ExchangeRebel Manifest API

openapi: 3.2.0
info:
  title: ExchangeRebel — pay-per-call APIs for AI agents (x402 on…
  version: 1.0.0
  contact:
    name: 'ExchangeRebel (operator: Rebel Data)'
    url: https://exchangerebel.com
    email: sound.money.investing@gmail.com
  x-guidance: 'All paid operations use x402 on Solana: call without payment to get a 402 challenge (SOL recipient + USDC token account + fresh memo), pay with the memo attached via the Solana Memo program, then retry with header X-Payment-Tx: <signature> and ?toll_memo=<memo>. Challenges are dual-version: the PAYMENT-REQUIRED header carries the x402 v2 PaymentRequired object and the response body carries the same challenge in x402 v1 form for compatibility. Free operations (security: []) include each service''s /health catalog with full response shapes. Prices in x-payment-info are USD per call unless the summary says otherwise (RPC is per 1,000-request block; Telegram provisioning is per bot-month; transcription is per minute of audio).'
  description: '67 data and utility APIs behind x402 tolls, settled in SOL or USDC on Solana. Call a paid endpoint without payment to receive a 402 x402 challenge (recipient + fresh memo), pay with the memo attached via the Solana Memo program, then retry with the X-Payment-Tx header and toll_memo query parameter. Free catalog/health endpoints are marked without x-payment-info. Full catalogs: GET /toll/discovery and each service''s /health.'
servers:
- url: https://exchangerebel.com
tags:
- name: Manifest
paths:
  /toll/manifest:
    get:
      tags:
      - Manifest
      summary: MCP Manifest-Claim Audit service catalog
      responses:
        '200':
          description: 'Success. Returns the service catalog: what a manifest-claim audit includes, the prices, and the scope statement (the audit grades a manifest''s published claims against the MCP specification and the manifest''s own internal evidence; it does not execute the server, observe its runtime behaviour, or certify that the server is safe or honest in operation).'
      security: []
      operationId: getTollManifest
      x-operation-id-source: derived
  /toll/manifest/health:
    get:
      tags:
      - Manifest
      summary: MCP Manifest-Claim Audit service health
      responses:
        '200':
          description: Success. Returns service liveness and the report signer address.
      security: []
      operationId: getTollManifestHealth
      x-operation-id-source: derived
  /toll/manifest/criteria:
    get:
      tags:
      - Manifest
      summary: The published MCP manifest-claim scoring criteria
      responses:
        '200':
          description: 'Success. Returns the full published scoring criteria (mcp-manifest-claims/v1): the seven scored checks per tool, the exact present_and_consistent/misshaped/absent rules, the published keyword and claim-phrase lists, the spec defaults, and the scoring; every audit is reproducible from them.'
      security: []
      operationId: getTollManifestCriteria
      x-operation-id-source: derived
  /toll/manifest/precheck:
    post:
      tags:
      - Manifest
      summary: Free headline manifest-claim pre-check of an MCP tool manifest
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                caller:
                  type: string
                  description: Solana base58 wallet of the operator; keys the free allowance (100/day per wallet).
                manifest:
                  description: 'The MCP server''s tools/list manifest document, in any accepted shape: { tools: [...] }, { result: { tools: [...] } }, or a bare array of tools. Mutually exclusive with url. Submitted content is processed in memory only and never stored.'
                url:
                  type: string
                  description: The URL of a tools/list JSON document to fetch (read-only GET, 512 KB / 10 s caps) and grade as the manifest. Mutually exclusive with manifest.
              required:
              - caller
      responses:
        '200':
          description: 'Success. Returns the headline only: the verdict line, the score, and the counts (tools graded, per-status check counts, findings count). Per-tool evidence and the fix list are in the paid report. When the caller''s free allowance is exhausted, the response is the /toll/manifest/audit payment challenge instead.'
      security: []
      operationId: postTollManifestPrecheck
      x-operation-id-source: derived
  /toll/manifest/audit:
    post:
      tags:
      - Manifest
      summary: Full manifest-claim audit report for one submitted MCP manifest
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                manifest:
                  description: 'The MCP server''s tools/list manifest document, in any accepted shape: { tools: [...] }, { result: { tools: [...] } }, or a bare array of tools. Mutually exclusive with url. Submitted content is processed in memory only and never stored.'
                url:
                  type: string
                  description: The URL of a tools/list JSON document to fetch (read-only GET, 512 KB / 10 s caps) and grade as the manifest. Mutually exclusive with manifest.
      responses:
        '200':
          description: 'Success. Returns the full signed report: the verdict line and score under the published criteria, per-tool, per-check results with evidence, the findings list (spec-default traps, both-claimed traps, schema inconsistencies), and a concrete fix list. Submitted manifest content is processed in memory only and never stored.'
        '402':
          description: 'Payment Required (x402). A per-item fee: $0.05 buys one full manifest-claim audit report for one submitted MCP manifest. The response body carries the payment instructions in x402 v1 form: payTo (the operator''s Solana wallet), the amount (50000 USDC units = $0.05) and a fresh memo. Pay in USDC on Solana with the memo attached via the Solana Memo program, then resubmit the same audit request with the payment transaction in the X-Payment-Tx header and ?toll_memo=<memo>, re-sending the same manifest (or manifest URL) in the request body. The PAYMENT-REQUIRED response header carries the same object in x402 v2 form.'
      x-payment-info:
        protocols:
        - x402
        price:
          mode: fixed
          currency: USD
          amount: '0.05'
      security:
      - x402Payment: []
      operationId: postTollManifestAudit
      x-operation-id-source: derived
  /toll/manifest/metrics:
    get:
      tags:
      - Manifest
      summary: MCP Manifest-Claim Audit aggregate counters
      responses:
        '200':
          description: Success. Returns aggregate counters (paid audits, distinct payers, free pre-checks today). Aggregate only — no payer identities.
      security: []
      operationId: getTollManifestMetrics
      x-operation-id-source: derived
  /toll/manifest/drift-criteria:
    get:
      tags:
      - Manifest
      summary: The published MCP manifest-drift criteria
      responses:
        '200':
          description: 'Success. Returns the full published drift criteria (mcp-manifest-drift/v1): the digest canonicalisation rules, the independently signed digest block, the drift input contract, the comparison and pairing rules, and the prices; every drift report is reproducible from them.'
      security: []
      operationId: getTollManifestDriftCriteria
      x-operation-id-source: derived
  /toll/manifest/drift-precheck:
    post:
      tags:
      - Manifest
      summary: Free headline manifest-drift pre-check against a customer-held baseline
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                caller:
                  type: string
                  description: Solana base58 wallet of the operator; keys the free allowance (100/day per wallet).
                baseline_report:
                  description: A full paid manifest-claim audit report object previously issued by this service (signed mode). Mutually exclusive with the other baseline fields.
                baseline_digests:
                  description: The manifest_digest block from a paid audit report, submitted verbatim (signed mode; requires baseline_signature).
                baseline_signature:
                  description: The manifest_digest_signature from the same paid audit report (the signature object or its base64 value; requires baseline_digests).
                baseline_manifest:
                  description: A second manifest document asserted by the customer as the baseline (fallback mode; the report states the baseline was customer-asserted, not service-anchored).
                manifest:
                  description: 'The current MCP server''s tools/list manifest document, in any accepted shape: { tools: [...] }, { result: { tools: [...] } }, or a bare array of tools. Mutually exclusive with url. Submitted content is processed in memory only and never stored.'
                url:
                  type: string
                  description: The URL of a tools/list JSON document to fetch (read-only GET, 512 KB / 10 s caps) and compare as the current manifest. Mutually exclusive with manifest.
              required:
              - caller
      responses:
        '200':
          description: 'Success. Returns the headline only: the verdict line (MANIFEST UNCHANGED, or MANIFEST CHANGED with the number of differing tools) and the per-status counts (unchanged / changed / added / removed). Per-tool differences, the re-grade, and the pattern screen are in the paid drift report. When the caller''s free allowance is exhausted, the response is the /toll/manifest/drift payment challenge instead.'
      security: []
      operationId: postTollManifestDriftPrecheck
      x-operation-id-source: derived
  /toll/manifest/drift:
    post:
      tags:
      - Manifest
      summary: Full manifest-drift comparison report against a customer-held baseline
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                baseline_report:
                  description: A full paid manifest-claim audit report object previously issued by this service (signed mode). Mutually exclusive with the other baseline fields.
                baseline_digests:
                  description: The manifest_digest block from a paid audit report, submitted verbatim (signed mode; requires baseline_signature).
                baseline_signature:
                  description: The manifest_digest_signature from the same paid audit report (the signature object or its base64 value; requires baseline_digests).
                baseline_manifest:
                  description: A second manifest document asserted by the customer as the baseline (fallback mode; the report states the baseline was customer-asserted, not service-anchored).
                manifest:
                  description: 'The current MCP server''s tools/list manifest document, in any accepted shape: { tools: [...] }, { result: { tools: [...] } }, or a bare array of tools. Mutually exclusive with url. Submitted content is processed in memory only and never stored.'
                url:
                  type: string
                  description: The URL of a tools/list JSON document to fetch (read-only GET, 512 KB / 10 s caps) and compare as the current manifest. Mutually exclusive with manifest.
      responses:
        '200':
          description: 'Success. Returns the full signed drift report: the verdict line (MANIFEST UNCHANGED, or MANIFEST CHANGED with the number of differing tools), per-tool UNCHANGED / CHANGED / ADDED / REMOVED with field-level diffs for changed tools, a re-grade of the current manifest under mcp-manifest-claims/v1, and a pattern screen of changed tools'' new descriptions under prompt-injection-rules/v1, separately labelled. Submitted content is processed in memory only and never stored; the baseline stays customer-held.'
        '402':
          description: 'Payment Required (x402). A per-item fee: $0.05 buys one drift comparison report for one submitted manifest against one customer-held baseline. The response body carries the payment instructions in x402 v1 form: payTo (the operator''s Solana wallet), the amount (50000 USDC units = $0.05) and a fresh memo. Pay in USDC on Solana with the memo attached via the Solana Memo program, then resubmit the same drift request with the payment transaction in the X-Payment-Tx header and ?toll_memo=<memo>, re-sending the same baseline and current manifest in the request body. The PAYMENT-REQUIRED response header carries the same object in x402 v2 form.'
      x-payment-info:
        protocols:
        - x402
        price:
          mode: fixed
          currency: USD
          amount: '0.05'
      security:
      - x402Payment: []
      operationId: postTollManifestDrift
      x-operation-id-source: derived
components:
  securitySchemes:
    x402Payment:
      type: apiKey
      in: header
      name: X-Payment-Tx
      description: 'x402 toll payment proof: the Solana transaction signature of a payment carrying the memo from the 402 challenge; send together with ?toll_memo=<memo>. Payment itself is made on-chain in SOL or USDC to the recipient named in the challenge.'