---
name: onegate-preflight
description: Verify an x402 seller before your agent pays it. Use when an agent is about to sign a 402 payment for an unfamiliar API, marketplace, or tool.
---

# onegate — preflight an x402 seller

One origin, USDC on Base / Polygon / Arbitrum, x402 v2. No account, no API key.

## When to use this

Call `POST https://onegate.biz.id/v1/x402/preflight` **before** your agent signs a payment
for a seller it has not paid before. It probes the seller, parses the 402
challenge, and returns a verdict plus the evidence behind it.

## Call it

```bash
curl -X POST https://onegate.biz.id/v1/x402/preflight \
  -H 'content-type: application/json' \
  -d '{"url":"https://seller.example/v1/data","maxPriceUsdc":0.01}'
```

The first request answers HTTP 402 with the payment challenge in the
`PAYMENT-REQUIRED` header. Sign it with any x402 client, retry with the
`PAYMENT-SIGNATURE` header, and the paid response carries:

```json
{
  "ok": true,
  "verdict": "pay_ok",
  "score": 84,
  "checks": [
    { "id": "accept.amount", "status": "pass", "detail": "Price is $0.005000 USDC." }
  ]
}
```

## Input

| field | required | meaning |
|---|---|---|
| `url` | yes | absolute http(s) URL of the x402 endpoint to check |
| `method` | no | `GET` or `POST`; defaults to whatever the probe needs |
| `body` | no | JSON body, for POST sellers that validate the body before returning 402 |
| `expectedPayTo` | no | recipient address you already expect |
| `maxPriceUsdc` | no | refuse sellers asking more than this |
| `network` | no | required CAIP-2 network, e.g. `eip155:8453` |

## Reading the verdict

- `pay_ok` — structurally valid challenge, no hard trust failures. Still check the work.
- `caution` — payable, but at least one signal is weak. Start with the smallest payment.
- `do_not_pay` — a hard failure: broken challenge, mismatched recipient, invalid certificate, or a dangerous address.

## What it checks

20 checks across five areas: the 402 challenge itself (resource binding, payTo,
USDC asset, network, price, timeout), TLS and domain age, DNS and email
authentication (SPF/DMARC), the payout wallet's history, and discoverability
across three surfaces (facilitator Bazaar catalog, the seller's own
`/.well-known/x402`, and the public x402 index).

It cannot tell you whether the work is good. It tells you whether the seller
is structurally sound before you sign anything.

## Other endpoints on this origin

- `GET /v1/flow/solana` — $0.02 — Per-token wallet flow on Solana, with full trader attribution.
- `GET /v1/flow` — $0.02 — Per-token wallet flow on EVM, returned as a delta since your last call.
- `POST /v1/gate/send` — $0.02 — Single-use authorisation for a transfer (native / ERC-20 / NFT), plus a signed receipt.
- `POST /v1/gate/swap` — $0.03 — Authorisation for a swap, with parameter validation, a lease, and a receipt.

## Discovery

- OpenAPI: `https://onegate.biz.id/openapi.json`
- x402 catalog: `https://onegate.biz.id/.well-known/x402.json`
- Agent card: `https://onegate.biz.id/.well-known/agent-card.json`
- Full guide: `https://onegate.biz.id/llms-full.txt`