subject is an agent wallet (0x… or did:pkh:eip155:…), a DID, or a stable agent id.
Wallet subjects prove control at request time: a fresh EIP-191 personal_sign
challenge (POST /v1/identity/challenge), or the x402 payer address equal to the subject.
A stored binding alone is not proof. Non-wallet subjects are unproven and capped at provisional.
The certificate records the method in subject_proof.
POST /v1/self-check scans prompt, tools, skills, MCP and policy on the server and returns a self_check_id (valid 15 minutes, single use). Bodies with nothing visible to scan (empty, or only whitespace / invisible characters, nested values included) get 400 nothing_to_scan with no charge. POST /v1/cert/issue takes {subject, self_check_id, wallet_proof?}; the certificate uses only the stored server-side scan, and a client-supplied scan is refused. The self_check_id is reserved before payment settles: an unknown, used, expired or concurrently reserved id (404 self_check_not_found, 409 self_check_used, 410 self_check_expired, 409 self_check_reserved) is refused without charge. If the reservation is lost after payment, the response is 409 self_check_reservation_lost with a manual refund pending.
provisional by default, always for HALT, for non-wallet subjects, and when no real surface (prompt, tools, skills, MCP or policy) was scanned. attested: verdict ATTEST and score ≥ 75. endorsed: score ≥ 75 and endorsements from at least 3 distinct wallet-proven agents holding an attested or endorsed certificate, within the last 30 days (self-endorsements do not count).
typ=atc, iss=certbeforepay:ca:v1, sub, iat/nbf/exp (default lifetime 24 hours), serial, tier, score,
grade, verdict, findings_hash, finding_count, endorsements, owasp_ids, taxonomy_version,
subject_proof, scan_source=server, self_check_id, surfaces, and demo: true on demo-mode certificates only (production refuses them). Signed Ed25519; a PEM form
(BEGIN CERTBEFOREPAY AGENT TRUST CERTIFICATE) is included. Verify for free with
POST /v1/cert/verify against the key at GET /v1/ca; revocations at
GET /v1/cert/revocations. Checking the signature offline does not cover revocation; revocation checks still use GET /v1/cert/revocations.
After a successful interaction, Agent A calls POST /v1/peer/attest with {from_certificate, to, wallet_proof: {nonce, signature}, note?}: its own unrevoked ATC at tier attested or endorsed with a wallet subject, the peer subject (not itself), and a fresh POST /v1/identity/challenge signature for that wallet. Invalid requests are refused with 400 (401 wallet_proof_invalid) and no charge. Endorsements count toward endorsed on the next certificate. To check a peer, POST /v1/peer/challenge takes {certificate, min_score?, require_tier?}; a missing or malformed certificate is a 400 with no charge, and a well-formed certificate that fails verification is a paid REJECT.
These are agent scan certificates (signed, not a legal CA or PKI).
Paid routes return HTTP 402 with a Base64 PAYMENT-REQUIRED header
for USDC on Base (eip155:8453). Retry with PAYMENT-SIGNATURE.
The local playground may send X-CBP-Demo: 1. It works only on a local test server with no real payTo. Production refuses it, and CBP_DEMO_PUBLIC is never set on Fly.
Prices live at GET /.well-known/x402.
POST /v1/wallet/check returns clear, caution or block (list_result is not listed when the address is not on the list). It is a scam/phishing signal
from the ScamSniffer scam database (GPL-3.0), not OFAC/SDN, and not a guarantee. The free public
data runs about 7 days behind ScamSniffer's live feed. The check runs before payment settles, so invalid input (400) and list or service failures found then (503) are not charged. If the server faults after settlement, the response is 503 wallet_check_failed with "charged":true,"refund":"pending", and the owner refunds it manually.
Injection markers and hidden instructions in prompts, skills, and tool descriptions. Embedded secrets. Privileged + exfil tool combinations. Skills that shell out or POST context. MCP servers without TLS. Missing spend caps, loop caps, and confirmation gates. This is a fast deterministic gate, not a full pentest.
Support: [email protected]
Security reports: [email protected]