API reference
Use the current HTTP surfaces to discover the tool descriptor and submit a bounded RiskScan request. This reference documents the real request shape without inventing a payment or settlement result.
01 · Current routes
Two public, unauthenticated RiskScan HTTP boundaries
This reference covers RiskScan, not every application route. These descriptions are static: they do not run a request or expose private configuration values.
GET /api/tools
The default boundary returns the current tool descriptor, including only the payment metadata the host publishes. Read it before relying on a payment path.
POST /api/riskscan
The request boundary evaluates caller-supplied declarations for the current RiskScan Quick surface.
02 · Request shape
RiskScan Quick fields
The request shape has three top-level fields and one declarations object with four boolean fields.
Top-level fields
requestRefsubjectRefcontext
Required declarations
identity· booleanpricing· booleanlimitations· booleanevidence· boolean
03 · Boundary
Configuration and protocol limits
x402 configuration is host-specific. Native Hedera metadata uses hedera:testnet; if the host is not configured, the existing unavailable boundary can be returned.
A 402 boundary is not proof of a completed payment.
World and Provider actions are session-protected dashboard controls, not public integration endpoints. They use their own route and authority checks.
A public MCP endpoint is not part of the current local routes.
04 · Continue reading