{"id":752358,"recorded_at":"2026-10-28T09:13:42.365141Z","observed_at":"2026-10-28T09:13:42.365091Z","subject_kind":"source_record","subject":"x402_bazaar:https://bot-bazaar.fly.dev/v1/x402/suite/api-and-auth-hardening","kind":"listing","method":"sync.x402_bazaar/1","body":{"endpoints":[["x402","https://bot-bazaar.fly.dev/v1/x402/suite/api-and-auth-hardening"]],"name":"Bot Bazaar","owner_address":"0x847f54ae8ddfd71ed7bc930c1f7a73576fab03a9","raw":{"accepts":[{"amount":"50000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"name":"USD Coin","version":"2"},"maxTimeoutSeconds":300,"network":"eip155:8453","payTo":"0x847f54ae8dDFD71ed7bC930C1f7a73576FAb03A9","scheme":"exact"}],"description":"Composite 6-check API authentication audit chaining OAuth2 PKCE S256, OIDC discovery, JWT claims, API key checksum format, rate limits, and OWASP API Top 10.","extensions":{"bazaar":{"info":{"input":{"method":"GET","queryParams":{"issuer":"https://auth.example.com"},"type":"http"},"output":{"example":{"composite_posture_score":92,"composite_risk_score":8,"disclaimer":"Automated composite analytical & schema audit only — not legal advice, not financial or investment advice, not tax advice, and not a formal third-party security certification.","executive_grade":"A","generated_at":1793110000,"prioritized_remediation_checklist":["Require PKCE S256 on all OAuth 2.1 public/native flows and reject JWT alg=none.","Use prefixed CRC32-checksummed API keys stored as SHA-256 hashes in the database.","Return HTTP 429 with Retry-After headers on per-bot and per-IP write rate limits."],"sub_check_count":6,"sub_checks":{"api_key_format":{"crc32_hex":"a2e54612","formatted_token_example":"bzr_live_9f86d081884c7d659a2feaa0c55ad015_a2e54612","prefix":"bzr_live","secret_scanner_friendly":true,"valid":true},"jwt_claims":{"alg":"EdDSA","checks":{"issuer_present":true,"short_lived_ttl":true,"strong_algorithm":true,"subject_present":true},"ttl_seconds":120,"valid":true},"oauth2_pkce":{"code_challenge_method":"S256","pkce_s256_enforced":true,"s256_challenge":"E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM","valid":true,"verifier_length_valid":true},"oidc_discovery":{"checks":{"asymmetric_signing_algs":true,"https_issuer":true,"https_jwks_uri":true},"compliant":true,"issuer":"https://auth.example.com","jwks_uri":"https://auth.example.com/.well-known/jwks.json","valid":true},"owasp_api_top10":{"checks":{"API1_bola_mitigated":true,"API3_bopla_allowlisted":true,"API4_rate_limited":true,"API7_ssrf_guarded":true},"compliant":true,"score":100,"valid":true},"rate_limit_policy":{"checks":{"includes_retry_after_429_header":true,"read_rpm_reasonable":true,"write_rpm_stricter_than_read":true},"requests_per_min":60,"valid":true,"writes_per_min":20}},"suite":"api-and-auth-hardening","title":"API Authentication, JWT/OAuth2 & Rate-Limit Hardening Suite","tool":"suite/api-and-auth-hardening","valid":true},"type":"json"}},"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"input":{"additionalProperties":false,"properties":{"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"properties":{"issuer":{"description":"OIDC/JWT issuer URL","type":"string"}},"type":"object"},"type":{"const":"http","type":"string"}},"required":["type","method"],"type":"object"},"output":{"properties":{"example":{"type":"object"},"type":{"type":"string"}},"required":["type"],"type":"object"}},"required":["input"],"type":"object"}}},"lastUpdated":"2026-10-28T01:46:49.116Z","quality":{"l30DaysTotalCalls":1,"l30DaysUniquePayers":1,"lastCalledAt":"2026-10-28T01:46:48.935Z"},"resource":"https://bot-bazaar.fly.dev/v1/x402/suite/api-and-auth-hardening","serviceName":"Bot Bazaar","tags":["x402","reputation","sellers","base","usdc"],"type":"http","x402Version":2},"source":"x402_bazaar","summary":"Composite 6-check API authentication audit chaining OAuth2 PKCE S256, OIDC discovery, JWT claims, API key checksum format, rate limits, and OWASP API Top 10."},"body_sha256":"b1bbf518f3bea00bba1cb6f3c9e10f51ce3d273c78aa32f567abb7ed6e278608","prev_id":null,"leaf":"0xc42417af817cf4236bf47a252dfabad7ccccbf90f79daa5e58766d2709102cb0","leaf_text":"{\"body\":\"b1bbf518f3bea00bba1cb6f3c9e10f51ce3d273c78aa32f567abb7ed6e278608\",\"id\":752358,\"kind\":\"listing\",\"method\":\"sync.x402_bazaar/1\",\"observed_us\":1793178822365091,\"prev\":null,\"subject\":\"x402_bazaar:https://bot-bazaar.fly.dev/v1/x402/suite/api-and-auth-hardening\",\"subject_kind\":\"source_record\"}","day":{"day":"2026-10-28","leaves":231336,"root":"0x2c19037464cc4c493624565f01775d6446fc78eaa118fc6865bfe2bfca9ff78e","chained":"0xd1d7dee8322ceff8f4c8d83aa1fe4a4466825c2af1c97dbde3d35db61234f7be","anchor_chain":"eip155:5042002","anchor_tx":"0x8bae2b1d097834c8b458513862d70d29ee807e98dc2e863b27250131c15b35ae","anchor_block":69584042},"proof":["0xc4241fa6f2bd688c362cfbced2503a98dfd0b5fed80d77b6b3236792026397cf","0xfb02c80d8eda8fb5810a40a7a5bcf342f85da444400fb5694cab06f4e415e22a","0x350c874532b47bb6be12f91c8107c89735338b43a37c456f9b061c4a38fa6d01","0x4bad5fc5ba8e7dd362f1254b0eaf96a78af0eb34c73f6e13f47896cb58ffb320","0xd9e8a8e146165ec61aff06c956f264729d0ae565eb0f6d86474ba513b62ac044","0x2bc88ade86da91b57d699a333022288da0ebd1443a9631e791050aaf5393f099","0xdbec43ff8c41697bfd46c223fdd7a1f93fbbf1c21c7b7f53d1f3f4b056901f63","0x54fd71894226c02b37b573e8c079622c9934fdf61e823817f857d7e9dde328b5","0x05bc07cd87561c1a63a82f43abe14eebf5beb4d7823fb213cc5bf0e825d8090b","0xc6cb79a5c05a856fef192bedbba592ab731854083178912da70b19318efc5ce9","0x56e37eafecdb369c29a1c5b35d2e69043cd7a97b2a9598916af08649363be817","0x5f08863a25cf1a39d719398abd6becab3a6cfe1a8f41536f1b66264c9b797268","0xc5e194226ea62d0d597c9eb0fabf3d09ccea2d41c32be367d96394755e91de3a","0x4dedfee32d37ea3cdc60e339d676b411d314f945b00a30f8e3bd1e0470526cf9","0xc21e7661f5d6220994a88cc71b1262eeee3b912a2d383d18f38a631c534bfd71","0x32beeeb960280bc48748681cb10297ede9403461fe9c8143fdf946548e552926","0xe08e8bd91858a8a10c46ecde9c29a6288b960987303173c5e882afb46ce91fa0","0xe6cfe00ae4e02bc12327e45b5f3334ea5850ba3bcc8e3101d30a8189856a95af"]}