# Synthex Forge — x402 API

Machine-native services that AI agents discover, pay for, and consume programmatically. Per-call x402-payable endpoints settling USDC on Base.

Base URL: `https://x402.synthexforge.com`
OpenAPI 3.1 spec: `https://x402.synthexforge.com/openapi.json`
Catalogue: 101 paths — 40 metered (paid per call), 61 free.

## Payment

All metered endpoints follow the x402 open-standard flow:

1. Call the endpoint with no payment.
2. Receive `HTTP 402 Payment Required` with a `PAYMENT-REQUIRED` header (base64 x402 envelope: scheme, network, asset, amount, payTo).
3. Sign an EIP-3009 `transferWithAuthorization` for the stated USDC amount.
4. Retry the **identical** request with the payment header — the service performs the work and returns the result.

- Network: `eip155:8453` (Base mainnet)
- Asset: `USDC` (`0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913`)
- Receive wallet (payTo): `0xc8fF67FAE72596478599EAAcfad8656fAe1113c8`
- Scheme: `exact` (EIP-3009 transferWithAuthorization)
- No account, no API key, no signup, no checkout page.

## Metered endpoints (40)


### Agent Infrastructure

1. `POST /v1/mcp/eval/judge` — $0.15 — Judge Grade.
2. `POST /v1/mcp/threatmodel/tool-permission` — $0.25 — Tool Permission Threatmodel.
3. `POST /v1/mcp/verify/uptime` — $0.25 — Uptime Canary Probe.
4. `POST /v1/memory/get` — $0.05 — Memory Get.
5. `POST /v1/memory/put` — $0.10 — Memory Put.

### Documents & Data

6. `POST /v1/invoice-ocr` — $0.02 — Invoice Ocr.
7. `POST /v1/sec-extract` — $0.05 — Sec Extract.
8. `POST /v1/utils/code-review-brief` — $0.15 — Utils Code Review Brief.
9. `POST /v1/utils/doc-convert` — $0.10 — Utils Doc Convert.
10. `POST /v1/utils/invoice-extract` — $0.10 — Utils Invoice Extract.
11. `POST /v1/utils/pii-redact` — $0.25 — Utils Pii Redact.
12. `POST /v1/utils/schema-cleanup` — $0.05 — Utils Schema Cleanup.
13. `POST /v1/utils/translate-doc` — $0.10 — Utils Translate Doc.

### Forensics & Evidence

14. `POST /v1/data/c2pa/verify` — $0.25 — C2Pa Verify.
15. `POST /v1/data/signed-snapshot` — $0.30 — Signed Snapshot.
16. `POST /v1/evidence/ingest` — $0.20 — Forensics Ingest.
17. `POST /v1/evidence/query` — $0.15 — Forensics Query.

### Governance

18. `POST /v1/bureau/audit` — $0.25 — x402 Bureau — full conformance audit of any endpoint (PAID $0.25).
19. `POST /v1/bureau/receipt-check` — $0.05 — x402 Bureau — conformance-check any issuer's receipt/offer (PAID $0.05).
20. `POST /v1/bureau/reputation` — $0.10 — x402 Bureau — reputation from signed observation history (PAID $0.10).
21. `POST /v1/governance/reserve` — $0.02 — Agent Spend Governor — ATOMIC reserved lease (PAID $0.02).
22. `POST /v1/governance/settle` — $0.02 — Agent Spend Governor — settle a lease, idempotent (PAID $0.02).

### other

23. `GET /api/ebook/download` — $29.00 — Ebook Download.

### Research & Synthesis

24. `POST /v1/finance/attested-evidence` — $0.35 — Attested Finance.
25. `POST /v1/research/attested-brief` — $2.00 — Attested Brief.
26. `GET /v1/signed-research` — $0.50 — Signed Research.
27. `POST /v1/synthesis/verdict` — $0.50 — Synthesis Verdict.

### Security & Compliance

28. `POST /v1/budget/preflight` — $0.25 — Budget Preflight.
29. `POST /v1/compliance/check` — $1.00 — Compliance Check.
30. `POST /v1/containment/register` — $0.25 — Containment Register.
31. `POST /v1/security/dependency-risk` — $0.20 — Dependency Risk.
32. `POST /v1/security/redteam/authorized-scan` — $0.25 — Redteam Authorized Scan.
33. `POST /v1/security/threatmodel` — $0.25 — Threatmodel Analyze.

### Trust & Reputation

34. `POST /v1/agent-reputation` — $0.25 — Agent Reputation.
35. `POST /v1/agent-reputation/trusted-route` — $0.30 — Agent Reputation Trusted Route.
36. `POST /v1/identity/control-proof` — $0.20 — Identity Control Proof.
37. `POST /v1/readiness/attest` — $0.25 — Readiness Attest.
38. `POST /v1/receipts/mint` — $0.25 — Receipts Mint.
39. `POST /v1/verify-catalog/register` — $0.25 — Verify Catalog Register.
40. `POST /v1/veritrack/attest` — $0.25 — Veritrack Attest.

## Free verification (17 verify routes + 22 public-key routes)

A buyer can verify our claims before paying. These routes are always free:

- `GET /v1/agent-reputation/trusted-route/verify` — re-check a signed result (supply `signature`, `sha256`, `body`).
- `GET /v1/agent-reputation/verify` — re-check a signed result (supply `signature`, `sha256`, `body`).
- `POST /v1/bureau/anchor/verify` — re-check a signed result (supply `signature`, `sha256`, `body`).
- `POST /v1/bureau/verify` — re-check a signed result (supply `signature`, `sha256`, `body`).
- `GET /v1/compliance/verify` — re-check a signed result (supply `signature`, `sha256`, `body`).
- `GET /v1/containment/verify` — re-check a signed result (supply `signature`, `sha256`, `body`).
- `GET /v1/data/verify` — re-check a signed result (supply `signature`, `sha256`, `body`).
- `GET /v1/evidence/verify` — re-check a signed result (supply `signature`, `sha256`, `body`).
- `POST /v1/governance/verify` — re-check a signed result (supply `signature`, `sha256`, `body`).
- `GET /v1/identity/control-proof/verify` — re-check a signed result (supply `signature`, `sha256`, `body`).
- `GET /v1/mcp/eval/judge/verify` — re-check a signed result (supply `signature`, `sha256`, `body`).
- `GET /v1/memory/verify` — re-check a signed result (supply `signature`, `sha256`, `body`).
- `GET /v1/readiness/attest/verify` — re-check a signed result (supply `signature`, `sha256`, `body`).
- `GET /v1/receipts/verify` — re-check a signed result (supply `signature`, `sha256`, `body`).
- `GET /v1/synthesis/verify` — re-check a signed result (supply `signature`, `sha256`, `body`).
- `GET /v1/utils/verify` — re-check a signed result (supply `signature`, `sha256`, `body`).
- `GET /v1/veritrack/verify` — re-check a signed result (supply `signature`, `sha256`, `body`).

Published Ed25519 public keys (hex), one per signing domain:

- `GET /v1/agent-reputation/public-key`
- `GET /v1/agent-reputation/trusted-route/public-key`
- `GET /v1/budget/public-key`
- `GET /v1/compliance/public-key`
- `GET /v1/containment/public-key`
- `GET /v1/data/c2pa/public-key`
- `GET /v1/data/public-key`
- `GET /v1/evidence/public-key`
- `GET /v1/governance/public-key`
- `GET /v1/identity/control-proof/public-key`
- `GET /v1/mcp/eval/judge/public-key`
- `GET /v1/mcp/threatmodel/tool-permission/public-key`
- `GET /v1/mcp/verify/uptime/public-key`
- `GET /v1/memory/public-key`
- `GET /v1/readiness/attest/public-key`
- `GET /v1/receipts/public-key`
- `GET /v1/security/redteam/public-key`
- `GET /v1/security/threatmodel/public-key`
- `GET /v1/synthesis/public-key`
- `GET /v1/utils/public-key`
- `GET /v1/verify-catalog/public-key`
- `GET /v1/veritrack/public-key`

## Free byte-exact re-checks (7)

Deterministic, reproducible re-runs of a paid result — free by design:

- `POST /v1/bureau/preflight` — x402 Bureau — free signed preflight of any x402 endpoint.
- `POST /v1/bureau/reputation/corpus` — x402 Bureau — reputation from REAL corpus history only (FREE).
- `POST /v1/governance/check` — Agent Spend Governor — Can I spend X? (FREE, never reserves).
- `POST /v1/mcp/threatmodel/tool-permission/recheck` — Tool Permission Threatmodel Recheck.
- `POST /v1/mcp/verify/uptime/recheck` — Uptime Canary Recheck.
- `POST /v1/security/redteam/recheck` — Redteam Recheck.
- `POST /v1/verify-catalog/recheck` — Verify Catalog Recheck.

## Service & discovery

- `GET /health` — service + settlement status
- `GET /ping` — liveness
- `GET /config` — configuration and pricing
- `GET /openapi.json` — OpenAPI 3.1 spec
- `GET /.well-known/x402.json` — x402 discovery manifest
- `GET /agent-card.json` — agent capability + payment card
- `GET /.well-known/agent-card.json` — the same agent card at the standard well-known location
- `GET /.well-known/api-catalog` — API catalogue (linkset) indexing the discovery documents
- `GET /llms.txt` — this file
- `GET /mcp.json` — MCP discovery manifest
- `GET /.well-known/mcp.json` — MCP discovery manifest

## Machine discovery artefacts

- `https://x402.synthexforge.com/.well-known/x402.json` — x402 v2 manifest, all 40 metered endpoints with prices
- `https://x402.synthexforge.com/llms.txt` — this document
- `https://x402.synthexforge.com/agent-card.json` — capability card, all 40 capabilities with prices

## MCP server

This host is also the backend of the **Synthex Signed-Evidence MCP** server. Discover it at `GET /mcp.json` (stdio transport, FastMCP).

## Provenance

Catalogue counts and prices captured 06 Oct 2026 (2026-10-06T21:54:18Z) from the live service and its route table.