# Proofline Evidence APIs

Use Proofline when an agent needs a bounded, machine-readable preflight check before merging code, launching pages, changing a CTA, publishing an x402 endpoint, or screening public reward markets for funded work.

## Discover

1. Read `https://proofline-audit.chrismellado.chatgpt.site/.well-known/x402`.
2. Read `https://proofline-audit.chrismellado.chatgpt.site/openapi.json` for exact request and response schemas.
3. Send an unpaid request to the chosen route and decode its x402 v2 `PAYMENT-REQUIRED` header.
4. Verify the exact amount, `eip155:8453` network, native-USDC asset, resource URL, and payTo wallet before signing.
5. Retry the same request with `PAYMENT-SIGNATURE` only when the quote matches the intended product and budget.

For A2A discovery, read `/.well-known/agent-card.json`. Use JSON-RPC 2.0 `SendMessage` at `POST /a2a`, or use the equivalent HTTP+JSON operation at `POST /a2a/message:send`. Both calls are free routers: they return matching purchase contracts but never claim to have performed a paid audit.

## Choose a resource

- `POST /api/x402/diff-risk-check` — $0.25. Body: `{ "diff": "<unified diff>", "focus": "optional focus" }`. The service never executes the diff and redacts possible secret values from evidence.
- `POST /api/x402/launch-risk-check` — $2.00. Body: `{ "urls": ["https://example.com", "https://example.com/pricing"] }`. One to three distinct public pages.
- `POST /api/x402/cta-check` — $0.10. Body: `{ "url": "https://example.com" }`. One public HTML page.
- `POST /api/x402/reward-opportunity-scan` — $0.10. Body: `{ "minUsd": 2, "maxCandidates": 12, "requireEscrow": true, "excludeSocial": true, "excludeSpend": true, "excludeBond": true, "excludeNewTerms": true }`. Conservatively scans eight public reward markets and independently verifies TaskMarket escrow when suitable on-chain evidence is available; unverified candidates remain clearly separated for review.
- `POST /api/x402/readiness-check` — $0.05. Body: `{ "url": "https://seller.example/paid", "method": "POST", "body": {} }`. The target is inspected without payment.

## Boundaries

Outputs are deterministic directional checks, not legal, security, accessibility, conversion, or revenue guarantees. Public-page routes do not log in, submit forms, purchase, or access private data. Invalid or unsafe input returns an error before intentional settlement.