AINumbers.co Visa Tap API
The visa-tap API from AINumbers.co — 2 operation(s) for visa-tap.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/ainumbers-co:ainumbers-co-visa-tap-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: AINumbers.co Fintech Intelligence Suite Visa Tap API
version: 1.0.0
description: '**1255 fintech intelligence tools** covering ISO 20022, A2A payments, CFPB §1033, EU AI Act, DORA, MiCA, AML/KYC, BaaS, DLT/tokenization, ESG/climate finance, agentic payments (AP2, ACP, x402, Visa TAP, Mastercard Agent Pay), PQC migration, sanctions screening, and OpenChainGraph v0.4 computation chains.
## Transport
> **The live transport is MCP JSON-RPC 2.0 at `https://mcp.ainumbers.co/mcp` — not REST.**
>
> This OpenAPI file is a **descriptive data-room artifact** — a machine-readable index of all tools and their input/output schemas. The REST paths (`POST /v1/tools/{name}`) described here are a projection; they become functional only if the optional REST shim (Area 2 Path B) is deployed.
>
> To call tools today, connect via the official MCP client SDKs. TypeScript: `@modelcontextprotocol/sdk`. Python: `mcp`.
## Architecture
All tools run **entirely client-side** (browser JavaScript). Zero PII. Zero server calls after page load. Deterministic, reproducible outputs. Licensed CC BY 4.0.
OpenChainGraph v0.4 compute-binding nodes additionally run **server-side on the MCP Worker** and emit verifiable artifacts with `execution_hash` (WebCrypto SHA-256 over RFC 8785 canonical JSON).'
contact:
name: Post Oak Labs
url: https://postoaklabs.com
email: tim@postoaklabs.com
license:
name: CC BY 4.0
url: https://creativecommons.org/licenses/by/4.0/
servers:
- url: https://ainumbers.co
description: Static browser-based tool host (DreamHost). Tools run client-side — no REST gateway is active on this origin. See x-mcp for the live MCP endpoint.
tags:
- name: visa-tap
paths:
/v1/tools/crosswalk_agent_payment_rail_trust:
post:
operationId: crosswalk_agent_payment_rail_trust
summary: Agent Payment Rail Trust Crosswalk
description: 'Crosswalk agent identity posture to Visa TAP, Mastercard Agent Pay, and Web Bot Auth acceptance criteria. Per-rail verdict with gap list. Three rails checked: web_bot_auth, visa_tap, mastercard_agent_pay.
**Tool URL:** https://ainumbers.co/chaingraph/art-133-agent-payment-rail-trust-crosswalk.html
**AP2/Policy Mandate export:** yes'
tags:
- visa-tap
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
alg:
type: string
directory_published:
type: boolean
card_present:
type: boolean
signature_verified:
type: boolean
required:
- alg
- directory_published
- card_present
- signature_verified
responses:
'200':
description: Successful tool execution result
content:
application/json:
schema:
type: object
properties:
rails:
type: object
properties:
web_bot_auth:
type: object
visa_tap:
type: object
mastercard_agent_pay:
type: object
all_rails_accepted:
type: boolean
x-mcp-tool-name: crosswalk_agent_payment_rail_trust
x-tool-url: https://ainumbers.co/chaingraph/art-133-agent-payment-rail-trust-crosswalk.html
x-source: manifest
x-ap2-export: true
/v1/tools/check_webbotauth_nonce_replay:
post:
operationId: check_webbotauth_nonce_replay
summary: Web Bot Auth Nonce & Replay-Window Checker
description: 'Check a Visa TAP-shaped nonce for format (minimum entropy, base64url), freshness against the created/expires window (capped at TAP''s 8-minute spread), and an optional caller-supplied seen-nonce record. Zero network, caller-supplied inputs only. Emits ACCEPT or REFUSE. Replay prevention depends on the caller supplying an accurate seen-nonce record from its own storage — this verifier is stateless and cannot detect replay on its own.
**Tool URL:** https://ainumbers.co/chaingraph/art-593-webbotauth-nonce-replay-check.html
**AP2/Policy Mandate export:** yes'
tags:
- visa-tap
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
nonce:
type: string
created:
type: number
expires:
type: number
now_unix:
type: number
max_age_s:
type: number
seen_nonces:
type: array
items:
type: string
nonce_already_used:
type: boolean
required:
- nonce
- created
- expires
- now_unix
responses:
'200':
description: Successful tool execution result
content:
application/json:
schema:
type: object
properties:
format_ok:
type: boolean
spread_ok:
type:
- boolean
- 'null'
fresh:
type:
- boolean
- 'null'
already_used:
type: boolean
nonce_valid:
type: boolean
verdict:
type: string
enum:
- ACCEPT
- REFUSE
x-mcp-tool-name: check_webbotauth_nonce_replay
x-tool-url: https://ainumbers.co/chaingraph/art-593-webbotauth-nonce-replay-check.html
x-source: manifest
x-ap2-export: true
x-mcp:
transport: MCP JSON-RPC 2.0 (streamable HTTP)
endpoint: https://mcp.ainumbers.co/mcp
protocol_version: '2025-11-25'
authentication: none
registry: co.ainumbers/tools (official MCP registry)
note: Connect any MCP-compatible client (Claude, ChatGPT, custom agent) directly to this endpoint. The REST paths in this file are descriptive only — they do not exist on the live server unless the REST shim is deployed.