RealX402

The problem

The x402 Bazaar and Agentic Market list 14,000+ self-declared services. Anyone can list one — there's no vetting before it shows up, and no independent conformance testing exists at the protocol level either. A well-formed, signed 402 challenge isn't the same thing as a real, working service behind it. And every payment, to a seller or anyone else, goes to a specific wallet address — one that could be sanctioned, brand new, or have no real activity behind it.

What /verify/seller checks

Given a seller's resource URL, /verify/seller probes it live (no payment made) and checks:

• Exists — does it actually respond with a well-formed x402 402 challenge, right now.
• Declaration consistent — does its own declared example output actually validate against its own declared schema. Catches broken, copy-pasted, or abandoned listings.
• Payout sanctioned — is its payTo address on the OFAC sanctions list, checked via Chainalysis's on-chain oracle.
• Wallet history — how old is the payout address and how much activity does it have (Base addresses only) — a bonus signal, not part of the verdict.
• Cairn citation — if the exact seller you're checking has a published Cairn conformance report, its verdict is included as supplementary evidence — a dated, independent finding, not a live check, and never part of our own verdict.

Honest about what this is: confirmation that the checkable things about a seller check out — not a guarantee it's trustworthy. No free source can promise that today. This is a first layer toward that, not the finished answer — every call, and the support behind it, helps build toward it.

This route is itself checked out: an independent, signed conformance report from Cairn — an autonomous agent that runs real adversarial payment batteries against live x402 sellers — passed all 16 checks against this endpoint. The two checks are complementary: this one answers "does this seller check out" on every call an agent makes; Cairn's answers "does this seller's payment handling actually hold up," run once and published permanently for anyone to verify.

What /verify/wallet checks

The same sanctions/wallet-history checks as /verify/seller, standalone for any EVM address on Base — not only a seller's declared payTo. Use it before sending or accepting funds from any wallet, not just paying a specific x402 seller.

• Valid address — is this even a well-formed EVM address. A malformed one is a deterministic no, no network call needed.
• Sanctioned — is it on the OFAC sanctions list, checked live via Chainalysis's on-chain oracle. The core, must-have check — if this itself can't be determined, the whole answer is an honest "unknown," never a guess.
• Has activity — does it have any on-chain transaction history (Base only), alongside its age — a bonus signal, not part of the verdict, same as in /verify/seller.

Call it

curl -i https://goodsong.dev/verify/seller \
  -H "Content-Type: application/json" \
  -d '{"resource_url": "https://api.example.com/paid-endpoint"}'
# → 402 Payment Required, with the x402 payment challenge in the response body

Both endpoints take the same call shape, just a different body:

POST /verify/seller     {"resource_url": "https://api.example.com/paid-endpoint"}
POST /verify/wallet     {"address": "0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045"}

• seller: method defaults to POST — set to GET if that's what triggers the seller's 402.
• wallet: address must be an EVM address on Base.

Pricing

Pay per call via x402 (USDC on Base) — no account, no key. A failed check (our source was down) is always free. Same backend as goodsong.dev's other verification endpoints (citations, packages, repos, legal case citations).