api.zfinia.com

Live 402 challenge

Captured by the enrichment pass, not read just now. Prices can change — always read the 402 the endpoint answers with.

{
  "error": "Payment required",
  "accepts": [
    {
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "extra": {
        "name": "USD Coin",
        "version": "2"
      },
      "payTo": "0x25e8245f07d5e4873987293dad666afbe56a9608",
      "amount": "300000",
      "scheme": "exact",
      "network": "eip155:8453",
      "maxTimeoutSeconds": 60
    }
  ],
  "resource": {
    "url": "https://api.zfinia.com/x402/v1/oauth-client-registration-audit",
    "tags": [
      "identity",
      "oauth",
      "security configuration",
      "misconfiguration detection",
      "developer tooling"
    ],
    "mimeType": "application/json",
    "description": "Audit an OAuth client registration. Reports a wildcard redirect URI, where any matching host receives authorization codes; a plaintext redirect outside loopback; a registered URI that carries its own redirect parameter, so a code can be forwarded off the client's origin while still matching; the implicit and password grants; a public client registering a grant that needs a secret; and a client secret committed into the registration document itself. No secret value is ever reported.",
    "serviceName": "OAuth Client Registration"
  },
  "extensions": {
    "bazaar": {
      "info": {
        "input": {
          "body": {
            "client": {
              "client_id": "web-dashboard",
              "client_name": "Example Dashboard",
              "grant_types": [
                "authorization_code",
                "implicit",
                "client_credentials"
              ],
              "client_secret": "redacted-example-value-not-a-real-secret",
              "redirect_uris": [
                "https://*.example.com/oauth/callback",
                "http://dashboard.example.com/oauth/callback",
                "https://dashboard.example.com/oauth/callback?returnTo=%2Fhome",
                "https://dashboard.example.com/"
              ],
              "response_types": [
                "code",
                "token"
              ],
              "token_endpoint_auth_method": "none"
            }
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json"
        },
        "output": {
          "type": "json",
          "example": {
            "limits": {
              "maxKeys": 100,
              "maxFindings": 500,
              "maxRedirectUris": 100,
              "maxDocumentBytes": 262144,
              "minRsaModulusBits": 2048,
              "maxTokenLifetimeSeconds": 28800
            },
            "passed": false,
            "complete": false,
            "findings": [
              {
                "code": "REDIRECT_URI_WILDCARD",
                "detail": "https://*.example.com/oauth/callback: A wildcard in a registered redirect URI means any host or path matching the pattern receives authorization codes.",
                "redirect_uri": "https://*.example.com/oauth/callback"
              },
              {
                "code": "REDIRECT_URI_PLAINTEXT_HTTP",
                "detail": "http://dashboard.example.com/oauth/callback: A plaintext redirect carries the authorization code over the network in the clear.",
                "redirect_uri": "http://dashboard.example.com/oauth/callback"
              },
              {
                "code": "REDIRECT_URI_FORWARDS_ELSEWHERE",
                "detail": "https://dashboard.example.com/oauth/callback?returnTo=%2Fhome: This URI carries its own redirect parameter, so a code delivered to it can be forwarded off the client's origin while still matching the ...",
                "redirect_uri": "https://dashboard.example.com/oauth/callback?returnTo=%2Fhome"
              }
            ],
            "client_id": "web-dashboard",
            "request_id": "example-request",
            "service_id": "oauth_client_registration_audit",
            "assumptions": [
              "A client is treated as public when token_endpoint_auth_method is none, which is what makes a bare-origin redirect and a missing PKCE declaration worth reporting.",
              "A plaintext redirect to a loopback host is permitted, because that is how a native client receives a code during development.",
              "A custom scheme is recorded as not examined rather than reported: it is normal for a native client and cannot be exclusively claimed on most platforms, so safety is not decidable from the registration..."
            ],
            "grant_types": [
              "authorization_code",
              "implicit",
              "client_credentials"
            ],
            "limitations": [
              "No signature is verified and no cryptographic operation is performed. These findings are about declared configuration, so a verdict is never a statement that a token or document is authentic.",
              "Nothing is fetched. The documents are supplied, so an arbitrary provider or client can be audited without a credential and without the provider being contacted.",
              "No client secret value, and no part of one, appears in any finding."
            ],
            "observed_at": "2026-10-02T00:00:00.000Z",
            "not_examined": [
              "PUBLIC_CLIENT_PKCE_NOT_DECLARED: This is a public client using the authorization code grant and the registration does not declare a code_challenge_method. PKCE may still be enforced by the provider, w..."
            ],
            "finding_count": 7,
            "response_types": [
              "code",
              "token"
            ],
            "service_version": "1.0.0",
            "findings_by_code": {
              "REDIRECT_URI_WILDCARD": 1,
              "REDIRECT_URI_BARE_ORIGIN": 1,
              "IMPLICIT_GRANT_REGISTERED": 1,
              "REDIRECT_URI_PLAINTEXT_HTTP": 1,
              "REDIRECT_URI_FORWARDS_ELSEWHERE": 1,
              "CLIENT_SECRET_PRESENT_IN_DOCUMENT": 1,
              "PUBLIC_CLIENT_WITH_CLIENT_CREDENTIALS": 1
            },
            "is_public_client": true,
            "safe_registration": false,
            "redirect_uri_count": 4,
            "token_endpoint_auth_method": "none"
          }
        }
      },
      "schema": {
        "type": "object",
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "required": [
          "input"
        ],
        "properties": {
          "input": {
            "type": "object",
            "required": [
              "type",
              "method",
              "bodyType",
              "body"
            ],
            "properties": {
              "body": {
                "type": "object",
                "required": [
                  "client"
                ],
                "properties": {
                  "client": {
                    "type": "object"
                  }
                },
                "additionalProperties": false
              },
              "type": {
                "type": "string",
                "const": "http"
              },
              "method": {
                "enum": [
                  "POST"
                ],
                "type": "string"
              },
              "bodyType": {
                "enum": [
                  "json",
                  "form-data",
                  "text"
                ],
                "type": "string"
              }
            },
            "additionalProperties": false
          },
          "output": {
            "type": "object",
            "required": [
              "type"
            ],
            "properties": {
              "type": {
                "type": "string"
              },
              "example": {
                "type": "object"
              }
            }
          }
        }
      }
    }
  },
  "x402Version": 2
}

Accepts

The payment requirements as published to the catalog. Read the live 402 before paying — a price here is a claim, not a quote.

[
  {
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "extra": {
      "name": "USD Coin",
      "version": "2"
    },
    "payTo": "0x25e8245f07d5e4873987293dad666afbe56a9608",
    "scheme": "exact",
    "network": "eip155:8453",
    "mimeType": "application/json",
    "resource": "https://api.zfinia.com/x402/v1/oauth-client-registration-audit",
    "description": "",
    "maxAmountRequired": "300000",
    "maxTimeoutSeconds": 60
  }
]

Provenance

Seen in the source catalog

2026-10-05 02:07Z

Last indexed by Roundhouse

2026-10-06 19:46Z

Last enriched (probe, favicon, geo)

2026-10-06 19:16Z

x402 version

1

Max timeout

60s

Liveness probe

HTTP 402