Vouch
Endpoints
| Method | Path | What you get |
|---|---|---|
| GET / HEAD / OPTIONS | /vet_agent |
402 payment challenge |
| POST | /vet_agent |
Paid report |
| GET | /sample |
Free self-audit + request schema |
| GET | /schema |
Request / response contract |
| GET | /health |
Liveness + marketplace resolve |
| GET / HEAD / OPTIONS | /audit_contract |
402 payment challenge (Erinyes) |
| POST | /audit_contract |
Paid Erinyes report |
| GET | /audit_sample |
Free run on a known-vulnerable fixture |
Preferred request
Send a marketplace agent id. Vouch resolves identity server-side.
POST /vet_agent
X-PAYMENT: <base64 x402 payload>
{ "agent_id": "6086" }If server-side resolve is down, send a snapshot instead so a missing JWT cannot brick a paid call:
{
"agent_id": "6086",
"agent": { "agentId": "6086", "ownerAddress": "0x…", "createdAt": 1783835043299 },
"reviews": { "list": [], "distribution": {}, "total": 0 }
}Payment
x402 exact + aggr_deferred on eip155:196 (X Layer), settled
through the OKX facilitator. The PAYMENT-REQUIRED header
carries the base64 requirements JSON — validators read the header, not
the body.
Business errors return 400 / 404. 402 is reserved for payment challenge. Vouch never settles on an unresolvable id.
What the score is
Deterministic. A pure function of evaluated + triggered signals. Checks
that could not run are not_evaluated — never a silent pass.
The model never touches the numbers.
- Listing age, security rating, sales history, online status
- Owner wallet outbound activity + reuse across listings
- Wallet age under 7d (only when first-seen is available)
- Self-review (reviewer wallet == owner wallet)
- Coordinated review timing (≥5 low-activity reviewers in 2h)
- Review data integrity
- Live endpoint probe: unpaid GET, then POST if needed
Erinyes request
Paste source. Or an address + chain, and Vouch will try Sourcify before charging.
POST /audit_contract
X-PAYMENT: <base64 x402 payload>
{
"name": "Vault",
"source": "pragma solidity ^0.8.0; contract Vault { ... }"
}The scanner always runs. The LLM pass (Agent Router → Claude) runs only when a key is configured. Findings need a seam. Everything else is a lead.