Provider launch evidence

x402 Bazaar Launch Passport quickstart

Use this when you run an x402-paid endpoint and need to know whether paying agents can retrieve it by task. Ontario launch passports package readiness, Coinbase indexing preflight, five-query Bazaar retrieval, and public profile evidence. Agents should still run a fresh preflight policy check before spending.

Trust boundary

This workflow never asks for private keys or seed phrases. Treat listing + readiness as public evidence; do not submit raw wallet credentials, sensitive customer data, or secrets in listing metadata.

Step 1 — Run the free Bazaar buyer-intent audit

UI: /tools/coinbase-bazaar-readiness. The check runs Coinbase's read-only indexing preflight and five public searches from one concrete buyer task. It does not settle funds.

curl -X POST https://ontarioprotocol.com/api/tools/coinbase-bazaar-readiness \
  -H "Content-Type: application/json" \
  -d '{"target_url":"https://example.com/api/paid-endpoint","buyer_query":"get one concrete data result for my agent"}'

Step 2 — Reach grade=ready before you expect /discover inclusion

Challenge behavior

Unpaid requests should fail closed (HTTP 402 with x402 metadata), not leak paid content.

Manifest + schema

Publish /.well-known/x402.json and an OpenAPI document agents can parse.

Stable metadata

Use a consistent endpoint URL, method, price, network, and owner fields.

Repeatability

Rerun verification after fixes to create a fresh public report ID.

Practical checklist: /proof/x402-discovery-listing-checklist.

Step 3 — Prepare listing JSON (validate locally and via API)

Ontario exposes the canonical payload contract as a strict JSON Schema: /.well-known/x402-list-service.schema.json. Use the free validator endpoint before you run the paid listing call.

{
  "name": "Example Service",
  "description": "Paid endpoint for agents",
  "buyer_query": "get one concrete data result for my agent",
  "category": "data",
  "endpoint": "https://example.com/api/paid",
  "method": "POST",
  "price_usdc": "0.01",
  "network": "base",
  "owner_url": "https://example.com",
  "owner_contact": "ops@example.com",
  "tags": ["x402", "ai-agent"]
}
curl -sS https://ontarioprotocol.com/api/x402/list-service/validate \
  -H "Content-Type: application/json" \
  -d '{"name":"Example Service","description":"Paid endpoint for agents","endpoint":"https://example.com/api/paid","method":"POST","price_usdc":"0.01","network":"base","owner_url":"https://example.com","verify_now":true}' | jq .

With verify_now: true, the same free call returns signed readiness evidence and a grade-aware provider_publication object. When its decision is paid_publication_available, use the exact method, endpoint, and privacy-safe body in provider_publication.agent_checkout.prepared_request to probe the live HTTP 402 challenge. The validator does not store a listing or settle funds.

Step 4 — Rehearse the x402 listing flow in sandbox (no spend, no storage)

Use the sandbox rehearsal endpoint to test client behavior end-to-end. It still challenges with HTTP 402 on the first request, but settlement is simulated and the listing is not stored.

# 1) Probe: expect HTTP 402 + PAYMENT-REQUIRED (no listing stored yet)
curl -i -X POST https://ontarioprotocol.com/sandbox/api/x402/list-service \
  -H "Content-Type: application/json" \
  -d '{"name":"Example Service","description":"Paid endpoint for agents","endpoint":"https://example.com/api/paid","method":"POST","price_usdc":"0.01","network":"base","owner_url":"https://example.com"}'

The sandbox will accept any non-empty payload.signature field as “valid” to let you test client retry logic. This is not a production x402 payment signature.

# 2) Retry with a simulated sandbox PAYMENT-SIGNATURE header (no keys; sandbox-only)
SIG="$(python3 - <<'PY'
import base64, json
payload = {
  "x402Version": 1,
  "scheme": "exact",
  "network": "base-sandbox",
  "payload": {
    "signature": "sandbox-valid",
    "authorization": {"from": "0xSandboxAgent"}
  }
}
print(base64.b64encode(json.dumps(payload, separators=(",", ":"), sort_keys=True).encode("utf-8")).decode("ascii"))
PY
)"

curl -sS -X POST https://ontarioprotocol.com/sandbox/api/x402/list-service \
  -H "Content-Type: application/json" \
  -H "PAYMENT-SIGNATURE: ${SIG}" \
  -d '{"name":"Example Service","description":"Paid endpoint for agents","endpoint":"https://example.com/api/paid","method":"POST","price_usdc":"0.01","network":"base","owner_url":"https://example.com"}' | jq .

Sandbox tutorial: /docs/agent-commerce-sandbox.

SDK examples: ontario_list_service.py · ontario-list-service.ts

Step 5 — Publish the paid launch passport (production)

The first request should return HTTP 402 (no listing stored yet). Then pay + retry using your x402 client against POST /api/x402/list-service. The paid response contains the canonical profile, readiness evidence, sanitized CDP preflight, five-query retrieval snapshot, copy-ready distribution bundle, and 30 days of automatic freshness maintenance. If the readiness report grades ready and the evidence remains fresh, the endpoint can become eligible for /discover's default filters and Ontario's task-to-tool buyer search. Payment adds no ranking score.

curl -i -X POST https://ontarioprotocol.com/api/x402/list-service \
  -H "Content-Type: application/json" \
  -d '{"name":"Example Service","description":"Paid endpoint for agents","buyer_query":"get one concrete data result for my agent","endpoint":"https://example.com/api/paid","method":"POST","price_usdc":"0.01","network":"base","owner_url":"https://example.com"}'

After submission, check /listings and filter-ready discovery via /discover?grade=ready.

Repeat-purchase path

Refresh an existing paid profile for 0.10 USDC

Use this only after a paid profile exists and its included 30-day maintenance window has expired. The refresh runs a new live readiness scan, saves a signed report, and updates that profile's HTML, JSON twin, and badge. It cannot edit provider metadata, buy a better grade, reorder trust results, or guarantee traffic, strict discovery, purchases, or safety.

# Free validation: confirm the paid profile exists before any payment
curl -sS -X POST https://ontarioprotocol.com/api/x402/refresh-listing/validate \
  -H "Content-Type: application/json" \
  -d '{"listing_id":"lst_example"}' | jq .
# Probe: expect HTTP 402 for 0.10 USDC on Base
curl -i -X POST https://ontarioprotocol.com/api/x402/refresh-listing \
  -H "Content-Type: application/json" \
  -d '{"listing_id":"lst_example"}'

Pay and retry with your wallet-enabled x402 client only after the free validator returns ok: true. During the first 30 days, Ontario automatically refreshes stale launch-passport evidence and the validator withholds the paid path. After that, it enforces a one-hour cooldown between completed profile refreshes. If Ontario settles payment but cannot complete the scan, the response provides a one-use paid_refresh_tx retry path so the same job is not charged twice.

Optional — clearly labeled sponsored reach

Providers that need human-facing promotion can request the 30-day sponsored discovery pilot. Sponsored placement is advertising, remains visibly labeled, and never changes readiness scores, strict-discovery filters, badges, or machine-readable agent trust results.

Next

Agents should treat the listing as a pointer to evidence, not a permission slip. Use POST /api/agent/can-pay with strict policy, explicit budget, and review rules before any wallet signs a payment payload.

Provider handoff

Want fewer surprises before you list?

Use the free catalog scorecard to compare your endpoint, repository, and registry evidence. If the public evidence supports it, request a fixed-scope launch review. Ontario does not promise registry acceptance, ranking, traffic, or safety.

Check catalog evidence free See the launch pack Scope the $199 launch pack Check Bazaar activation free