ExchangeRebel Auth-Surface Conformance API

openapi: 3.2.0
info:
  title: ExchangeRebel — pay-per-call APIs for AI agents (x402 on…
  version: 1.0.0
  contact:
    name: 'ExchangeRebel (operator: Rebel Data)'
    url: https://exchangerebel.com
    email: sound.money.investing@gmail.com
  x-guidance: 'All paid operations use x402 on Solana: call without payment to get a 402 challenge (SOL recipient + USDC token account + fresh memo), pay with the memo attached via the Solana Memo program, then retry with header X-Payment-Tx: <signature> and ?toll_memo=<memo>. Challenges are dual-version: the PAYMENT-REQUIRED header carries the x402 v2 PaymentRequired object and the response body carries the same challenge in x402 v1 form for compatibility. Free operations (security: []) include each service''s /health catalog with full response shapes. Prices in x-payment-info are USD per call unless the summary says otherwise (RPC is per 1,000-request block; Telegram provisioning is per bot-month; transcription is per minute of audio).'
  description: '67 data and utility APIs behind x402 tolls, settled in SOL or USDC on Solana. Call a paid endpoint without payment to receive a 402 x402 challenge (recipient + fresh memo), pay with the memo attached via the Solana Memo program, then retry with the X-Payment-Tx header and toll_memo query parameter. Free catalog/health endpoints are marked without x-payment-info. Full catalogs: GET /toll/discovery and each service''s /health.'
servers:
- url: https://exchangerebel.com
tags:
- name: Auth-Surface Conformance
paths:
  /toll/auth-surface:
    get:
      tags:
      - Auth-Surface Conformance
      summary: MCP Auth-Surface Conformance service catalog
      responses:
        '200':
          description: 'Success. Returns the service catalog: what an auth-surface conformance report includes, the price ($0.05 per report), the published criteria (mcp-auth-surface/v1, pinned to MCP authorization revision 2026-07-28), the pinned public test corpus, and the scope banner (the published declarations only - not a security certification).'
      security: []
      operationId: getTollAuthSurface
      x-operation-id-source: derived
  /toll/auth-surface/health:
    get:
      tags:
      - Auth-Surface Conformance
      summary: MCP Auth-Surface Conformance service health
      responses:
        '200':
          description: Success. Returns service liveness and the criteria id.
      security: []
      operationId: getTollAuthSurfaceHealth
      x-operation-id-source: derived
  /toll/auth-surface/criteria:
    get:
      tags:
      - Auth-Surface Conformance
      summary: The published auth-surface conformance criteria
      responses:
        '200':
          description: 'Success. Returns the full published criteria (mcp-auth-surface/v1): all 38 graded checks (30 declaration checks over the protected-resource metadata, the authorization-server metadata and the server card, the cross-document checks, and 8 live-observation checks), the grade vocabulary, the 12-item not-assessable disclosure, and the pinned public test corpus identity (SHA-256 c49f88f78635226ede5ee7e89171f45473bf2e293741976f15ecde35b696d1fd); every report is reproducible from them. The price is $0.05 per report (ruled 2026-11-03).'
      security: []
      operationId: getTollAuthSurfaceCriteria
      x-operation-id-source: derived
  /toll/auth-surface/corpus:
    get:
      tags:
      - Auth-Surface Conformance
      summary: The pinned public test corpus identity
      responses:
        '200':
          description: 'Success. Returns the public test corpus identity for auth-surface conformance: its SHA-256 pin c49f88f78635226ede5ee7e89171f45473bf2e293741976f15ecde35b696d1fd (the SHA-256 of the corpus''s canonical serialization). The corpus is buyer-runnable before paying.'
      security: []
      operationId: getTollAuthSurfaceCorpus
      x-operation-id-source: derived
  /toll/auth-surface/check:
    post:
      tags:
      - Auth-Surface Conformance
      summary: Grade one MCP server's published auth surface ($0.05 per report)
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                endpointUrl:
                  type: string
                  description: The MCP server endpoint URL whose published auth surface is graded.
                statedCanonicalUrl:
                  type: string
                  description: The canonical resource URL the operator states for this endpoint; graded against the metadata documents.
                declaredRevision:
                  type: string
                  description: The MCP authorization revision the operator declares (2026-07-28; a 2025-11-25 declaration exercises the transition labels).
                intakeModes:
                  type: object
                  description: The declared intake modes for the submission, per the criteria document.
                prm:
                  type: object
                  description: The protected-resource metadata document (RFC 9728) as published.
                asDocs:
                  type: object
                  description: The authorization-server metadata documents (RFC 8414 / OIDC Discovery), keyed by issuer.
                card:
                  type: object
                  description: The MCP server card document.
                manifest:
                  type: object
                  description: The server manifest, if one is published.
                challengeObservation:
                  type: object
                  description: An observed unauthenticated challenge for the challenge checks.
                selfReportedCapture:
                  type: object
                  description: Your own capture of the challenge; graded only in the labelled self-reported tier, never merged with observed evidence.
              required:
              - endpointUrl
              - statedCanonicalUrl
      responses:
        '200':
          description: 'Success. Returns the signed full report (Ed25519, this service''s own key): the scope banner, the verdict line with per-class counts, all 38 check grades (class (i) from the submitted declarations; class (ii) graded from live observation under the service''s fetch fence, or recorded not-observed), the coverage block, the evidence manifest, and the payment-inclusion note. No composite score.'
        '402':
          description: 'Payment Required (x402). $0.05 per report — RULED. The payment includes: the signed full report — every class-(i) check graded, every class-(ii) check graded or recorded not-observed, the coverage block, the evidence manifest — and nothing on the disclosure list. The response body carries the payment instructions in x402 v1 form: payTo (the operator''s Solana wallet), the amount (50000 USDC units = $0.05 per report) and a fresh memo (prefix as-conf-). Pay in USDC on Solana with the memo attached via the Solana Memo program, then resubmit the same request with the payment transaction in the X-Payment-Tx header and the memo in the X-Payment-Memo header, re-sending the request body. The PAYMENT-REQUIRED response header carries the same object in x402 v2 form.'
      x-payment-info:
        protocols:
        - x402
        price:
          mode: fixed
          currency: USD
          amount: '0.05'
      security:
      - x402Payment: []
      operationId: postTollAuthSurfaceCheck
      x-operation-id-source: derived
  /toll/auth-surface/metrics:
    get:
      tags:
      - Auth-Surface Conformance
      summary: MCP Auth-Surface Conformance aggregate counters
      responses:
        '200':
          description: Success. Returns aggregate counters (free pre-checks, paid reports). Aggregate only - no payer identities, no submitted content.
      security: []
      operationId: getTollAuthSurfaceMetrics
      x-operation-id-source: derived
components:
  securitySchemes:
    x402Payment:
      type: apiKey
      in: header
      name: X-Payment-Tx
      description: 'x402 toll payment proof: the Solana transaction signature of a payment carrying the memo from the 402 challenge; send together with ?toll_memo=<memo>. Payment itself is made on-chain in SOL or USDC to the recipient named in the challenge.'