x402 census · api.zfinia.com · c6b9c911c4cb · JSON

POST /x402/v1/ci-workflow-contract-audit

live

Audit a CI workflow for what it leaves movable or undeclared. Reports actions pinned to a tag rather than a commit - a tag can be moved by whoever owns the action, so the code a step runs can change without this file changing - missing permissions and timeouts, a job depending on one that is not declared, a pull_request_target trigger, and an expression interpolated straight into a shell command.

Verdict: live. The unpaid GET reached a valid 402. The live amount equals the catalog price.

Facts from the catalogs

Field Value

URL https://api.zfinia.com/x402/v1/ci-workflow-contract-audit

Method POST

Price $0.12 USDC = 120000 atomic units of 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913

Network eip155:8453 (base)

payTo 0x25e8245f07d5e4873987293dad666afbe56a9608

Seller api.zfinia.com

Catalogs cdp (row updated 2026-10-04)

Listed since (lower bound) 2026-10-04 (earliest catalog timestamp; catalogs report last-update times only)

Last catalog update 2026-10-04

CDP quality counters 1 calls and 1 unique payers in 30 days, last call 2026-10-04 (catalog-reported, not verified on chain)

Category (keyword rule) research/reports

Templated path no

x402Version in catalog 2

Service name / tags CI Workflow Audit · configuration, continuous integration, supply chain hygiene, linting, developer tooling

Unpaid probe (census of 2026-10-22)

Field Value

Probed at 2026-10-22T00:28:06.837Z

HEAD 402

GET 402

Verdict live live: valid 402 to an unpaid GET

402 carried in header+body

x402Version in the 402 2

accepts[0] {"scheme":"exact","network":"eip155:8453","amount":"120000","payTo":"0x25e8245f07d5e4873987293dad666afbe56a9608","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","maxTimeoutSeconds":60,"extra":{"name":"USD Coin","version":"2"}}

Live amount equals catalog price yes

Live payTo equals catalog payTo yes

extensions.bazaar in the 402 yes

PAYMENT-REQUIRED header yes

WWW-Authenticate offer none

Content type / server / CORS application/json / Vercel / none

Latency 384 ms

Error Payment required

No hourly re-probe has reached this resource yet; the cron covers a rotating slice of 150 per hour.

On-chain facts for the payTo (public address)

Field Value

Distinct payers 4

Payments 5

USDC volume $0.03

Median payment $0.01

First / last payment 2026-08-30 / 2026-09-30

Sampler-shaped share of payments 100.0%

Payers that are not samplers 0

Source forensics-2026-09-30

Address 0x25e8245f07d5e4873987293dad666afbe56a9608

Declared input and output (extensions.bazaar)

{
 "input": {
  "body": {
   "contract": {
    "required_jobs": [
     "build",
     "publish",
     "lint"
    ]
   },
   "workflow": {
    "jobs": {
     "build": {
      "runs-on": "ubuntu-latest",
      "steps": [
       {
        "uses": "actions/checkout@v4"
       },
       {
        "uses": "actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8"
       },
       {
        "name": "Greet",
        "run": "echo \"Building ${{ github.event.pull_request.title }}\""
       },
       {
        "run": "npm ci && npm test"
       }
      ]
     },
     "notify": {
      "needs": [
       "publish",
       "lint"
      ],
      "runs-on": "ubuntu-latest",
      "steps": [
       {
        "run": "echo done"
       }
      ]
     },
     "publish": {
      "needs": "build",
      "permissions": {
       "contents": "read",
       "packages": "write"
      },
      "runs-on": "ubuntu-latest",
      "steps": [
       {
        "uses": "actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3"
       }
      ],
      "timeout-minutes": 15
     }
    },
    "name": "release",
    "on": {
     "pull_request_target": {},
     "push": {
      "branches": [
       "main"
      ]
     }
    }
   }
  },
  "bodyType": "json",
  "method": "POST",
  "type": "http"
 },
 "output": {
  "type": "json",
  "example_truncated": true,
  "chars": 2535
 }
}

Try it (unpaid: shows the 402)

curl -si -X POST 'https://api.zfinia.com/x402/v1/ci-workflow-contract-audit' -H 'accept: application/json' -H 'content-type: application/json' --data '{}'

The catalog declares POST. A 402 answer carries the payment requirements in the JSON body and, for x402 v2, base64 in the PAYMENT-REQUIRED header. This page never sends a payment.

Paid checks (x402, USDC on Base)

GET https://bazaar.agentexchange.work/r/c6b9c911c4cb/probe.json re-runs this probe right now for $0.01 and writes the result here. POST https://bazaar.agentexchange.work/featured with {"id":"c6b9c911c4cb"} places this resource at the top of the report and search pages for 30 days for $1.00, labelled. Unpaid requests answer 402 with the terms. Pricing.

Catalog references: agentic.market (CDP Bazaar front end) · this record as JSON · all resources on api.zfinia.com.