{"id":"x402-bureau-conformance","name":"x402 Endpoint Conformance Standard","version":"1.0.0","clauses":[{"clause":"C1","title":"Payment gate present and enforced","requirement":"A protected resource MUST return HTTP 402 with a PAYMENT-REQUIRED challenge on an unpaid request, and MUST NOT return 200 on the paid path without payment.","guards_against":["X402-D001","X402-D011"],"observable_in_preflight":true},{"clause":"C2","title":"Well-formed payment envelope","requirement":"The PAYMENT-REQUIRED header MUST be base64 JSON that parses to a valid x402 v2 PaymentRequired structure with a non-empty accepts list.","guards_against":["X402-D002"],"observable_in_preflight":true},{"clause":"C3","title":"Recognized settlement network","requirement":"accepts[].network SHOULD be a CAIP-2 identifier known to the Bureau registry (e.g. eip155:8453).","guards_against":["X402-D003"],"observable_in_preflight":true},{"clause":"C4","title":"Valid recipient address","requirement":"accepts[].payTo MUST be a syntactically valid address for the declared network.","guards_against":["X402-D004"],"observable_in_preflight":true},{"clause":"C5","title":"Honest resource URL","requirement":"resource.url MUST NOT be a raw IP, loopback, or non-standard port; it SHOULD match the public origin.","guards_against":["X402-D005"],"observable_in_preflight":true},{"clause":"C6","title":"Price consistency","requirement":"The charged amount MUST equal the advertised price.","guards_against":["X402-D006"],"observable_in_preflight":false},{"clause":"C7","title":"Independent verifiability route","requirement":"A service claiming verifiable output SHOULD expose a free route to verify a signature.","guards_against":["X402-D007"],"observable_in_preflight":false},{"clause":"C8","title":"Signed output","requirement":"Output claimed verifiable MUST carry a signature and a discoverable verification key.","guards_against":["X402-D008"],"observable_in_preflight":false},{"clause":"C9","title":"Authorization window disclosed","requirement":"accepts[] SHOULD declare a positive max_timeout_seconds authorization window.","guards_against":["X402-D009"],"observable_in_preflight":true},{"clause":"C10","title":"Staleness disclosure","requirement":"Claims and outputs SHOULD carry an explicit date / as-of signal.","guards_against":["X402-D010"],"observable_in_preflight":false},{"clause":"C11","title":"402 response discipline","requirement":"The 402 response SHOULD carry an explicit application/json content-type and a no-store / no-cache cache-control header.","guards_against":["X402-D012"],"observable_in_preflight":true}],"defect_ids":["X402-D001","X402-D002","X402-D003","X402-D004","X402-D005","X402-D006","X402-D007","X402-D008","X402-D009","X402-D010","X402-D011","X402-D012"]}