{"id":3767265,"recorded_at":"2026-11-06T20:26:19.059527Z","observed_at":"2026-11-06T20:26:19.059473Z","subject_kind":"source_record","subject":"x402_bazaar:https://bot-bazaar.fly.dev/v1/x402/suite/api-and-auth-hardening","kind":"listing","method":"sync.x402_bazaar/1","body":{"endpoints":[["x402","https://bot-bazaar.fly.dev/v1/x402/suite/api-and-auth-hardening"]],"name":"Bot Bazaar","owner_address":"0x847f54ae8ddfd71ed7bc930c1f7a73576fab03a9","raw":{"accepts":[{"amount":"50000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"name":"USD Coin","version":"2"},"maxTimeoutSeconds":300,"network":"eip155:8453","payTo":"0x847f54ae8dDFD71ed7bC930C1f7a73576FAb03A9","scheme":"exact"}],"description":"Composite 6-check API authentication audit chaining OAuth2 PKCE S256, OIDC discovery, JWT claims, API key checksum format, rate limits, and OWASP API Top 10.","extensions":{"bazaar":{"info":{"input":{"method":"GET","queryParams":{"issuer":"https://auth.example.com"},"type":"http"},"output":{"example":{"composite_posture_score":92,"composite_risk_score":8,"disclaimer":"Automated composite analytical & schema audit only — not legal advice, not financial or investment advice, not tax advice, and not a formal third-party security certification.","executive_grade":"A","generated_at":1793110000,"prioritized_remediation_checklist":["Require PKCE S256 on all OAuth 2.1 public/native flows and reject JWT alg=none.","Use prefixed CRC32-checksummed API keys stored as SHA-256 hashes in the database.","Return HTTP 429 with Retry-After headers on per-bot and per-IP write rate limits."],"sub_check_count":6,"sub_checks":{"api_key_format":{"crc32_hex":"a2e54612","formatted_token_example":"bzr_live_9f86d081884c7d659a2feaa0c55ad015_a2e54612","prefix":"bzr_live","secret_scanner_friendly":true,"valid":true},"jwt_claims":{"alg":"EdDSA","checks":{"issuer_present":true,"short_lived_ttl":true,"strong_algorithm":true,"subject_present":true},"ttl_seconds":120,"valid":true},"oauth2_pkce":{"code_challenge_method":"S256","pkce_s256_enforced":true,"s256_challenge":"E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM","valid":true,"verifier_length_valid":true},"oidc_discovery":{"checks":{"asymmetric_signing_algs":true,"https_issuer":true,"https_jwks_uri":true},"compliant":true,"issuer":"https://auth.example.com","jwks_uri":"https://auth.example.com/.well-known/jwks.json","valid":true},"owasp_api_top10":{"checks":{"API1_bola_mitigated":true,"API3_bopla_allowlisted":true,"API4_rate_limited":true,"API7_ssrf_guarded":true},"compliant":true,"score":100,"valid":true},"rate_limit_policy":{"checks":{"includes_retry_after_429_header":true,"read_rpm_reasonable":true,"write_rpm_stricter_than_read":true},"requests_per_min":60,"valid":true,"writes_per_min":20}},"suite":"api-and-auth-hardening","title":"API Authentication, JWT/OAuth2 & Rate-Limit Hardening Suite","tool":"suite/api-and-auth-hardening","valid":true},"type":"json"}},"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"input":{"additionalProperties":false,"properties":{"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"properties":{"issuer":{"description":"OIDC/JWT issuer URL","type":"string"}},"type":"object"},"type":{"const":"http","type":"string"}},"required":["type","method"],"type":"object"},"output":{"properties":{"example":{"type":"object"},"type":{"type":"string"}},"required":["type"],"type":"object"}},"required":["input"],"type":"object"}}},"lastUpdated":"2026-11-06T04:30:56.897Z","quality":{"l30DaysTotalCalls":2,"l30DaysUniquePayers":2,"lastCalledAt":"2026-11-06T04:30:56.681Z"},"resource":"https://bot-bazaar.fly.dev/v1/x402/suite/api-and-auth-hardening","serviceName":"Bot Bazaar","tags":["x402","reputation","sellers","base","usdc"],"type":"http","x402Version":2},"source":"x402_bazaar","summary":"Composite 6-check API authentication audit chaining OAuth2 PKCE S256, OIDC discovery, JWT claims, API key checksum format, rate limits, and OWASP API Top 10."},"body_sha256":"8519a061b5bfb22778a86c7f12a6da0b145337498ca4b9b9c71dac5a01398941","prev_id":752358,"leaf":"0xf34bc7ecd5b9dae740bd541c1383ed6624c0ffaf352a95c0f08962852bdc9153","leaf_text":"{\"body\":\"8519a061b5bfb22778a86c7f12a6da0b145337498ca4b9b9c71dac5a01398941\",\"id\":3767265,\"kind\":\"listing\",\"method\":\"sync.x402_bazaar/1\",\"observed_us\":1793996779059473,\"prev\":752358,\"subject\":\"x402_bazaar:https://bot-bazaar.fly.dev/v1/x402/suite/api-and-auth-hardening\",\"subject_kind\":\"source_record\"}","day":{"day":"2026-11-06","leaves":303443,"root":"0xb30ccefe7182c6f767e1fcbfb5f64ffd649da831f665f65c5ff39cd40512284f","chained":"0xc383f7ef68d2914082484765aa09e42c12c59a74a096ae64127c562618c506d3","anchor_chain":"eip155:5042002","anchor_tx":"0xfba13cb7ee4ada7f2fee3702a786a2201596be2ffea37dfc281ab4c8e9942fe1","anchor_block":71111178},"proof":["0xf34bcfac92d6be57ac8264bd7a07326df1664064570c8fae6a052b67a41440e0","0x69981a1f198d5d44c025eda292146d106ac9b7f944420d86c41f3a01b5d67ab5","0x0065bbf3702cbc65a581817deb00c69bb9536f84b5f91d3267960ac8799dcdcf","0x0ee3f1a2ca9c26e1ee41bf417af0111f8c7ed32f14ce579c92ae75b73f40f024","0x1838a9df6f6a9af2c69e930b25f173df7d573c6312bf5072a9bc971a404b6994","0xd034abdd388c7f2b6b869df5bf63f1164e53e81f404f8475faed8764d1eae751","0x38e3e460e184e8641af03891ea9d76ea50296eb87bc80e356077cf26aa77d4ff","0xed3e926b969a328cda8eb04cf47bd2488fabdf2f1a13dee794b21cc1d228d721","0x5187d36ef525aa8e4705c093132346796b8d2a2cf397a6425c31193844f9d091","0xd725bf408f59ef63ae6bab3223c418f5301d8dc641bbb4f008ebe2c7c1b1acc4","0x0f69f9dc906d9183284914665f87f53718fa39c4819dd4e1474323bbfe8a0103","0xdc823d204c470b887be4426dead2781d9dbd279e667a368729444e6e7b789bb6","0xa5dc4fb3a7ae09f3d06c57adbff25da103da7a1961739da10aa705af4b5cc1ed","0xadb9e5d5e78a6ef642bc8b18b9f3dd14d6e5d20536651d3ce85fec62d35a6aba","0x0bc8160b8c94aae791142fc9caa83c153cc73b339512089ee494d4e8e7094abe","0x04c1c4929933bae20304ac32084d4b93dcac07567f68e828ac93bbc39eb4614c","0x0ab273486ad4e41bf08c741b20b2ee12e0fc87eaa429a5467c58fd3be34409b9"]}