OrionCMD Checks

Live 402 challenge

Captured by the enrichment pass, not read just now. Prices can change — always read the 402 the endpoint answers with.

{
  "error": "Payment required",
  "offer": {
    "asset": "USDC",
    "input": {
      "type": "http",
      "method": "GET",
      "queryParams": {
        "domain": "example.com"
      }
    },
    "price": "$2.00",
    "network": "eip155:8453",
    "mime_type": "application/json",
    "how_to_pay": "x402 v2: sign the accepts[0] requirement and retry with the PAYMENT-SIGNATURE header (challenge also in the PAYMENT-REQUIRED header). Invalid input is answered before payment and never charged.",
    "input_schema": {
      "type": "object",
      "required": [
        "type",
        "method"
      ],
      "properties": {
        "type": {
          "type": "string",
          "const": "http"
        },
        "method": {
          "enum": [
            "GET"
          ],
          "type": "string"
        },
        "queryParams": {
          "type": "object",
          "required": [
            "domain"
          ],
          "properties": {
            "domain": {
              "type": "string",
              "description": "Hostname or URL, e.g. example.com"
            }
          }
        }
      },
      "additionalProperties": false
    },
    "price_atomic": "2000000",
    "what_you_get": "Run a full website security audit with a prioritized fix list for a client or vendor review. $2 USDC on Base per call. Runs every OrionCMD check plus HTTPS redirect, www/apex, security.txt, robots.txt and sitemap. Returns the A-F grade, score and an action plan sorted critical to low. Don't use this for one quick check; single checks start at $0.01.",
    "output_schema": {
      "type": "object",
      "required": [
        "type"
      ],
      "properties": {
        "type": {
          "type": "string"
        },
        "example": {
          "type": "object"
        }
      }
    },
    "sample_output": {
      "domain": "example.com",
      "report": "full_site_audit",
      "summary": {
        "grade": "C",
        "score": 72,
        "points": "72/100",
        "partial": false,
        "headline": "No critical issues; 2 high-priority fixes.",
        "actions_by_priority": {
          "low": 4,
          "high": 2,
          "medium": 3,
          "critical": 0
        }
      },
      "sections": {
        "security_txt": {
          "present": false
        },
        "http_to_https": {
          "status": 301,
          "checked": true,
          "permanent": true,
          "redirects_to_https": true
        }
      },
      "categories": {
        "tls": {
          "max": 25,
          "score": 25
        }
      },
      "action_plan": [
        {
          "fix": "Publish TXT _dmarc.example.com = \"v=DMARC1; p=none; rua=mailto:dmarc@example.com\", read the reports for 2-4 weeks, then move to p=quarantine and p=reject.",
          "area": "email",
          "issue": "No DMARC record, so anyone can send mail as this domain and big mailbox providers may reject bulk mail.",
          "effort": "minutes",
          "priority": "high"
        }
      ]
    },
    "related_endpoints": [
      {
        "url": "https://api.orioncmd.com/v1/cert",
        "price": "$0.01",
        "method": "GET",
        "description": "Check a domain's SSL/TLS certificate expiry and renewal from CT logs. $0.01 USDC on Base per call. Returns issuer, validity, days left, % of lifetime used, renewal cadence and a renewal-stall heuristi"
      },
      {
        "url": "https://api.orioncmd.com/v1/dns",
        "price": "$0.01",
        "method": "GET",
        "description": "Check a domain's DNS records, DNSSEC, CAA, SPF and DMARC. $0.01 USDC on Base per call. Returns NS, A/AAAA/CNAME, MX, SPF, DMARC, CAA and DNSSEC via Cloudflare DoH, with plain-English findings and past"
      },
      {
        "url": "https://api.orioncmd.com/v1/expiry",
        "price": "$0.01",
        "method": "GET",
        "description": "When does a domain expire? Registration expiry and registrar via RDAP. $0.01 USDC on Base per call. Returns registrar, registration and expiry dates, days left, EPP status and nameservers. Within 60 d"
      },
      {
        "url": "https://api.orioncmd.com/v1/email-auth",
        "price": "$0.01",
        "method": "GET",
        "description": "Check a domain's email authentication: SPF, DMARC, DKIM, MTA-STS, TLS-RPT and BIMI. $0.01 USDC on Base per call. Returns SPF validity and lookup count (limit 10), DMARC policy/pct/rua, DKIM on common "
      },
      {
        "url": "https://api.orioncmd.com/v1/headers",
        "price": "$0.01",
        "method": "GET",
        "description": "Check a website's HTTP security headers and redirect chain. $0.01 USDC on Base per call. One HTTPS GET returns the redirect chain, final status, HSTS, CSP, X-Frame-Options and other headers, a simple "
      },
      {
        "url": "https://api.orioncmd.com/v1/domain-grade",
        "price": "$0.03",
        "method": "GET",
        "description": "Get a domain security grade A-F with a per-category breakdown. $0.03 USDC on Base per call. Returns one A-F grade, a 0-100 score, points per category (TLS 25, email auth 25, headers 20, DNS 15, expiry"
      },
      {
        "url": "https://api.orioncmd.com/v1/site-health",
        "price": "$0.03",
        "method": "GET",
        "description": "Check a domain's certificate, DNS and expiry together in one call. $0.03 USDC on Base per call. Returns a summary, the renewal-stall heuristic, the Let's Encrypt 64-day (2027-02-10) note and fixes[] w"
      },
      {
        "url": "https://api.orioncmd.com/v1/threat-check",
        "price": "$0.02",
        "method": "GET",
        "description": "Is this domain malicious or named by ransomware? Domain threat check. $0.02 USDC on Base per call. Matches the hostname, parent domains and resolved IPv4 against ThreatCluster's high-confidence 30-day"
      },
      {
        "url": "https://api.orioncmd.com/v1/bulk-threat-check",
        "price": "$0.50",
        "method": "GET",
        "description": "Check up to 100 domains or IPv4 addresses against a threat IOC feed in one call. $0.5 USDC on Base per call. Resolves each domain and matches names, parent domains and IPv4 against ThreatCluster's hig"
      },
      {
        "url": "https://api.orioncmd.com/v1/watch",
        "price": "$0.30",
        "method": "POST",
        "description": "OrionCMD Checks: Prepaid domain threat watch: up to 25 domains for 30 days, webhook alerts. Pay once; each domain is re-checked about once a day for 30 days. You get an HMAC-signed JSON POST at your h"
      }
    ]
  },
  "accepts": [
    {
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "extra": {
        "name": "USD Coin",
        "version": "2"
      },
      "payTo": "0x2dAF658B01e257206375798a15832E9f547D65dD",
      "amount": "2000000",
      "scheme": "exact",
      "network": "eip155:8453",
      "maxTimeoutSeconds": 120
    }
  ],
  "resource": {
    "url": "https://api.orioncmd.com/v1/audit-report",
    "tags": [
      "site-audit",
      "security-audit",
      "vendor-review",
      "action-plan",
      "msp"
    ],
    "mimeType": "application/json",
    "description": "Run a full website security audit with a prioritized fix list for a client or vendor review. $2 USDC on Base per call. Runs every OrionCMD check plus HTTPS redirect, www/apex, security.txt, robots.txt and sitemap. Returns the A-F grade, score and an action plan sorted critical to low. Don't use this for one quick check; single checks start at $0.01.",
    "serviceName": "OrionCMD Checks"
  },
  "extensions": {
    "bazaar": {
      "info": {
        "input": {
          "type": "http",
          "method": "GET",
          "queryParams": {
            "domain": "example.com"
          }
        },
        "output": {
          "type": "json",
          "example": {
            "domain": "example.com",
            "report": "full_site_audit",
            "summary": {
              "grade": "C",
              "score": 72,
              "points": "72/100",
              "partial": false,
              "headline": "No critical issues; 2 high-priority fixes.",
              "actions_by_priority": {
                "low": 4,
                "high": 2,
                "medium": 3,
                "critical": 0
              }
            },
            "sections": {
              "security_txt": {
                "present": false
              },
              "http_to_https": {
                "status": 301,
                "checked": true,
                "permanent": true,
                "redirects_to_https": true
              }
            },
            "categories": {
              "tls": {
                "max": 25,
                "score": 25
              }
            },
            "action_plan": [
              {
                "fix": "Publish TXT _dmarc.example.com = \"v=DMARC1; p=none; rua=mailto:dmarc@example.com\", read the reports for 2-4 weeks, then move to p=quarantine and p=reject.",
                "area": "email",
                "issue": "No DMARC record, so anyone can send mail as this domain and big mailbox providers may reject bulk mail.",
                "effort": "minutes",
                "priority": "high"
              }
            ]
          }
        }
      },
      "schema": {
        "type": "object",
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "required": [
          "input"
        ],
        "properties": {
          "input": {
            "type": "object",
            "required": [
              "type",
              "method"
            ],
            "properties": {
              "type": {
                "type": "string",
                "const": "http"
              },
              "method": {
                "enum": [
                  "GET"
                ],
                "type": "string"
              },
              "queryParams": {
                "type": "object",
                "required": [
                  "domain"
                ],
                "properties": {
                  "domain": {
                    "type": "string",
                    "description": "Hostname or URL, e.g. example.com"
                  }
                }
              }
            },
            "additionalProperties": false
          },
          "output": {
            "type": "object",
            "required": [
              "type"
            ],
            "properties": {
              "type": {
                "type": "string"
              },
              "example": {
                "type": "object"
              }
            }
          }
        }
      }
    }
  },
  "x402Version": 2
}

Accepts

The payment requirements as published to the catalog. Read the live 402 before paying — a price here is a claim, not a quote.

[
  {
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "extra": {
      "name": "USD Coin",
      "version": "2"
    },
    "payTo": "0x2dAF658B01e257206375798a15832E9f547D65dD",
    "amount": "2000000",
    "scheme": "exact",
    "network": "eip155:8453",
    "maxTimeoutSeconds": 120
  }
]

Extensions

{
  "bazaar": {
    "info": {
      "input": {
        "type": "http",
        "method": "GET",
        "queryParams": {
          "domain": "example.com"
        }
      },
      "output": {
        "type": "json",
        "example": {
          "domain": "example.com",
          "report": "full_site_audit",
          "summary": {
            "grade": "C",
            "score": 72,
            "points": "72/100",
            "partial": false,
            "headline": "No critical issues; 2 high-priority fixes.",
            "actions_by_priority": {
              "low": 4,
              "high": 2,
              "medium": 3,
              "critical": 0
            }
          },
          "sections": {
            "security_txt": {
              "present": false
            },
            "http_to_https": {
              "status": 301,
              "checked": true,
              "permanent": true,
              "redirects_to_https": true
            }
          },
          "categories": {
            "tls": {
              "max": 25,
              "score": 25
            }
          },
          "action_plan": [
            {
              "fix": "Publish TXT _dmarc.example.com = \"v=DMARC1; p=none; rua=mailto:dmarc@example.com\", read the reports for 2-4 weeks, then move to p=quarantine and p=reject.",
              "area": "email",
              "issue": "No DMARC record, so anyone can send mail as this domain and big mailbox providers may reject bulk mail.",
              "effort": "minutes",
              "priority": "high"
            }
          ]
        }
      }
    },
    "schema": {
      "type": "object",
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "required": [
        "input"
      ],
      "properties": {
        "input": {
          "type": "object",
          "required": [
            "type",
            "method"
          ],
          "properties": {
            "type": {
              "type": "string",
              "const": "http"
            },
            "method": {
              "enum": [
                "GET"
              ],
              "type": "string"
            },
            "queryParams": {
              "type": "object",
              "required": [
                "domain"
              ],
              "properties": {
                "domain": {
                  "type": "string",
                  "description": "Hostname or URL, e.g. example.com"
                }
              }
            }
          },
          "additionalProperties": false
        },
        "output": {
          "type": "object",
          "required": [
            "type"
          ],
          "properties": {
            "type": {
              "type": "string"
            },
            "example": {
              "type": "object"
            }
          }
        }
      }
    }
  }
}

Provenance

Seen in the source catalog

2026-10-24 15:00Z

Last indexed by Roundhouse

2026-10-26 20:00Z

Last enriched (probe, favicon, geo)

2026-10-24 19:16Z

x402 version

2

Max timeout

120s

Liveness probe

HTTP 402