BUYER QUICKSTART / BASE MAINNET

Make one bounded paid call.
Know every term first.

Andromalius uses x402 v2 to sell deterministic security reports for $0.01 or $0.02 in native Base USDC. Inspect the report format and live payment requirement before any wallet signs.

Inspect a free report ↗Open in x402scan ↗Build a policy-locked client →Buy with AgentCash →

01 / CHOOSE THE JOB

Pay only when the audit is useful.

CHALLENGE AUDIT$0.01

Check one x402 v2 payment requirement against the network, asset, payee, amount, scheme, resource, and timeout you expected.

View synthetic output ↗
DISCOVERY AUDIT$0.02

Check one OpenAPI 3.0 or 3.1 document for x402 pricing, payment metadata, request and response schemas, and discovery gaps.

View synthetic output ↗

02 / VERIFY BEFORE SIGNING

Reject a payment if one field differs.

Obtain the unsigned HTTP 402 first. Your wallet policy should independently match all of these values before it authorizes the retry.

Protocol
x402 v2 · exact
Network
Base · eip155:8453
Asset
Native USDC · 6 decimals
USDC contract
0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913
Receiving wallet
0x2ff7D9d400b27659F67EFd9E43D779D2bE5053c3
Maximum amount
10,000 or 20,000 atomic USDC

03 / COMPLETE THE CALL

Use a reviewed x402 v2 client.

The first request is payment-free and returns the live payment requirement. A reviewed client validates it, signs locally with an isolated low-balance wallet, retries the exact request, and requires both the report and settlement response.

  1. 01
    Inspect without a wallet

    Read the catalog, OpenAPI document, synthetic output, and unsigned 402.

  2. 02
    Set a hard local ceiling

    Allow only Base, native USDC, the published payee, and the chosen fixed price.

  3. 03
    Sign outside Andromalius

    Never send a private key, recovery phrase, wallet credential, or token allowance.

  4. 04
    Require delivery and settlement

    Do not automatically retry an ambiguous or missing payment result.

CHALLENGE AUDIT · UNSIGNED
curl -i -X POST \
  https://api.andromalius.io/v1/audit/challenge \
  -H 'content-type: application/json' \
  --data '{
    "paymentRequired": {
      "x402Version": 2,
      "resource": {
        "url": "https://merchant.example/v1/resource",
        "description": "Fixed synthetic resource",
        "mimeType": "application/json"
      },
      "accepts": [{
        "scheme": "exact",
        "network": "eip155:8453",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "amount": "10000",
        "payTo": "0x2ff7D9d400b27659F67EFd9E43D779D2bE5053c3",
        "maxTimeoutSeconds": 300,
        "extra": {}
      }]
    },
    "expected": {
      "scheme": "exact",
      "network": "eip155:8453",
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "payTo": "0x2ff7D9d400b27659F67EFd9E43D779D2bE5053c3",
      "maxAmountAtomic": "10000",
      "resourceUrl": "https://merchant.example/v1/resource",
      "maxTimeoutSeconds": 300
    }
  }'
DISCOVERY AUDIT · UNSIGNED
curl -i -X POST \
  https://api.andromalius.io/v1/audit/discovery \
  -H 'content-type: application/json' \
  --data '{"openapi":{"openapi":"3.1.0","info":{"title":"Example","version":"1.0.0"},"paths":{}}}'

Both bodies are complete synthetic inputs, not placeholders. The challenge fixture has matching policies; the empty discovery fixture intentionally reports PAID_OPERATIONS_MISSING. A finding is a completed audit result, not a payment failure. Andromalius never fetches merchant.example. These commands only inspect the price: a 402 does not validate your input. Before a separately approved paid retry, use a valid body and independently verify the live payment requirement.

Follow the AgentCash handoff →Copy the safe client boundary →Buy through the live listing ↗Official x402 buyer guide ↗

The commands above intentionally stop at the unsigned 402 and cannot authorize payment. Andromalius never connects to your wallet. United States business users age 18 or older only. Terms · Privacy · Refunds