---
title: "Pay for and execute a bounded pre-transaction scan"
method: POST
path: "/api/x402/scan"
tags: ["Verification Records"]
---

# Pay for and execute a bounded pre-transaction scan

`POST /api/x402/scan`

## Request

- Base URL: `https://flint.network`
- URL: `https://flint.network/api/x402/scan`
- Auth: API key in header `PAYMENT-SIGNATURE`

x402 resource for autonomous buyers. The x402 payment purchases FLINT's scan service; the request body describes a separate intended commerce transaction that has not executed. Unknown callers receive bounded deterministic evaluation without external provider or model calls. A verified FLINT Agent Passport bound to the x402 payer wallet can upgrade authority evidence.

## Request body

- X402ScanRequest
  - `nonce` string, required
  - `timestamp` string, date-time, required
  - `passport_id` string: Optional FLINT Agent Passport. Authority credit requires server verification and a match to the verified x402 payer wallet.
  - `merchant_reference` string
  - `transaction` object, required
    - `action` string, required
    - `reference` string
    - `chain` string, required
    - `token` object
      - `symbol` string
      - `issuer` string
      - `contract` string
    - `amount_display` string, required
    - `counterparty_address` string, required
    - `direction` string
  - `agent_claim` X402ScanAgentClaim
    - `agent_id` string
    - `agent_runtime_hint` string
    - `wallet_type` string

## Response `200`

The service payment settled and FLINT returned a signed pre-transaction decision record.

- X402ScanResponse
  - `caller_obligation` CallerObligation, required: FLINT does not hold keys and cannot stop the scanned transfer. This is the enforce-or-attest contract: the caller (or passport owner) must report what happened.
    - `enforcement` 'caller', required
    - `statement` string, required
    - `report_url` string, uri, required
    - `caller_binding_token` string, required: Lets an anonymous x402 caller report its own outcome without an account. Random, single-use per record.
  - `step_up` object: Present only when verdict is step_up; the remediation menu.
  - `passport_binding` PassportBinding, required: Whether a passport_id was presented on this scan and whether it was creditable. A presented passport's flint_agent_id is always carried here, even when not credited; the record's own Trust Graph merge key (agent.flint_agent_id / graph.flint_agent_id) is the passport's faid only when credited is true.
    - `presented` boolean, required
    - `passport_id` string, nullable
    - `flint_agent_id` string, nullable
    - `credited` boolean
    - `binding` 'credited' | 'presented_uncredited' | 'null', nullable: How this record's identity relates to the presented passport. null when no passport reached identity verification at all.
    - `reason_codes` string[]
  - `ok` unknown, required
  - `verdict` 'allow' | 'step_up' | 'review' | 'block', required
  - `score` number, required
  - `confidence` number
  - `top_reasons` string[]
  - `record_id` string, required
  - `record_url` string, uri, nullable, required: Human-readable authorization record URL, derived by FLINT from the record ID.
  - `receipt_url` string, uri, nullable, required: Machine retrieval URL for the signed settlement-receipt envelope.
  - `receipt_page_url` string, uri, nullable, required: Human-readable Scout service-payment receipt URL.
  - `signed_record` string, required
  - `record` object
  - `scan` object, required
    - `profile` 'marketplace_basic_v1', required
    - `status` 'completed', required
    - `transaction_intent_commitment` string, required
    - `payer_wallet_commitment` string, required
    - `external_provider_calls` unknown, required
    - `model_calls` unknown, required
    - `bounded_paid_path_executed` unknown, required
    - `external_provider_path_executed` unknown, required
    - `record_persisted` boolean, required
    - `record_persistence_status` 'persisted' | 'unavailable', required
    - `replay_protection_status` 'completed' | 'unavailable', required
    - `trust_graph_ingest_attempted` boolean, required
    - `passport_upgraded` boolean, required
  - `service_payment` object, required
    - `purpose` 'flint_transaction_scan_service_fee', required
    - `status` 'settled', required
    - `method` 'x402' | 'scout_credit': How this scan's service fee was paid. scout_credit means no x402 settlement or fsr_ receipt was issued for this call.
    - `distinct_from_scanned_transaction` unknown, required
    - `receipt_status` 'issued' | 'unavailable' | 'disabled', required
    - `receipt_id` string, nullable, required
    - `credits_remaining` integer, nullable: Present when method is scout_credit.
  - `settlement_receipt` object, nullable
  - `compliance` object

## Other responses

- `400`: Invalid request
- `402`: Canonical x402 v2 payment challenge. No protected or expensive work has executed.
- `403`: The verified payment did not provide a bindable payer wallet, or a presented Passport is terminally ineligible.
- `409`: Conflict or idempotency collision
- `413`: Invalid request
- `429`: The cheap caller-admission quota for paid attempts was exceeded.
- `431`: Invalid request
- `500`: Server error
- `502`: Upstream graph or service failure
- `503`: Service unavailable or not configured

---

[API](https://skmtc.dev/flint/apis/flint-agent-transaction-control-api.md) · [All operations](https://skmtc.dev/flint/apis/flint-agent-transaction-control-api/llms.txt) · [OpenAPI document](https://skmtc.dev/flint/apis/flint-agent-transaction-control-api/revisions/eb5052b7b5dc?raw)