM call. Provided text only. Over 1 MB truncated.
{"text":"Cloudflare Workers run code at the edge. They use V8 isolates, so cold starts are near zero. Many companies migrated their APIs to Workers to cut latency. Pricing is based on requests and CPU time.","sentences":2}
POST /v1/redact $0.003 Mask PII in free text before you send it to an LLM or write it to a log. Pattern-based detection (not ML): emails, phone numbers (Google libphonenumber), IBANs (mod-97), payment cards (Luhn), URLs and IPs. Choose types[] and mode: mask (j***@d***.com, readable), remove, or label ([EMAIL_1], re-identifiable by index). Names and postal addresses are out of scope. The input text is never logged or stored.
{"text":"Contact jane.doe@example.com or +33 6 12 34 56 78, IBAN FR7630006000011234567890189.","mode":"mask"}
POST /v1/embed $0.004 Text → vector embeddings via Cloudflare Workers AI. Send {text} or {texts[]} (≤20, each ≤4000 chars); returns one float vector per input. Default model @cf/baai/bge-m3 (1024-dim, multilingual). The model is named in the response — embeddings only compare within the same model. Completes the RAG chain: readability → chunk → embed, no OpenAI account. Cosine-compare the vectors yourself. Unavailable model/binding → 503, not billed.
{"texts":["A cat sat on the mat.","A feline rested on the rug."]}
POST /v1/structured-data $0.003 Extract a page's structured data: JSON-LD (schema.org), Open Graph tags, and best-effort microdata. Returns the parsed JSON-LD objects, detected schema.org types (Product, Offer, Review, Event, Recipe, Article…), microdata items and the og:* map. Send inline {html} or a public {url} (SSRF-checked). Malformed JSON-LD yields a {parseError} entry, never a crash. Microdata is best-effort; JSON-LD is the reliable path. Max 5 MB.
{"url":"https://hydrogen.shop/products/the-h2-snowboard"}
GET /v1/llms-txt $0.002 Fetch and parse a site's llms.txt (llmstxt.org) — the LLM-era robots.txt. Give any page URL; it resolves the origin's /llms.txt, and returns the H1 title, the blockquote summary, and every section's links ([title](url): notes). Also probes /llms-full.txt and reports its size. A site without one returns {found:false} (a 200, still useful). The fetch is SSRF-checked. Bonus signal in /v1/site-profile.
{"url":"https://developers.cloudflare.com/"}
POST /v1/c2pa-verify $0.005 Verify C2PA / Content Credentials (provenance & tamper detection) in an image: send the image bytes or a JSON {url}. Returns Trusted/Valid/Invalid/None with per-manifest signature, trust-chain (issuer) and asset-hash checks plus C2PA actions. 'Trusted' only if the signer chains to the C2PA trust list, otherwise 'Valid'. Relevant to EU AI Act Art. 50. Verification only (embedded manifests) — not generation.
{"url":"https://example.com/photo-with-credentials.jpg"}
POST /v1/rerank $0.004 Rerank passages by relevance to a query via Cloudflare Workers AI (@cf/baai/bge-reranker-base). Send {query, documents[] (≤50, each ≤4000 chars), topK?}; returns [{index, score}] best-first — the missing link after embed/chunk, keeping the top chunks before a costly LLM call. Score is the model's relevance score (higher = better), named as it only compares within this model. Unavailable binding → 503, unbilled.
{"query":"How do I reset my password?","documents":["To reset your password, click 'Forgot password' on the sign-in page.","Our office is open Monday to Friday, 9am to 5pm.","Passwords must be at least 12 characters and are reset from account settings."],"topK":2}
POST /v1/json-validate $0.002 Validate a JSON value against a JSON Schema (draft 2020-12 default; 2019-09/7/4 via $schema). Send {data, schema}; returns {valid, errors:[{path, message, keyword}]} with a JSON Pointer path per failure. For agents checking structured/tool-call output before use. Runs on an eval-less validator (Ajv can't run on Workers). Remote $ref is refused (self-contained only); unsafe regex patterns are rejected before compilation.
{"data":{"name":"Ada","age":36},"schema":{"type":"object","properties":{"name":{"type":"string"},"age":{"type":"integer","minimum":0}},"required":["name","age"]}}
GET /v1/x402-quote $0.002 Enriched quote for an x402 endpoint: probes it unpaid (never pays, SSRF-checked), decodes {price, asset, network, payTo}, then compares the USD price against the live Bazaar market for its category → {marketContext:{category, medianForCategory, cheaperThanMarket}}. Not just how much, but whether it's fair. Market context is best-effort; the decoded quote returns even if the Bazaar read fails. Neutral — our own endpoints are never featured.
{"url":"https://402utils.com/v1/rss-to-json"}
POST /v1/x402-batch-probe $0.003 Probe up to 10 x402 endpoints in parallel and get each one's reachability and decoded price — for an agent comparing several sellers at once. Send {urls:[…]}; returns [{url, reachable, isX402, price?, priceUsd?, error?}]. Each URL is SSRF-validated independently and NO payment is ever sent; one unreachable URL never fails the batch (it is reported per-URL). Reuses the same decoder as x402-probe.
{"urls":["https://402utils.com/v1/rss-to-json","https://402utils.com/v1/qr"]}
POST /v1/regex-test $0.001 Test a regex against one or many inputs, safely. Send {pattern, flags?, input|inputs[], mode?}: 'match' returns the first match + capture groups, 'matchAll' every match, 'replace' the rewritten string (needs {replacement}). A mandatory ReDoS guard statically rejects catastrophic patterns (nested quantifiers, `.*.*$`, backrefs) BEFORE running — on Workers no timeout can stop a runaway regex. For agents that generate and dry-run regexes.
{"pattern":"(\\d{4})-(\\d{2})-(\\d{2})","input":"date: 2026-07-06","mode":"match"}
POST /v1/jsonpath $0.002 Extract values from a JSON document with a JSONPath expression or an RFC 6901 JSON Pointer, without returning the whole document. Send {data, path}; get {matches, count}. Path starting with $ = JSONPath ($.items[*].price, $..author, [0], [1:5], [*]); starting with / = JSON Pointer (/items/0/price). No-eval tree walk with bounded traversal; filter expressions [?(…)] are not supported by design.
{"data":{"items":[{"price":10},{"price":22},{"price":7}]},"path":"$.items[*].price"}
POST /v1/json-transform $0.002 Reshape JSON declaratively — predictable, not a language. `mapping` mirrors the output shape; its leaf strings are dot-paths into `data` (a.b.0.c; negative index ok; 'contacts.*.email' projects over an array; '=text' escapes a literal). Objects/arrays nest; number/boolean/null are literals. Missing paths → null. Field rename/flatten/projection to fit a payload to a target schema. Distinct from /v1/jq (declarative vs query language).
{"data":{"user":{"first":"Ada","last":"Lovelace"},"tags":["math","computing"]},"mapping":{"name":"user.first","surname":"user.last","firstTag":"tags.0","kind":"=person"}}
POST /v1/csv-diff $0.003 Row-level diff of two CSVs (a→b) — reconcile two exports. With `key` (a column name, or a column index when header:false), rows pair by key → added / removed / changed (per-field old→new). Without a key, a whole-row multiset diff gives added/removed only. Delimiter auto-detected (, ; tab |); tolerant RFC-4180 parsing. First row is the header unless header:false. Max 5 MB per input; reported buckets cap at 10000.
{"a":"id,qty\n1,10\n2,5\n","b":"id,qty\n1,12\n3,7\n","key":"id"}
POST /v1/dedupe $0.002 De-duplicate a list of records or strings. Exact: group by a `key` field (dot-path) or, by default, the whole item (key-order-insensitive). Fuzzy (`fuzzy`: a field name, or true for scalar strings): group by normalized Levenshtein similarity ≥ `threshold` (default 0.85) — e.g. 'Jean Dupont' ≈ 'jean dupont' but 'Jean Martin' stays separate. Returns unique[] and duplicates[] (kept + dropped indices). Fuzzy ≤ 1000 items.
{"items":[{"name":"Jean Dupont"},{"name":"jean dupont"},{"name":"Jean Martin"}],"fuzzy":"name"}
POST /v1/sentences $0.001 Segment text into sentences — robust to the classic traps: abbreviations (Dr., e.g.), decimals ($3.14), URLs/emails (www.x.com), initials (J. R. R.) and ellipses. A period is a boundary only when followed by whitespace and a sentence-like start; !, ? and … are stronger; blank lines split paragraphs. Rule-based (EN/FR tuned), deterministic. A fine-grained chunking primitive, complements /v1/chunk. Over 1 MB truncated.
{"text":"Dr. Smith paid $3.14 to www.x.com. Then he left."}
POST /v1/keywords $0.002 Extract salient keywords/key-phrases from text via TextRank (word co-occurrence graph + PageRank), merging adjacent high-ranked words into phrases. Pure, deterministic, model-free — extractive, NOT ML/NER or an LLM (the point: reproducible, no inference cost). English + French stopwords removed. Returns keywords[] with normalized scores (top ≈ 1). For content tagging/indexing and pre-RAG. Over 100k tokens is truncated.
{"text":"Cloudflare Workers run JavaScript at the edge using V8 isolates. Workers have near-zero cold starts and per-request billing, which makes edge computing cheap for high-traffic APIs.","topK":5}
POST /v1/text-similarity $0.002 Similarity of two texts in [0,1]. Methods: `jaccard` (word-set overlap, default), `levenshtein` (normalized edit distance) — both pure & deterministic — and `cosine-embed` (cosine of Cloudflare Workers AI embeddings @cf/baai/bge-m3, semantic; model named). Compare two texts (dedup, matching) without handling embeddings yourself. cosine-embed 503s unbilled if the AI binding is unavailable. Caps: jaccard 200k, levenshtein 5k, cosine 4k chars.
{"a":"A cat sat on the mat.","b":"The feline rested on the rug.","method":"cosine-embed"}
GET /v1/favicon $0.002 Resolve a website's best icon: parses <head> for link rel=icon / apple-touch-icon / mask-icon, reads a linked web app manifest's icons, and adds the /favicon.ico fallback, then ranks them (scalable/large first). Returns the best iconUrl plus all ranked candidates with rel/sizes/type/source. The URL is SSRF-checked; fetches are capped. For agents building directories or UIs.
{"url":"https://github.com"}
POST /v1/jq $0.003 Apply a jq-style filter to JSON — the JSON swiss-army knife. Supports identity, fields, index/slice/iterate, pipe |, comma, //, and/or/not, arithmetic, comparisons, array/object construction and builtins (select, map, keys, length, add, sort_by, group_by, unique, to_entries, has, range…). A SAFE pure-JS subset (no eval, bounded): no variables, def, reduce, regex or assignment. Returns the whole jq output stream as results[].
{"json":{"users":[{"name":"Ada","age":36},{"name":"Bo","age":29}]},"filter":".users | map(select(.age > 30) | .name)"}
GET /v1/tech-detect $0.004 Detect a website's tech stack — frameworks, CMS, e-commerce, analytics, tag managers, CDN, web server, language — from response headers, cookies, <meta generator> and HTML/script markers. HEURISTIC, signature-based on PUBLIC fingerprints (NOT the licensed Wappalyzer database): strong on popular tech, conservative elsewhere; not-listed ≠ absent. Each hit carries a confidence and the matched evidence. The URL is SSRF-checked; the fetch is capped.
{"url":"https://vercel.com"}
GET /v1/lei-lookup $0.003 Global KYB via the official GLEIF registry. ?lei=<20-char LEI> returns legal name, entity + registration status, jurisdiction, address, next renewal and direct parent; ?name=&country= searches by name. The ISO 17442 checksum is verified locally, so a typo is a 400 with no network call. GLEIF down → 503, unbilled. Public CC0 data. Part of the EU compliance toolkit; enriches supplier-check.
{"lei":"529900D6BF99LW9R2E68"}
GET /v1/vat-oss $0.002 EU B2C e-commerce VAT: where a distance sale is taxed and how much. Applies the €10,000/year OSS threshold — at/below → seller-country VAT (domestic); above → consumer-country VAT via OSS. IOSS for imports ≤ €150. ?sellerCountry=&buyerCountry=&amount= (+ ytdCrossBorder, category). Returns scheme, taxationPlace, applicableCountry, vatRate, vatAmount. Calculation aid; OSS/IOSS registration and filing are the seller's responsibility.
{"sellerCountry":"FR","buyerCountry":"DE","amount":100,"ytdCrossBorder":15000}
GET /v1/eori-check $0.002 Validate an EU EORI number (the customs operator id for any EU import/export) against the Commission's official EOS service. Format is checked locally first, so junk never hits the network. Valid numbers return the registered name/address when the operator consented. Never a false 'invalid': if the service is down you get a 503, not charged. Complements vat-check in the EU compliance toolkit. ?attest=1 → Ed25519-signed.
{"eori":"NL822502975"}
POST /v1/eu-sanctions $0.004 Screen a name against the EU consolidated financial sanctions list ONLY (official embedded snapshot, persons + entities — NOT OFAC/SDN, UN or UK/OFSI). Fuzzy matching returns each hit with a score, sanction programme, listing date and matched name. POST body {name, type?, threshold?} (POST so the name never enters logs). A screening aid: a match is not a compliance determination — verify with the official source before acting.
{"name":"Saddam Hussein"}
GET /v1/ecb-calendar $0.001 TARGET2/T2 settlement calendar — the SEPA banking calendar, to predict when a euro transfer settles. TARGET is closed on weekends + six fixed days (New Year, Good Friday, Easter Monday, 1 May, 25 & 26 Dec). ?year= lists the closing days; ?date= says whether it settles (and the next open day); ?date=&addBusinessDays=N returns the value date N settlement days away. The SEPA counterpart of /v1/business-days.
{"date":"2026-04-03","addBusinessDays":1}
POST /v1/hash $0.001 Compute cryptographic hashes / checksums of a string or of raw bytes (base64). Returns lowercase hex for each requested algorithm: sha256 (default), sha512, sha1, md5. SHA via native Web Crypto; md5 and sha1 are offered for legacy interop only and flagged — not for security. POST so the input never lands in a URL/log. Verification/checksums only, not a hash cracker.
{"text":"hello world","algorithms":["sha256","md5"]}
GET /v1/color $0.001 Colour utilities: ?op=convert (default) turns any hex/rgb()/hsl()/CSS-name into hex, rgb, hsl, hsv, alpha, relative luminance and exact CSS name; ?op=contrast with ?fg=&bg= returns the WCAG 2.x contrast ratio and AA/AAA pass/fail for normal & large text plus UI components (accessibility / EAA); ?op=palette derives complementary, analogous, triadic, tints and shades. Send hex without '#'.
{"op":"contrast","fg":"000000","bg":"ffffff"}
POST /v1/unit-convert $0.001 Convert a value between units in the same physical dimension: length, mass, volume, temperature, area, speed, data, energy, pressure, time, angle. Factors are exact SI constants (NIST SP 811) — deterministic, unlike an LLM's guess. Pass ?category=currency to convert ISO 4217 amounts at ECB reference rates instead (informational, not for pricing). Unknown units → 400 with a suggestion.
{"value":100,"from":"celsius","to":"fahrenheit"}
POST /v1/slugify $0.001 Turn free multilingual text into a URL-safe slug. Transliterates Latin (all diacritics: é→e, ü→u), Cyrillic and Greek to ASCII; deterministic. Options: separator (default '-'), lowercase (default true), maxLength (cuts on a word boundary), transliterate (default true; false keeps letters of any script as a Unicode slug). Complex scripts (CJK, Arabic, Hebrew) are NOT romanised and are dropped.
{"text":"Crème Brûlée à la Vanille"}
POST /v1/mime-detect $0.002 Detect a file's true MIME type from its magic-number byte signature — not from a declared extension or Content-Type. Send the raw bytes (≤10 MB) as the body, or JSON { bytes: base64 }. Returns {mime, extension, confidence, description, category, executable}. Covers images, documents (incl. OOXML/OpenDocument), archives, audio/video, fonts and executables (which are flagged). Security check for file pipelines. Not a barcode/QR reader.
{"bytes":"JVBERi0xLjQK"}
POST /v1/barcode $0.002 Generate a 1D barcode as PNG or SVG: EAN-13, EAN-8, UPC-A, Code 128, Code 39 or ITF-14. Validates the structure and check digit for each symbology — EAN/UPC/ITF compute a missing check digit or reject a wrong one. Options: format (png/svg), scale (module px 1-10), text (human-readable line, default on). Returns the raw image. Generation only — reading a barcode from an image is out of scope.
{"data":"5901234123457","symbology":"ean13","format":"png"}

How to pay (the 402 flow)

# 1. Call it — get HTTP 402 with price + asset + network in the PAYMENT-REQUIRED header
curl -i -X POST https://402utils.com/v1/echo \
  -H 'content-type: application/json' \
  -d '{"msg":"hello farm"}'

# 2. Pay with any x402 client (signs a gasless USDC authorization; the
#    facilitator settles on-chain) and it retries automatically:
#    npx x402 fetch https://402utils.com/v1/echo  —  or @x402/fetch in code.

Signed attestations

Add ?attest=1 to vat-check, vat-rates, iban-check, rf-reference, routing-check, phone-check, supplier-check or invoice-ready to get an Ed25519-signed attestation of the result — an audit trail anyone can verify offline against the public key at /.well-known/402utils-attestation.json.