Evidence row 1262535

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://apiaudit.madebydevx.com/v1/quick"
    ]
  ],
  "name": "apiaudit.madebydevx.com/v1/quick",
  "owner_address": "0xb3cddccee6b150c8effd55b961afc0ecefe7f247",
  "raw": {
    "accepts": [
      {
        "amount": "90000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 300,
        "network": "eip155:8453",
        "payTo": "0xB3cDDccEe6B150c8efFD55B961afc0Ecefe7f247",
        "scheme": "exact"
      }
    ],
    "description": "Quick API health check for agents: send one public API endpoint URL and get a 3-sample spot check for $0.09 USDC on Base: grade A-F, score, production-ready yes/no, median/p95 latency, success rate and the top 3 issues with concrete fixes (security headers, CORS, HTTPS redirect, JSON consistency). Unreachable targets not charged. Full 10-sample audit with every finding and cert expiry: POST /v1/audit ($9). By DevX.",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "body": {
              "method": "GET",
              "url": "https://jsonplaceholder.typicode.com/todos/1"
            },
            "bodyType": "json",
            "discoverable": true,
            "method": "POST",
            "type": "http"
          },
          "output": {
            "example": {
              "operation_id": "5d0c7a3e-1f2b-4c6d-8e9f-0a1b2c3d4e5f",
              "payment": {
                "amount_raw": "90000",
                "network": "eip155:8453",
                "status": "paid",
                "tx_hash": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "result": {
                "full_report": {
                  "price_usd": "9.00",
                  "url": "/v1/audit"
                },
                "latency_ms": {
                  "ttfb_median": 5,
                  "ttfb_p95": 12
                },
                "tier": "quick",
                "top_issues": [
                  {
                    "fix": "Add: Strict-Transport-Security: max-age=31536000; includeSubDomains",
                    "severity": "medium",
                    "title": "No HSTS header"
                  },
                  {
                    "fix": "Allow-list trusted origins; never reflect the Origin header when credentials are allowed.",
                    "severity": "medium",
                    "title": "CORS reflects any Origin with credentials"
                  },
                  {
                    "fix": "Redirect (301/308) or reject (403/426) plain HTTP; combine with HSTS.",
                    "severity": "medium",
                    "title": "Plain HTTP is served, not redirected"
                  }
                ],
                "verdict": {
                  "grade": "C",
                  "label": "needs work before production",
                  "production_ready": false,
                  "score": 70
                }
              },
              "status": "paid"
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "body": {
                  "additionalProperties": false,
                  "properties": {
                    "body": {
                      "description": "Optional probe body for POST (string or JSON, max 16 KB)"
                    },
                    "expect_status": {
                      "description": "Status code that counts as success (default: any status < 400)",
                      "maximum": 599,
                      "minimum": 100,
                      "type": "integer"
                    },
                    "headers": {
                      "additionalProperties": {
                        "maxLength": 1024,
                        "type": "string"
                      },
                      "description": "Optional request headers (e.g. authorization) used only for the probe; never stored or echoed",
                      "type": "object"
                    },
                    "method": {
                      "description": "Probe method (default GET). POST is sent once per sample.",
                      "enum": [
                        "GET",
                        "HEAD",
                        "POST",
                        "OPTIONS"
                      ],
                      "type": "string"
                    },
                    "requestKey": {
                      "description": "Optional idempotency key: same payer + requestKey + input within 7 days returns the stored report without a second charge.",
                      "maxLength": 128,
                      "minLength": 8,
                      "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$",
                      "type": "string"
                    },
                    "url": {
                      "description": "Public http(s) API endpoint to audit (only this URL is probed)",
                      "format": "uri",
                      "maxLength": 2048,
                      "type": "string"
                    }
                  },
                  "required": [
                    "url"
                  ],
                  "type": "object"
                },
                "bodyType": {
                  "enum": [
                    "json"
                  ],
                  "type": "string"
                },
                "discoverable": {
                  "type": "boolean"
                },
                "method": {
                  "enum": [
                    "POST"
                  ],
                  "type": "string"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method",
                "bodyType",
                "body"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "iconUrl": "https://res.cloudinary.com/bdb-prod/image/upload/c_fill,ar_1:1,w_256,h_256,f_auto,q_auto/v1792674330/bazaar-icons/e0e6fd42800bc2b7.png",
    "lastUpdated": "2026-10-30T16:19:38.222Z",
    "quality": {
      "l30DaysTotalCalls": 1,
      "l30DaysUniquePayers": 1,
      "lastCalledAt": "2026-10-30T16:19:38.012Z"
    },
    "resource": "https://apiaudit.madebydevx.com/v1/quick",
    "tags": [
      "api-health",
      "quick-check",
      "security-headers",
      "latency",
      "devtools"
    ],
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "Quick API health check for agents: send one public API endpoint URL and get a 3-sample spot check for $0.09 USDC on Base: grade A-F, score, production-ready yes/no, median/p95 latency, success rate and the top 3 issues with concrete fixes (security headers, CORS, HTTPS redirect, JSON consistency). Unreachable targets not charged. Full 10-sample audit with every finding and cert expiry: POST /v1/audit ($9). By DevX."
}

What the leaf hashes

{"body":"f78e2439a0a95e22b55cfca4312385d27d1c81e871931ab38fbf6b6ef886ae1b","id":1262535,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793385567130063,"prev":null,"subject":"x402_bazaar:https://apiaudit.madebydevx.com/v1/quick","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-30 (243099 rows).

1. 0x04e1d6ebd56c855a154b0295f1d53fd5f8987b089b8874517e5db8e8bda3f47c
2. 0x3422a7b046a0a8f640ea93ef0206524212e3a817d9f45c14b8ce8872a9343c79
3. 0x6b12e220ce3516557dcfa9b561f7f32c97dfde1859a2bac48947556229c0e263
4. 0x2e2b64a5d792047c0df850e4fc06bca93daca5490eff719394ceecc3c53ceb0d
5. 0x750ad1a63e1f3043f7d2c4ccd0a2a7923b7042ee157acfd8f2d36b8c1ebffe65
6. 0x67ee9d348f0943a3491d27a53f25469201611ce322e0667fdead50d82f0c71fa
7. 0x5dc223844ad0f1267713988c6babd2f393a8b18a50980e50714d191f1d09db3c
8. 0xa11c6eb3c608bf973c643e41a6c9a4d56969765c295331b9e4503fcccb8ba8b3
9. 0x07f734109394c87bb9062624e53cb38d4ce1d538ea5f0d47b7baf74e4da45566
10. 0x3fa70884644fab5bbe6933a1e9492263bab78039fefce99f8428706ef1308b6c
11. 0x0f8fc28d693d68f9b35611b6ac0fff77345b25013aae5f12a6e1950c53ba5950
12. 0x4588a56123dd48dd025eb0cba6684201f8e98429c9b6b7d1cbe4920b3fc8e8b3
13. 0x287d3fb38960cf3c4d3356b0e6240c982ffcd471f4e9b7f7d550363c3483d375
14. 0xa0c9900ba7512d3a576c15bf6cc53f55a0645d9bf9b4e2e4c1760d00af98e761
15. 0x2b7a05865245feaf40ea40b73e02d86357af2dcbac9c7b992f1420f5eaa15246
16. 0xe2a9872e1b6a01c55a7a8cc5c05c61f3933255db5c26b9c79be4011d28685b52
17. 0xb0c9ef42e725578748f3119c9dbebf2fc437266bda013df29f98ed3ebe621403
18. 0x30a81d8fcef4e8f9e2877c62796cfc5612fc1b251127d531dee28f8dbd5c5147

Day root

0x0826c7ad6039e06a2360ca0a4a3a4fe7f2626c6dc19f71a37599386f78b39875

Chained

0x36b4c8a1063758f0b8765fa1bdf75fa92fb543cc183add3e261880ee2bd1f822

Published

On Arc Testnet, block 69923247: 0x8704744146c6967c8abc9e9a99de4db7283b29e840922ea83a69b6fe776e6861