Unpaid requests should fail closed (HTTP 402 with x402 metadata), not leak paid content.
x402 Bazaar Launch Passport quickstart
Use this when you run an x402-paid endpoint and need to know whether paying agents can retrieve it by task. Ontario launch passports package readiness, Coinbase indexing preflight, five-query Bazaar retrieval, and public profile evidence. Agents should still run a fresh preflight policy check before spending.
Trust boundary
This workflow never asks for private keys or seed phrases. Treat listing + readiness as public evidence; do not submit raw wallet credentials, sensitive customer data, or secrets in listing metadata.
Step 1 — Run the free Bazaar buyer-intent audit
UI: /tools/coinbase-bazaar-readiness. The check runs Coinbase's read-only indexing preflight and five public searches from one concrete buyer task. It does not settle funds.
curl -X POST https://ontarioprotocol.com/api/tools/coinbase-bazaar-readiness \
-H "Content-Type: application/json" \
-d '{"target_url":"https://example.com/api/paid-endpoint","buyer_query":"get one concrete data result for my agent"}'
Step 2 — Reach grade=ready before you expect /discover inclusion
Publish /.well-known/x402.json and an OpenAPI document agents can parse.
Use a consistent endpoint URL, method, price, network, and owner fields.
Rerun verification after fixes to create a fresh public report ID.
Practical checklist: /proof/x402-discovery-listing-checklist.
Step 3 — Prepare listing JSON (validate locally and via API)
Ontario exposes the canonical payload contract as a strict JSON Schema:
/.well-known/x402-list-service.schema.json.
Use the free validator endpoint before you run the paid listing call.
{
"name": "Example Service",
"description": "Paid endpoint for agents",
"buyer_query": "get one concrete data result for my agent",
"category": "data",
"endpoint": "https://example.com/api/paid",
"method": "POST",
"price_usdc": "0.01",
"network": "base",
"owner_url": "https://example.com",
"owner_contact": "ops@example.com",
"tags": ["x402", "ai-agent"]
}
curl -sS https://ontarioprotocol.com/api/x402/list-service/validate \
-H "Content-Type: application/json" \
-d '{"name":"Example Service","description":"Paid endpoint for agents","endpoint":"https://example.com/api/paid","method":"POST","price_usdc":"0.01","network":"base","owner_url":"https://example.com","verify_now":true}' | jq .
With verify_now: true, the same free call returns signed readiness evidence and a
grade-aware provider_publication object. When its decision is
paid_publication_available, use the exact method, endpoint, and privacy-safe body in
provider_publication.agent_checkout.prepared_request to probe the live HTTP 402 challenge. The validator does
not store a listing or settle funds.
Step 4 — Rehearse the x402 listing flow in sandbox (no spend, no storage)
Use the sandbox rehearsal endpoint to test client behavior end-to-end. It still challenges with HTTP 402 on the first request, but settlement is simulated and the listing is not stored.
# 1) Probe: expect HTTP 402 + PAYMENT-REQUIRED (no listing stored yet)
curl -i -X POST https://ontarioprotocol.com/sandbox/api/x402/list-service \
-H "Content-Type: application/json" \
-d '{"name":"Example Service","description":"Paid endpoint for agents","endpoint":"https://example.com/api/paid","method":"POST","price_usdc":"0.01","network":"base","owner_url":"https://example.com"}'
The sandbox will accept any non-empty payload.signature field as “valid” to let you test client retry logic.
This is not a production x402 payment signature.
# 2) Retry with a simulated sandbox PAYMENT-SIGNATURE header (no keys; sandbox-only)
SIG="$(python3 - <<'PY'
import base64, json
payload = {
"x402Version": 1,
"scheme": "exact",
"network": "base-sandbox",
"payload": {
"signature": "sandbox-valid",
"authorization": {"from": "0xSandboxAgent"}
}
}
print(base64.b64encode(json.dumps(payload, separators=(",", ":"), sort_keys=True).encode("utf-8")).decode("ascii"))
PY
)"
curl -sS -X POST https://ontarioprotocol.com/sandbox/api/x402/list-service \
-H "Content-Type: application/json" \
-H "PAYMENT-SIGNATURE: ${SIG}" \
-d '{"name":"Example Service","description":"Paid endpoint for agents","endpoint":"https://example.com/api/paid","method":"POST","price_usdc":"0.01","network":"base","owner_url":"https://example.com"}' | jq .
Sandbox tutorial: /docs/agent-commerce-sandbox.
SDK examples: ontario_list_service.py ·
ontario-list-service.ts
Step 5 — Publish the paid launch passport (production)
The first request should return HTTP 402 (no listing stored yet). Then pay + retry using your x402 client against
POST /api/x402/list-service. The paid response contains the
canonical profile, readiness evidence, sanitized CDP preflight, five-query retrieval snapshot,
copy-ready distribution bundle, and 30 days of automatic freshness maintenance. If the readiness report grades
ready and the evidence remains fresh, the endpoint can become eligible for
/discover's default filters and Ontario's task-to-tool buyer search. Payment adds no ranking score.
curl -i -X POST https://ontarioprotocol.com/api/x402/list-service \
-H "Content-Type: application/json" \
-d '{"name":"Example Service","description":"Paid endpoint for agents","buyer_query":"get one concrete data result for my agent","endpoint":"https://example.com/api/paid","method":"POST","price_usdc":"0.01","network":"base","owner_url":"https://example.com"}'
After submission, check /listings and filter-ready discovery via
/discover?grade=ready.
Refresh an existing paid profile for 0.10 USDC
Use this only after a paid profile exists and its included 30-day maintenance window has expired. The refresh runs a new live readiness scan, saves a signed report, and updates that profile's HTML, JSON twin, and badge. It cannot edit provider metadata, buy a better grade, reorder trust results, or guarantee traffic, strict discovery, purchases, or safety.
# Free validation: confirm the paid profile exists before any payment
curl -sS -X POST https://ontarioprotocol.com/api/x402/refresh-listing/validate \
-H "Content-Type: application/json" \
-d '{"listing_id":"lst_example"}' | jq .
# Probe: expect HTTP 402 for 0.10 USDC on Base
curl -i -X POST https://ontarioprotocol.com/api/x402/refresh-listing \
-H "Content-Type: application/json" \
-d '{"listing_id":"lst_example"}'
Pay and retry with your wallet-enabled x402 client only after the free validator returns ok: true.
During the first 30 days, Ontario automatically refreshes stale launch-passport evidence and the validator
withholds the paid path. After that, it enforces a one-hour cooldown between completed profile refreshes.
If Ontario settles payment but cannot complete the scan, the response provides a one-use
paid_refresh_tx retry path so the same job is not charged twice.
Optional — clearly labeled sponsored reach
Providers that need human-facing promotion can request the 30-day sponsored discovery pilot. Sponsored placement is advertising, remains visibly labeled, and never changes readiness scores, strict-discovery filters, badges, or machine-readable agent trust results.
Next
Agents should treat the listing as a pointer to evidence, not a permission slip. Use
POST /api/agent/can-pay with strict policy, explicit budget,
and review rules before any wallet signs a payment payload.
Want fewer surprises before you list?
Use the free catalog scorecard to compare your endpoint, repository, and registry evidence. If the public evidence supports it, request a fixed-scope launch review. Ontario does not promise registry acceptance, ranking, traffic, or safety.
Check catalog evidence free See the launch pack Scope the $199 launch pack Check Bazaar activation free