Pay-per-CBOM-Seal: a drand-timestamped, re-verifiable seal over a CycloneDX CBOM (ECMA-424

[
  {
    "scheme": "exact",
    "network": "eip155:8453",
    "payTo": "0xC13789e82661635d9Cea38a53A0390CF9939ef4f",
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "amount": "50000",
    "maxTimeoutSeconds": 300
  },
  {
    "scheme": "exact",
    "network": "eip155:8453",
    "payTo": "0xC13789e82661635d9Cea38a53A0390CF9939ef4f",
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "amount": "50000",
    "maxTimeoutSeconds": 300
  }
]

{
  "bazaar": {
    "body": {
      "cbom": {
        "bomFormat": "CycloneDX",
        "components": []
      },
      "issuer": "acme"
    },
    "bodyType": "json",
    "description": "Pay-per-CBOM-Seal: a drand-timestamped, re-verifiable seal over a CycloneDX CBOM (ECMA-424) cryptographic inventory — a Dilithium-2 (NIST FIPS 204) `.cbomseal` cert PLUS an additive ML-DSA-65 / Dilithium-3 (NIST FIPS 204) served signature over the same canonical claim. Built for CNSA 2.0 / OMB M-23-02 PQC-readiness disclosure. Informational readiness breakdown included. x402-native.",
    "info": {
      "input": {
        "body": {
          "cbom": {
            "bomFormat": "CycloneDX",
            "components": []
          },
          "issuer": "acme"
        },
        "bodyType": "json",
        "method": "POST",
        "type": "http"
      },
      "output": {
        "example": {
          "seal": {
            "seal_id": "…"
          },
          "served_signature": {
            "algorithm": "ml-dsa-65"
          }
        },
        "type": "json"
      }
    },
    "method": "POST",
    "output": {
      "example": {
        "seal": {
          "seal_id": "…"
        },
        "served_signature": {
          "algorithm": "ml-dsa-65"
        }
      },
      "schema": {
        "properties": {
          "payment": {
            "description": "Settlement receipt (scheme, network, asset, txHash, payer, settled).",
            "type": "object"
          },
          "readiness": {
            "description": "Informational PQC-readiness breakdown (quantum_vulnerable / pqc / symmetric_or_hash / unknown counts). NOT an audit.",
            "type": "object"
          },
          "seal": {
            "description": "The re-verifiable `.cbomseal`: { claim (cbom_hash, issuer, subject, crypto_asset_count, drand_round, drand_randomness, sealed_at, algorithm), signature (base64 Dilithium-2 / ML-DSA-44, via the Rust PQC node), public_key, seal_id }. Re-verifiable at /api/cbom.",
            "type": "object"
          },
          "served_signature": {
            "description": "ADDITIVE post-quantum signature over the SAME canonical claim: { algorithm (\"ml-dsa-65\"), algorithm_label, signature (base64 ML-DSA-65 / Dilithium-3, 3309 bytes, signed locally via @noble), public_key (base64, 1952 bytes), signed_message (\"FRACTALAI-x402-served-v1\\nx402-seal-cbom\\n<claim_digest>\"), claim_digest (sha256 of canonical claim) }. Verify offline: ml_dsa65.verify(b64(signature), utf8(signed_message), b64(public_key)).",
            "type": "object"
          },
          "verify_drand_at": {
            "description": "URL to independently re-check the drand round on drand.sh.",
            "type": "string"
          }
        },
        "required": [
          "seal",
          "served_signature"
        ],
        "type": "object"
      },
      "type": "json"
    },
    "route_key": "POST /api/x402/seal-cbom",
    "schema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "properties": {
        "input": {
          "additionalProperties": false,
          "properties": {
            "body": {
              "type": "object"
            },
            "bodyType": {
              "enum": [
                "json",
                "form-data",
                "text"
              ],
              "type": "string"
            },
            "headers": {
              "additionalProperties": {
                "type": "string"
              },
              "type": "object"
            },
            "method": {
              "enum": [
                "POST",
                "PUT",
                "PATCH"
              ],
              "type": "string"
            },
            "queryParams": {
              "additionalProperties": {
                "type": "string"
              },
              "type": "object"
            },
            "type": {
              "const": "http",
              "type": "string"
            }
          },
          "required": [
            "type",
            "method",
            "bodyType",
            "body"
          ],
          "type": "object"
        },
        "output": {
          "properties": {
            "example": {
              "type": "object"
            },
            "type": {
              "type": "string"
            }
          },
          "required": [
            "type"
          ],
          "type": "object"
        }
      },
      "required": [
        "input"
      ],
      "type": "object"
    },
    "serviceName": "FractalAI CBOM Seal",
    "tags": [
      "cbom",
      "cnsa-2.0",
      "crypto-inventory",
      "pqc-readiness",
      "compliance"
    ],
    "type": "http"
  }
}

curl "https://fractalai.net.co/api/x402/seal-cbom"
# -> 402 Payment Required, accepts[] lists how to pay
# retry with a PAYMENT-SIGNATURE (or PAYMENT header) once paid

const res = await fetch("https://fractalai.net.co/api/x402/seal-cbom");
if (res.status === 402) {
  const { accepts } = await res.json();
  // pay one of accepts[] via an x402 client, then retry with the payment header
}

import httpx
res = httpx.get("https://fractalai.net.co/api/x402/seal-cbom")
if res.status_code == 402:
    accepts = res.json()["accepts"]
    # pay one of accepts[] via an x402 client, then retry with the payment header