x402 Manifest Checklist: Make Your API Discoverable

A working x402 endpoint is only half the job. If agents cannot discover, quote, and evaluate it reliably, it might as well be a private URL. Your manifest is the bridge between "this endpoint accepts payment" and "an autonomous client can safely decide whether to fetch the live 402 and use it."

The short version

Before submitting a manifest to Agent Bazaar, make sure it passes this minimum bar:

• Public HTTPS URL. Host it at a stable URL, ideally /.well-known/x402.json. It must be fetchable without cookies, JavaScript, auth headers, or IP allowlists.
• Top-level x402Version. Include the protocol version once at the top level. Agent Bazaar currently expects the modern resource-list shape with x402Version: 2.
• At least one resource. Empty manifests are ignored. Every listed resource should correspond to a real payable endpoint.
• Every resource has url, description, and accepts[]. A URL tells the agent where to call, the description tells it when to call, and accepts[] tells it how to pay.
• Amounts are base units. For 6-decimal USDC, "10000" means 0.01 USDC, not 10,000 USDC.
• Output schema is present when possible. Agents trust a resource faster when they know the shape of the response before spending.

A clean minimal manifest

{
  "x402Version": 2,
  "resources": [
    {
      "url": "https://api.example.com/v1/token-risk?mint={mint}",
      "description": "Returns a token risk report with authority, liquidity, holder concentration and risk score.",
      "accepts": [
        {
          "scheme": "exact",
          "network": "eip155:8453",
          "payTo": "0xYourBaseWallet",
          "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
          "amount": "10000",
          "maxTimeoutSeconds": 120
        }
      ],
      "outputSchema": {
        "type": "object",
        "required": ["risk_score", "summary"],
        "properties": {
          "risk_score": { "type": "number" },
          "summary": { "type": "string" },
          "warnings": { "type": "array", "items": { "type": "string" } }
        }
      },
      "tags": ["solana", "token-risk", "security"]
    }
  ]
}

accepts[] hygiene

The accepts[] array is where most bad listings break. Treat every row as a quote an agent might execute exactly as written.

Descriptions agents can use

A good description is not marketing copy. It should tell the agent when the resource is useful, what input it expects, and what output it returns. Compare:

Schema discipline

If your response is JSON, publish an outputSchema. It helps agents plan the next step after payment: parse a score, call another tool, summarize a report, or stop because the resource does not return the field they need. Keep schemas honest. A small accurate schema beats an impressive one that does not match reality.

Pre-submit test

Run these checks before listing:

# Manifest is public and JSON
curl -i https://api.example.com/.well-known/x402.json

# Endpoint returns a structured 402 when unpaid
curl -i "https://api.example.com/v1/token-risk?mint=..."

# Submit or refresh the listing
curl -X POST https://bazaar.saylorinnovations.com/submit \
  -H "content-type: application/json" \
  -d '{"manifestUrl":"https://api.example.com/.well-known/x402.json"}'

When to re-submit

Re-submit whenever the manifest changes: price, wallet address, network, resource URL, schema, tags, or description. Agent Bazaar treats a verified direct submission as the provider's current source of truth, so refreshing is cheap and intentional.