---
title: "x402 Domain & Nonce Window Checker"
method: POST
path: "/v1/tools/check_x402_domain_nonce_window"
tags: ["compliance_control", "x402", "eip-712", "eip-3009", "domain-separation", "nonce-check", "mcp:check_x402_domain_nonce_window"]
---

# x402 Domain & Nonce Window Checker

`POST /v1/tools/check_x402_domain_nonce_window`

## Request

- Base URL: `https://ainumbers.co`
- URL: `https://ainumbers.co/v1/tools/check_x402_domain_nonce_window`
- Auth: none declared

Checks an EIP-3009 TransferWithAuthorization's domain separation and replay-defense-adjacent fields against caller-supplied expectations. expected_chain_id and expected_verifying_contract are mandatory policy parameters, separate from the chainId/verifyingContract actually baked into the signed domain -- a mismatch on either is a hard refuse, never a soft warning (the cross-domain replay defect EIP-712 domain separation exists to prevent). Also checks the validAfter/validBefore window against a caller-supplied now_unix, and the nonce's format (bytes32, non-zero). Accepts an optional caller-supplied nonce_already_used boolean; this kernel never queries a chain -- on-chain nonce uniqueness is enforced by the token contract at settlement time, not by this verifier. Zero network calls; never a facilitator, proxy, or settlement relay.

**Tool URL:** https://ainumbers.co/chaingraph/art-592-x402-domain-nonce-window-checker.html

## Request body

- object
  - `expected_chain_id` number
  - `expected_verifying_contract` string
  - `chainId` number
  - `verifyingContract` string
  - `validAfter` number
  - `validBefore` number
  - `now_unix` number
  - `nonce` string
  - `nonce_already_used` boolean

## Response `200`

Successful tool execution result

- object
  - `verdict` string
  - `reasons` string[]
  - `expected` object
    - `expected_chain_id` string, nullable
    - `expected_verifying_contract` string, nullable
  - `signed_domain` object
    - `chain_id` string, nullable
    - `verifying_contract` string, nullable
  - `domain_chain_match` boolean, nullable
  - `domain_contract_match` boolean, nullable
  - `window` object
    - `valid_after` string, nullable
    - `valid_before` string, nullable
    - `now_unix` string, nullable
  - `authorization_within_window` boolean, nullable
  - `authorization_expired` boolean, nullable
  - `authorization_not_yet_valid` boolean, nullable
  - `nonce` string, nullable
  - `nonce_well_formed` boolean, nullable
  - `nonce_already_used` boolean, nullable
  - `disclosure` string

---

[API](https://skmtc.dev/ainumbers/apis/ainumbers-co-fintech-intelligence-suite.md) · [All operations](https://skmtc.dev/ainumbers/apis/ainumbers-co-fintech-intelligence-suite/llms.txt) · [OpenAPI document](https://skmtc.dev/ainumbers/apis/ainumbers-co-fintech-intelligence-suite/revisions/b462e4f5bb28?raw)