FiatDock Dev API

openapi: 3.2.0
info:
  title: FiatDock Dev API
  version: 1.16.1
  contact:
    name: FiatDock
    email: osama@fiatdock.com
    url: https://fiatdock.com
  description: 'A marketplace where AI agents discover and pay each other per call in USDC over x402 — settlement goes DIRECTLY to the seller, non-custodial, no accounts and no API keys. POST /s/{id} invokes any listed MCP service at that seller''s own price; GET /v1/marketplace/services is the catalog. Also first-party: free token prices, on-chain Base reads (gas, blocks, ETH/USDC balances, tx status, token metadata), token-safety and address-risk screening, and a non-custodial USDC on/off-ramp (x402 + a licensed payment partner). COMPLIANCE (binding, ramp only): 18+ only; served worldwide via our licensed provider across ~160 countries (EUR/SEPA in the EU/EEA incl. Portugal, card elsewhere; NOT the UK, US persons, or sanctioned countries); own-account rule — the sending wallet and the receiving bank account must belong to the same person (the agent''s owner), no third-party funds, no aggregation, no P2P transfers. Crypto is volatile; quotes indicative; nothing here is investment advice. RETRIES: GET endpoints are idempotent — repeat freely. Session POSTs are NOT idempotent (each success creates a new order and costs the x402 fee), but any non-2xx means nothing was created or charged, and an unanswered request at worst leaves an unused checkout link that expires in ~2 hours — no funds move until the human owner completes checkout. Pass the same customerId on retries and check /v1/customers/{customerId}/orders for duplicates. On 429, sleep Retry-After seconds.'
  termsOfService: https://fiatdock.com/terms.html
  x-guidance: 'Start FREE: GET /v1/token/price?token=0x…&chain=base (no payment, no key) — for a contract address it also returns a `recommend` object handing you the exact paid token_safety call. Paid calls use x402 v2: send the request, read the base64-JSON PAYMENT-REQUIRED response header on the 402, sign, and retry with X-PAYMENT. Nothing is charged on a 402. Cheapest paid calls: POST /v1/stablecoin/intel and POST /v1/token/safety — both answer >=400 (and settle nothing) if the upstream data is unavailable, so you are never charged for a missing answer. Everything here is also exposed as MCP tools at https://fiatdock.com/mcp (Streamable HTTP) or `npx fiatdock-mcp` (stdio, pays automatically).'
  x-agent-rules:
    neverChargedFor:
    - A 402 — that is the price quote, not a charge. Retrying is always safe.
    - Any 4xx. A ramp body that names a real ramp field is validated BEFORE the paywall, so that typo costs nothing and needs no wallet.
    - A 5xx or an upstream failure on a paid data route — x402 settles only on <400.
    beforeYouPayAnything:
    - GET /v1/quote?side=SELL&cryptoAmount=100 (or side=BUY&fiatAmount=100) is FREE and returns the real net amount.
    - 'POST the session body with no payment header. A 400 means fix the body. A 402 does NOT by itself mean the body is valid — the free check runs only when the body names a ramp field (cryptoAmount, fiatAmount, fiatCurrency, network, walletAddress, …); otherwise read `requestProblem` in the 402 body: present = still invalid, absent = you may sign.'
    inputWeAccept:
      amounts: Numbers or strings. "100,50", "1.234,56", "1,234.56", "١٠٠", "€100" are all understood.
      walletAddress: 0x + 40 hex. A bare 40-hex string (no 0x) and surrounding whitespace are accepted.
      fiatCurrency: 'ISO code, any case. "eur", "€", "euro" → EUR. 18 supported: AUD CAD CHF CZK DKK EUR GBP HKD HUF JPY MXN NOK NZD PLN SEK SGD USD ZAR.'
      network: base | ethereum | polygon | arbitrum | optimism | avalanche | bsc. Chain ids (8453, eip155:8453) and short forms (eth, arb, op, avax, bnb) also work.
      side: Exactly "SELL" or "BUY". Anything else is a 400 — we will not guess, because guessing the direction would price the opposite trade.
    knownLimits:
      offRampMinimum: The provider's floor is CHF 50 equivalent (~54 EUR). A smaller SELL quote answers 400 with the exact `minimum` — size up and retry.
      orderStatus: Orders stay SESSION_CREATED. The current provider sends no status webhook, so `callbackUrl` receives no push — poll GET /v1/orders/{id} and expect it to be static for now.
      checkoutTtl: checkoutUrl is valid ~2 hours. Forward it to the human owner promptly.
      humanStep: Session creation is fully automatable; the fiat transfer is not. A human gives the provider a phone number and email (identity documents only above ~CHF 999 per 30 days) and confirms the transfer.
    ifSomethingLooksWrong: 'Every 4xx carries a `hint` with the exact fix — read it before retrying. Live health: GET https://fiatdock.com/status. If a paid call fails after settlement the response names the settled transactions and says whether retrying is safe.'
servers:
- url: https://fiatdock.com
tags:
- name: Dev
paths:
  /v1/dev/package:
    post:
      operationId: packageIntel
      description: 'Before adding a dependency: give an npm or PyPI package (and optionally an exact version; default latest). Returns every vulnerability OSV.dev lists for that version (ids, CVE aliases, severity as its database labels it, fixed versions), whether it is deprecated (npm) or yanked (PyPI), licence, https source repository, publish dates, latest version, last week''s downloads, runtime dependency and maintainer counts, and risk flags from a stated rule list. It reads registry metadata and advisories, not the code; ''no vulnerabilities'' means none known to OSV. An unknown package or version, or an outage, answers 4xx/502 and is not charged. Paid $0.0027 USDC via x402. MCP tool: package_intel.'
      requestBody:
        required: false
        content:
          application/json:
            example:
              name: lodash
              ecosystem: npm
              version: 4.17.20
            schema:
              type: object
              properties:
                name:
                  description: 'The package name: an npm package (lodash, @types/node) or a PyPI project (requests, Django)'
                  type: string
                  maxLength: 214
                  example: lodash
                ecosystem:
                  description: 'Which registry the name is on: npm (default) or pypi'
                  type: string
                  enum:
                  - npm
                  - pypi
                  example: npm
                version:
                  description: An exact published version to analyse (4.17.20, 2.31.0). Omit for the latest release; ranges like ^4 are refused
                  type: string
                  maxLength: 65
                  example: 4.17.20
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PackageIntel'
          description: npm / PyPI package safety and maintenance
        '400':
          description: an input the tool cannot use, or a field it does not read (not charged)
        '402':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaymentRequired'
          description: 'x402 v2 Payment Required: the exact requirements arrive base64-JSON in the PAYMENT-REQUIRED response header (pay $0.0027 USDC on base = CAIP-2 eip155 id), then retry with the PAYMENT-SIGNATURE header (x402 v2; the v1 name X-PAYMENT is also accepted). Nothing is charged on a 402 — retrying is always safe.'
        '404':
          description: nothing to answer for this input — e.g. an unknown coin, currency, ticker or token, or a search with no match (not charged)
        '429':
          description: Rate limited (global 120/min/IP; stricter buckets on /mcp, webhook, auth). Sleep exactly Retry-After seconds, then retry.
          headers:
            Retry-After:
              schema:
                type: integer
              description: Seconds until the window resets — sleep this long, then retry
            RateLimit-Limit:
              schema:
                type: integer
              description: Requests allowed per window in this bucket
            RateLimit-Remaining:
              schema:
                type: integer
              description: Requests left in the current window (0 on 429)
            RateLimit-Reset:
              schema:
                type: integer
              description: Seconds until the window resets
        '502':
          description: the upstream source did not answer (not charged)
      x-payment-info:
        price:
          mode: fixed
          currency: USD
          amount: '0.002700'
        protocols:
        - x402: {}
      tags:
      - Dev
      summary: Package intel
      x-summary-source: derived
    get:
      operationId: packageIntelGet
      description: 'Before adding a dependency: give an npm or PyPI package (and optionally an exact version; default latest). Returns every vulnerability OSV.dev lists for that version (ids, CVE aliases, severity as its database labels it, fixed versions), whether it is deprecated (npm) or yanked (PyPI), licence, https source repository, publish dates, latest version, last week''s downloads, runtime dependency and maintainer counts, and risk flags from a stated rule list. It reads registry metadata and advisories, not the code; ''no vulnerabilities'' means none known to OSV. An unknown package or version, or an outage, answers 4xx/502 and is not charged. Paid $0.0027 USDC via x402. MCP tool: package_intel. Also payable with GET: send the same inputs as query parameters (ADR-0175).'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PackageIntel'
          description: npm / PyPI package safety and maintenance
        '400':
          description: an input the tool cannot use, or a field it does not read (not charged)
        '402':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaymentRequired'
          description: 'x402 v2 Payment Required: the exact requirements arrive base64-JSON in the PAYMENT-REQUIRED response header (pay $0.0027 USDC on base = CAIP-2 eip155 id), then retry with the PAYMENT-SIGNATURE header (x402 v2; the v1 name X-PAYMENT is also accepted). Nothing is charged on a 402 — retrying is always safe.'
        '404':
          description: nothing to answer for this input — e.g. an unknown coin, currency, ticker or token, or a search with no match (not charged)
        '429':
          description: Rate limited (global 120/min/IP; stricter buckets on /mcp, webhook, auth). Sleep exactly Retry-After seconds, then retry.
          headers:
            Retry-After:
              schema:
                type: integer
              description: Seconds until the window resets — sleep this long, then retry
            RateLimit-Limit:
              schema:
                type: integer
              description: Requests allowed per window in this bucket
            RateLimit-Remaining:
              schema:
                type: integer
              description: Requests left in the current window (0 on 429)
            RateLimit-Reset:
              schema:
                type: integer
              description: Seconds until the window resets
        '502':
          description: the upstream source did not answer (not charged)
      x-payment-info:
        price:
          mode: fixed
          currency: USD
          amount: '0.002700'
        protocols:
        - x402: {}
      parameters:
      - name: name
        in: query
        required: false
        schema:
          type: string
        description: 'The package name: an npm package (lodash, @types/node) or a PyPI project (requests, Django)'
      - name: ecosystem
        in: query
        required: false
        schema:
          type: string
        description: 'Which registry the name is on: npm (default) or pypi'
      - name: version
        in: query
        required: false
        schema:
          type: string
        description: An exact published version to analyse (4.17.20, 2.31.0). Omit for the latest release; ranges like ^4 are refused
      tags:
      - Dev
      summary: Package intel get
      x-summary-source: derived
components:
  schemas:
    PaymentRequired:
      type: object
      description: The 402 body (ADR-0045). Nothing is charged and nothing is created on a 402 — retrying is always safe.
      properties:
        error:
          type: string
        priceUsd:
          type: number
          description: Price in dollars. Present on single-leg challenges; multi-leg challenges omit it — read `accepts`.
        accepts:
          type: array
          description: The exact payment terms to sign, mirrored from the PAYMENT-REQUIRED header.
          items:
            type: object
        hint:
          type: string
          description: How to pay, and what to do if you have no wallet.
        docs:
          type: string
      required:
      - error
      - accepts
      - hint
    PackageIntel:
      type: object
      description: Paid. npm / PyPI package safety and maintenance.
      properties:
        ecosystem:
          type: string
          enum:
          - npm
          - pypi
          description: 'The registry: npm or pypi'
        name:
          type: string
          description: The package name as the registry spells it
        version:
          type: string
          description: The version analysed (the latest when none was named)
        latestVersion:
          type:
          - string
          - 'null'
          description: The registry's latest release (npm's `latest` dist-tag; PyPI's current version)
        isLatest:
          type:
          - boolean
          - 'null'
          description: True when the analysed version is the latest
        description:
          type:
          - string
          - 'null'
          description: The package's own one-line description
        license:
          type:
          - string
          - 'null'
          description: The declared licence (SPDX expression where given), or null when none is declared
        repository:
          type:
          - string
          - 'null'
          description: The declared source repository as an https URL, or null
        homepage:
          type:
          - string
          - 'null'
          description: The declared homepage, or null
        deprecated:
          type:
          - string
          - 'null'
          description: 'npm: the deprecation message of this version; PyPI: ''yanked: <reason>'' when the release is yanked; null otherwise'
        publishedAt:
          type:
          - string
          - 'null'
          description: ISO time the analysed version was published (null when the registry could not be read for dates)
        latestPublishedAt:
          type:
          - string
          - 'null'
          description: ISO time the latest release was published
        daysSinceLatestRelease:
          type:
          - number
          - 'null'
          description: Whole days since the latest release was published
        downloadsLastWeek:
          type:
          - number
          - 'null'
          description: 'Downloads in the last 7 days (npm: api.npmjs.org; PyPI: pypistats.org last_week); null when the counter did not answer'
        dependencyCount:
          type:
          - number
          - 'null'
          description: Runtime dependencies this version declares (npm `dependencies`; PyPI `requires_dist` entries not tied to an extra); null when undeclared metadata makes it unknown
        maintainersCount:
          type:
          - number
          - 'null'
          description: Accounts allowed to publish (npm's current maintainers; PyPI's owners and maintainers)
        vulnerabilities:
          type: array
          items:
            type: object
            properties:
              id:
                type: string
                description: The OSV id (GHSA-…, PYSEC-…, MAL-…)
              aliases:
                type: array
                items:
                  type: string
                description: Other ids of the same flaw (CVE-…, the other database's id)
              summary:
                type:
                - string
                - 'null'
                description: The advisory's own one-line summary
              severity:
                type:
                - string
                - 'null'
                description: LOW / MODERATE / HIGH / CRITICAL as the advisory's own database labels it; null when it gives none
              cvssVector:
                type:
                - string
                - 'null'
                description: The advisory's CVSS vector string, when it has one
              fixedIn:
                type: array
                items:
                  type: string
                description: Versions the advisory says fix it (empty = no fixed release named)
              published:
                type:
                - string
                - 'null'
                description: When the advisory was published
              url:
                type: string
                description: The advisory on osv.dev
            required:
            - id
            - aliases
            - summary
            - severity
            - cvssVector
            - fixedIn
            - published
            - url
          description: Known vulnerabilities OSV.dev lists for THIS version, most severe first
        vulnerabilityCount:
          type: number
          description: Number of vulnerabilities listed (the same flaw published by two databases counts once)
        osvRecords:
          type: number
          description: OSV records returned before the same flaw from two databases was folded into one row
        riskFlags:
          type: array
          items:
            type: string
          description: 'Flags from a stated rule list (see note): malicious_package, deprecated, yanked, known_vulnerabilities, high_or_critical_vulnerability, newer_version_available, no_release_in_2_years, very_low_downloads, no_license, no_repository'
        source:
          type: string
          description: Where the data came from
        asOf:
          type: string
          description: ISO time of the oldest upstream read this answer used
        note:
          type: string
          description: How to read the answer, its rules and limits, and the data attribution
        defaulted:
          type: object
          properties:
            field:
              type: string
            to:
              type: string
            value:
              type: string
            note:
              type: string
          required:
          - field
          - to
          - value
          - note
          description: 'Present only when the body named no field: which package the answer is for, and why'
      required:
      - ecosystem
      - name
      - version
      - latestVersion
      - isLatest
      - description
      - license
      - repository
      - homepage
      - deprecated
      - publishedAt
      - latestPublishedAt
      - daysSinceLatestRelease
      - downloadsLastWeek
      - dependencyCount
      - maintainersCount
      - vulnerabilities
      - vulnerabilityCount
      - osvRecords
      - riskFlags
      - source
      - asOf
      - note
externalDocs:
  description: Agent skill file — what to run before acting on a token, an address or a counterparty (text/markdown, live prices and catalog)
  url: https://fiatdock.com/skill.md
x-payment-protocol:
  protocol: x402
  version: 2
  network: base
  asset: USDC
  payTo: '0xeB12bB2f52EeD33DBa6A00774E48324032Fd87C6'
  mode: per-call
  paid:
  - path: /v1/offramp/session
    method: POST
    priceUsd: 0.01
  - path: /v1/onramp/session
    method: POST
    priceUsd: 0.01
  - path: /v1/token/safety
    method: POST
    priceUsd: 0.0045
  - path: /v1/stablecoin/intel
    method: POST
    priceUsd: 0.002
  - path: /v1/chain/token-metadata
    method: POST
    priceUsd: 0.002
  - path: /v1/chain/gas-price
    method: POST
    priceUsd: 0.001
  - path: /v1/chain/block
    method: POST
    priceUsd: 0.001
  - path: /v1/chain/eth-balance
    method: POST
    priceUsd: 0.001
  - path: /v1/chain/usdc-balance
    method: POST
    priceUsd: 0.001
  - path: /v1/chain/tx-status
    method: POST
    priceUsd: 0.001
  - path: /v1/chain/address-intel
    method: POST
    priceUsd: 0.0045
  - path: /v1/chain/token-report
    method: POST
    priceUsd: 0.0045
  - path: /v1/web/read
    method: POST
    priceUsd: 0.0018
  - path: /v1/email/check
    method: POST
    priceUsd: 0.001
  - path: /v1/market/perp
    method: POST
    priceUsd: 0.001
  - path: /v1/markets/prediction
    method: POST
    priceUsd: 0.0045
  - path: /v1/defi/yields
    method: POST
    priceUsd: 0.001
  - path: /v1/fx/rates
    method: POST
    priceUsd: 0.001
  - path: /v1/chain/portfolio
    method: POST
    priceUsd: 0.0045
  - path: /v1/token/holders
    method: POST
    priceUsd: 0.0027
  - path: /v1/domain/intel
    method: POST
    priceUsd: 0.0045
  - path: /v1/web/contacts
    method: POST
    priceUsd: 0.0027
  - path: /v1/news/crypto
    method: POST
    priceUsd: 0.001
  - path: /v1/sec/filings
    method: POST
    priceUsd: 0.0027
  - path: /v1/text/prompt-check
    method: POST
    priceUsd: 0.0045
  - path: /v1/token/screener
    method: POST
    priceUsd: 0.009
  - path: /v1/papers/search
    method: POST
    priceUsd: 0.009
  - path: /v1/geo/satellite
    method: POST
    priceUsd: 0.009
  - path: /v1/web/seo-audit
    method: POST
    priceUsd: 0.009
  - path: /v1/x402/top
    method: POST
    priceUsd: 0.009
  - path: /v1/chain/ens
    method: POST
    priceUsd: 0.0027
  - path: /v1/time/convert
    method: POST
    priceUsd: 0.001
  - path: /v1/calendar/holidays
    method: POST
    priceUsd: 0.001
  - path: /v1/weather/forecast
    method: POST
    priceUsd: 0.0018
  - path: /v1/wiki/summary
    method: POST
    priceUsd: 0.0018
  - path: /v1/news/hackernews
    method: POST
    priceUsd: 0.0027
  - path: /v1/feed/read
    method: POST
    priceUsd: 0.0022
  - path: /v1/dev/package
    method: POST
    priceUsd: 0.0027
  - path: /v1/sec/financials
    method: POST
    priceUsd: 0.0045
  - path: /v1/token/verdict
    method: POST
    priceUsd: 0.009
  - path: /v1/market/backtest
    method: POST
    priceUsd: 0.009
  - path: /s/{id}
    method: POST
    priceUsd: null
    note: per-listing price; the 402 is authoritative
  free:
  - /v1/quote
  - /v1/token/price
  - /v1/orders/{partnerOrderId}
  - /v1/marketplace/services
  - /v1/marketplace/services/{id}
  - /v1/marketplace/demand
  - /v1/x402/search
  relay:
  - path: /v1/x402/call
    method: POST
    priceUsd: null
    note: carries the caller's PAYMENT-SIGNATURE to an index-listed x402 endpoint; that endpoint's 402 is authoritative and its payTo receives the money — FiatDock charges nothing here