ExchangeRebel SDK Safety API

openapi: 3.2.0
info:
  title: ExchangeRebel — pay-per-call APIs for AI agents (x402 on…
  version: 1.0.0
  contact:
    name: 'ExchangeRebel (operator: Rebel Data)'
    url: https://exchangerebel.com
    email: sound.money.investing@gmail.com
  x-guidance: 'All paid operations use x402 on Solana: call without payment to get a 402 challenge (SOL recipient + USDC token account + fresh memo), pay with the memo attached via the Solana Memo program, then retry with header X-Payment-Tx: <signature> and ?toll_memo=<memo>. Challenges are dual-version: the PAYMENT-REQUIRED header carries the x402 v2 PaymentRequired object and the response body carries the same challenge in x402 v1 form for compatibility. Free operations (security: []) include each service''s /health catalog with full response shapes. Prices in x-payment-info are USD per call unless the summary says otherwise (RPC is per 1,000-request block; Telegram provisioning is per bot-month; transcription is per minute of audio).'
  description: '67 data and utility APIs behind x402 tolls, settled in SOL or USDC on Solana. Call a paid endpoint without payment to receive a 402 x402 challenge (recipient + fresh memo), pay with the memo attached via the Solana Memo program, then retry with the X-Payment-Tx header and toll_memo query parameter. Free catalog/health endpoints are marked without x-payment-info. Full catalogs: GET /toll/discovery and each service''s /health.'
servers:
- url: https://exchangerebel.com
tags:
- name: SDK Safety
paths:
  /toll/sdk-safety:
    get:
      tags:
      - SDK Safety
      summary: SDK Safety service catalog
      responses:
        '200':
          description: 'Success. Returns the service catalog: what an SDK version-safety check includes, the price ($0.01 per check), the published criteria (sdk-version-safety/v1), the pinned flaw snapshot (x402-sdk-flaws/v1-2026-10-24: 25 disclosed x402 SDK flaws, 3 critical) and the honesty boundary (the pinned record establishes no SDK identifier and no fixed version for any flaw, so every well-formed submission grades NOT-IN-RECORD in v1).'
      security: []
      operationId: getTollSdkSafety
      x-operation-id-source: derived
  /toll/sdk-safety/health:
    get:
      tags:
      - SDK Safety
      summary: SDK Safety service health
      responses:
        '200':
          description: Success. Returns service liveness and the report signer address.
      security: []
      operationId: getTollSdkSafetyHealth
      x-operation-id-source: derived
  /toll/sdk-safety/criteria:
    get:
      tags:
      - SDK Safety
      summary: The published SDK version-safety criteria
      responses:
        '200':
          description: 'Success. Returns the full published criteria (sdk-version-safety/v1): the input contract, the per-flaw outcome states (AFFECTED / FIXED / NOT-APPLICABLE / NOT-ESTABLISHED), the overall verdict rules including NOT-IN-RECORD, the honesty boundary, and the pinned public test corpus identity; every report is reproducible from them.'
      security: []
      operationId: getTollSdkSafetyCriteria
      x-operation-id-source: derived
  /toll/sdk-safety/corpus:
    get:
      tags:
      - SDK Safety
      summary: The pinned public test corpus identity
      responses:
        '200':
          description: 'Success. Returns the public test corpus identity for sdk-version-safety/v1: corpus id sdk-safety-corpus/v1 and its SHA-256 pin 3fc3ffaaa2f29a45d483dd0d778f724baf6820626466a46485796684d472ba43 (the SHA-256 of the corpus''s canonical serialization, verifiable with the published harness). The corpus is buyer-runnable before paying.'
      security: []
      operationId: getTollSdkSafetyCorpus
      x-operation-id-source: derived
  /toll/sdk-safety/precheck:
    post:
      tags:
      - SDK Safety
      summary: Free headline pre-check of one SDK name + version
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                caller:
                  type: string
                  description: Solana base58 wallet of the operator; keys the free allowance (100/day per wallet).
                sdk:
                  type: string
                  description: The x402 SDK name to check against the pinned flaw snapshot.
                version:
                  type: string
                  description: 'The SDK version to check (semver: optional leading v, MAJOR.MINOR.PATCH, optional -prerelease / +build).'
              required:
              - caller
              - sdk
              - version
      responses:
        '200':
          description: 'Success. Returns validation + record-coverage only: whether the SDK name + version are well-formed and the coverage statement (the pinned record establishes no SDK identifier and no fixed version for any flaw, so a paid check of any well-formed pair grades NOT-IN-RECORD in v1). No per-flaw grading is performed and no verdict is returned. When the caller''s free allowance is exhausted, the response is the /toll/sdk-safety/check payment challenge instead.'
      security: []
      operationId: postTollSdkSafetyPrecheck
      x-operation-id-source: derived
  /toll/sdk-safety/check:
    post:
      tags:
      - SDK Safety
      summary: Full signed SDK version-safety report for one submitted SDK name + version
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                sdk:
                  type: string
                  description: The x402 SDK name to check against the pinned flaw snapshot.
                version:
                  type: string
                  description: 'The SDK version to check (semver: optional leading v, MAJOR.MINOR.PATCH, optional -prerelease / +build).'
              required:
              - sdk
              - version
      responses:
        '200':
          description: 'Success. Returns the full signed report: per-flaw outcomes for all 25 recorded flaws (AFFECTED / FIXED / NOT-APPLICABLE / NOT-ESTABLISHED, both versions printed wherever a fixed threshold exists in the snapshot), the overall verdict (including NOT-IN-RECORD when the submitted SDK or version is outside the pinned record''s established data), and the factors. Factors printed; no composite score.'
        '402':
          description: 'Payment Required (x402). A per-item fee: $0.01 per check - each SDK name + version you submit is charged at $0.01; the payment includes one version-safety check of the one x402 SDK name + version you submit against the pinned flaw snapshot named in the report (snapshot x402-sdk-flaws/v1-2026-10-24) — per-flaw outcomes for all 25 recorded flaws (AFFECTED / FIXED / NOT-APPLICABLE / NOT-ESTABLISHED, with both versions printed wherever a fixed threshold exists in the snapshot), the overall verdict (including NOT-IN-RECORD when the submitted SDK or version is outside the pinned record''s established data), and the factors. Factors printed; no composite score. Nothing submitted is stored beyond the payments ledger''s closed field list. The response body carries the payment instructions in x402 v1 form: payTo (the operator''s Solana wallet), the amount (10000 USDC units = $0.01 per check) and a fresh memo. Pay in USDC on Solana with the memo attached via the Solana Memo program, then resubmit the same request with the payment transaction in the X-Payment-Tx header and ?toll_memo=<memo>, re-sending the check in the request body. The PAYMENT-REQUIRED response header carries the same object in x402 v2 form.'
      x-payment-info:
        protocols:
        - x402
        price:
          mode: fixed
          currency: USD
          amount: '0.01'
      security:
      - x402Payment: []
      operationId: postTollSdkSafetyCheck
      x-operation-id-source: derived
  /toll/sdk-safety/metrics:
    get:
      tags:
      - SDK Safety
      summary: SDK Safety aggregate counters
      responses:
        '200':
          description: Success. Returns aggregate counters (paid checks, distinct payers, free pre-checks today). Aggregate only - no payer identities, no submitted SDK content.
      security: []
      operationId: getTollSdkSafetyMetrics
      x-operation-id-source: derived
components:
  securitySchemes:
    x402Payment:
      type: apiKey
      in: header
      name: X-Payment-Tx
      description: 'x402 toll payment proof: the Solana transaction signature of a payment carrying the memo from the 402 challenge; send together with ?toll_memo=<memo>. Payment itself is made on-chain in SOL or USDC to the recipient named in the challenge.'