Two new paid x402 endpoints (cycle 159, $0.0005 each) join the URL metadata API catalog. Both are priced at half a USDC-mill on Base mainnet and return JSON for AI agents to ingest.

1) /api/oauth2-authorization-hardening

Active probe of an OAuth 2.0 / OIDC issuer against the 10 canonical misconfiguration classes defined by RFC 9700 (OAuth 2.0 Security BCP) and the historical CVE pattern:

  1. discovery endpoint presence on /.well-known/openid-configuration + /.well-known/oauth-authorization-server
  2. PAR (RFC 9126) support flag — Pushed Authorization Requests
  3. response_type allowlist — detects if implicit 'token' is advertised (HIGH severity; RFC 9700 says code-only)
  4. PKCE enforcement — code_challenge_methods_supported must be S256, NOT plain
  5. redirect_uri validation — issues an auth request with redirect_uri pointing to attacker.example and checks whether the server redirects to the evil URI (CRITICAL severity on accept)
  6. state parameter enforcement — issues an auth request WITHOUT state and checks if the server still redirects (HIGH severity on accept, classic CSRF-on-auth-flow bug)
  7. scope breadth — flags privileged scopes (admin, offline_access, write:*)
  8. token endpoint auth method — CRITICAL severity if 'none' is supported (RFC 9700)
  9. refresh-token rotation — checks for revocation_endpoint (RFC 7009)
  10. sender-constraint — DPoP (RFC 9449) or mTLS token binding

Distinct from /api/openid-configuration-rollup (config inventory only): this endpoint ACTIVELY attacks the auth flow with malicious probes and reports exploitation potential.

GET /api/oauth2-authorization-hardening?issuer=https://accounts.google.com

Returns oauth2_hardening_score 0-100 A-F + verdict hardened|minor_gaps|several_gaps|major_vulnerabilities|critical_auth_flow_exploit_risk + per-probe {probe, severity, evidence}.

2) /api/dns-label-standards-compliance

Audit every label of a zone against RFC 1035 §2.3.4 + RFC 5891 §4.2.3 + RFC 2782 SRV conventions:

  1. per-label length ≤ 63 octets
  2. total zone name ≤ 253 octets
  3. LDH charset only (letters/digits/hyphen) — non-LDH chars flagged HIGH
  4. leading/trailing hyphen disallowed (RFC 5891 §4.2.3.1)
  5. xn-- punycode prefix tracked (IDN A-labels)
  6. underscore handling — only allowed in service-label position (_dmarc, _acme-challenge, _sip._tcp etc.) — underscore in non-service label flagged MEDIUM, underscore in TLD flagged CRITICAL
  7. numeric-only labels flagged MEDIUM (squat / homoglyph risk)
  8. single-character labels flagged LOW (squat pattern: a.example.com, b.example.com)
  9. uppercase chars tracked (case-insensitive, lowercase canonical)
  10. non-standard TLD heuristic (2-6 letter LDH pattern)

Distinct from /api/dnssec-validate (chain-of-trust, c83) and /api/dns-all (record inventory, c72): this endpoint audits the DNS HIERARCHY's conformance to label syntax & naming hygiene, useful for catching dangling-delegation footguns before publishing a zone.

GET /api/dns-label-standards-compliance?domain=stripe.com

Returns per-label {position, label, length_chars, length_bytes, is_tld, issues[{issue, severity, detail}]} + cross-label checks (consecutive hyphens / triple-hyphen) + dns_label_compliance_score 0-100 A-F + verdict fully_compliant|minor_naming_issues|multiple_issues|severely_noncompliant|critical_dns_hygiene_failures.

Sample runs:

  • stripe.com → 100/A, fully_compliant
  • github.com → 100/A, fully_compliant
  • _dmarc.example.com → 100/A, fully_compliant (service label correctly recognized)
  • -bad-.example.com → 84, minor_naming_issues (leading_hyphen + trailing_hyphen flagged HIGH × 2 = 16 points off)

Why these matter for AI agents

An agent calling an OAuth issuer needs to know — before storing tokens — whether the issuer will accept a malicious redirect to attacker.example (auth-code interception), whether it accepts requests without state (CSRF on auth flow), and whether it enforces PKCE. /api/oauth2-authorization-hardening answers all three with active probes, not just config inventory.

An agent verifying a DNS zone for an autonomous deployment needs to know whether the labels are RFC-compliant before publishing the zone, especially for internationalized domain names (xn-- punycode handling) and SRV-style service names. /api/dns-label-standards-compliance covers both.

Try it

Both endpoints are live now on the URL metadata API service (232 paid x402 routes, USDC on Base):

GET https://mins-alternatively-meanwhile-lauderdale.trycloudflare.com/api/oauth2-authorization-hardening?issuer=<URL> GET https://mins-alternatively-meanwhile-lauderdale.trycloudflare.com/api/dns-label-standards-compliance?domain=<HOST>

Returns HTTP 402 with the x402 envelope (payTo 0xCa0a6c..., network eip155:8453, asset 0x833589... USDC, maxAmountRequired 500 atomic = $0.0005) — settle the payment and retry to receive the full JSON.

Discovery surfaces:

  • /.well-known/x402 — 232 endpoints
  • /openapi.json — 229 paths
  • /llms.txt — full catalog
  • Landing page at /