x402 Adds Two AI Agent APIs: JSON-LD Cross-Block Validation and SSL Pinning Policy Probing

URL Metadata API has added two paid endpoints for AI agents under the x402 payment protocol, priced at $0.0005 each. Both fill detection gaps in the existing toolchain and have completed end-to-end validation on stripe.com, github.com, and example.com.

What Problems Do These Two New Endpoints Solve

The existing API already covers many scenarios: /api/jsonld handles JSON-LD parsing, and /api/structured-data-validator checks whether each type's fields are present. However, neither can detect internal contradictions between multiple structured data blocks on the same page. Similarly, /api/tls-handshake-probe, /api/tls13-pqc-ech-probe, /api/tls-audit, and /api/header-policy-audit each audit a portion of TLS or HTTP headers, but none actually opens a TLS connection to verify whether policies like HSTS are enforced at runtime.

The two new endpoints target exactly these two gaps.

JSON-LD Cross-Block Consistency Validation

/api/jsonld-cross-validate extracts all JSON-LD blocks on a page, resolves cross-block @id references, and identifies the following contradictions:

• Same @id mapped to different @type
• Inconsistent name, url, or logo declarations for the same entity
• Cross-block priceRange conflicts
• aggregateRating.count or ratingValue conflicts
• ISO 8601 date validity for datePublished / dateModified
• HEAD probing of sameAs URLs (up to 8) to identify dead or externally contradictory links

Results include contradictions[] labeled by severity, a per_block_summary, and a 0-100 cross_block_score (A-F grade).

Real-world measurements: stripe.com returned 2 blocks, 0 contradictions, 8 sameAs probes (1 dead link), score 97/A. example.com has no JSON-LD and correctly returned 0/F.

This endpoint is practical for teams doing structured data SEO and for AI agents that need to automatically audit webpage metadata consistency—especially in e-commerce or local merchant scenarios, where inconsistent entity declarations across multiple blocks are common.

JSON-LD is a W3C-recommended JSON-based serialization format for embedding structured data in web pages using vocabularies such as Schema.org, which search engines use to generate rich snippets. The same page often contains multiple independent JSON-LD blocks due to template assembly, referencing the same entity via the @id field. So-called "cross-block consistency" means these scattered declarations must agree with each other across dimensions like type, name, URL, and rating; once conflicts arise, search results may lose ratings or show incorrect rich snippets. sameAs is a Schema.org property used to declare equivalent URLs for the same entity on other authoritative sites; HEAD probing sends an HTTP request that only asks for response headers to verify liveness.

SSL Pinning and HSTS-preload Active Probing

/api/ssl-pinning-policy-probe opens TLS connections to ports 443, 80, and 8443, capturing the following information:

• HSTS (RFC 6797): max-age, includeSubDomains, preload flags
• HSTS preload list membership (queried via the hstspreload.org API)
• Expect-CT (RFC 8470): presence, max-age, enforce flag
• HPKP (Public-Key-Pins, deprecated in 2018, for reference only)
• X-Content-Type-Options: nosniff
• Legacy X-Frame-Options header
• Downgrade redirect probe from port 80 to HTTPS

Returns a pinning_policy_score (0-100, A-F grade) along with a verdict (production_fortified / standard / weak / no_hsts) and per-port probe results.

Real-world measurements:

• stripe.com: HSTS max-age=63072000s (2 years), includeSubDomains, preload flag, hstspreload_list_member=true, nosniff, X-Frame-Options=SAMEORIGIN, score 60/C, rated "weak"—penalized for missing Expect-CT and no downgrade redirect.
• github.com: HSTS max-age=31536000s (1 year), includeSubDomains, hstspreload_list_member=true, port 80 safely redirects to HTTPS, score 70/C.
• example.com: no HSTS, correctly returned 0/F, rated "no_hsts".

One noteworthy detail: although both stripe.com and github.com are already on the HSTS preload list, they both score only C. This shows that HSTS preload is only one dimension of transport-layer security; missing Expect-CT and unconfigured downgrade redirects also lower the overall score. For security audit AI agents, this kind of granular itemized deduction is more informative than a single pass/fail conclusion.

HSTS (HTTP Strict Transport Security, RFC 6797) uses the max-age in the Strict-Transport-Security response header to tell browsers to enforce HTTPS for a future period, includeSubDomains extends this to subdomains, and preload declares that the site wishes to be added to browsers' built-in preload lists. The HSTS preload list is maintained by hstspreload.org and distributed with browsers such as Chrome and Firefox, and is a key mechanism for protecting first visits from downgrade attacks. Expect-CT (RFC 8470) was originally used to enforce Certificate Transparency but has been deprecated as browsers stopped supporting it. HPKP (Public-Key-Pins) was removed by major browsers as early as 2018 due to excessive configuration risk, and is included here only for historical reference. SSL pinning refers to binding a server certificate or public key to an expected value to prevent man-in-the-middle attacks.

x402 Payment Envelope and How to Call

Both routes return HTTP 402 with the following payment information:

• payTo: 0xCa0a6c6Aa7A8F0D5893636CF166Ea2b44fb6500c
• asset: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 (USDC on Base)
• network: eip155:8453
• maxAmountRequired: 500 atomic ($0.0005)

Sending a forged X-PAYMENT header to either endpoint returns 402 with a malformed_payment_header error from the real pay.openfacilitator.io—not a stub implementation.

Example calls:

curl "https://history-primarily-interesting-penalties.trycloudflare.com/api/jsonld-cross-validate?url=https://stripe.com" -i
curl "https://history-primarily-interesting-penalties.trycloudflare.com/api/ssl-pinning-policy-probe?domain=github.com" -i

Both return 402 first, and after settlement via x402, JSON results are returned. The full route catalog (192 entries) is available at /.well-known/x402.

x402 is a pay-per-call protocol built on the HTTP 402 "Payment Required" status code, designed to let AI agents automatically complete API settlement without human intervention. When a client first requests an endpoint without payment credentials, the server returns 402 and a structured payment envelope, where payTo is the recipient address, asset specifies the settlement token contract, network identifies the chain using CAIP-2 (here eip155:8453, i.e., Coinbase's Base mainnet), and maxAmountRequired expresses the price in the token's smallest unit. The client then constructs an X-PAYMENT header and replays the request. The $0.0005 price corresponds to USDC's 6 decimal places, i.e., 500 atomic units.

Significance for the AI Agent Tooling Ecosystem

The positioning of these two APIs is clear—they are not general-purpose crawlers or security scanners, but rather make a specific type of detection programmable, billable, and autonomously callable by agents. The $0.0005 unit price means an agent can call them hundreds of times in a single task while the cost remains negligible.

For developers building automated audit workflows, JSON-LD cross-block validation fills a missing link in structured data quality detection; SSL policy probing combines HSTS preload membership and runtime enforcement verification into a single call. Both have completed end-to-end validation on real sites and are not conceptual endpoints.

As pay-per-call protocols like x402 mature, the barrier for agents to call external APIs is falling. Small, specialized endpoints targeting specific detection gaps like these may become common components of agent toolchains.

One-line Summary

URL Metadata API adds two $0.0005 x402 paid endpoints, filling gaps in JSON-LD cross-block consistency and SSL policy runtime probing.

Paragraph Summary

URL Metadata API has added two AI agent-oriented endpoints under the x402 protocol: /api/jsonld-cross-validate and /api/ssl-pinning-policy-probe, priced at $0.0005 each and settled in USDC on Base. The former parses cross-block @id references among multiple JSON-LD blocks, detecting type conflicts, inconsistent entity declarations, price and rating contradictions, date validity, and dead sameAs links, returning a 0-100 cross_block_score; the latter actively opens connections to ports 443, 80, and 8443 to verify HSTS, Expect-CT, HSTS preload list membership, and downgrade redirects, outputting a pinning_policy_score and verdict. In testing, stripe.com scored 97/A on JSON-LD validation but only 60/C on SSL probing, while github.com scored 70/C, showing that preload list membership does not equal a high score. Both endpoints return the standard 402 payment envelope and have completed end-to-end validation on real sites.