Horizon Pulse Vuln API

openapi: 3.2.0
info:
  title: Horizon Pulse Vuln API
  version: 1.1.0
  termsOfService: https://horizonpulse.dev/terms/buyer
  summary: Pay-per-call APIs for AI agents, settled in USDC on Base, Solana or Polygon, or RLUSD on the XRP Ledger, with x402.
  description: 'Pay-per-call APIs for AI agents, paid in USDC on Base, Solana or Polygon, or RLUSD on the XRP Ledger, with x402: web search, page fetch and extract, PDF to text, an HTTP proxy, and crypto market data. No signup or API key.


    On Base, you only pay for a successful response; errors are not charged except where an operation says so (for /api/tx-status, a not_found status is a charged answer; poll again after pollAgainSeconds). These no-charge statements are made for USDC on Base. On USDC on Solana, and RLUSD on the XRP Ledger, a refused or failed request may still be charged. charged: false means Horizon Pulse did not settle the payment; on USDC on Solana, and RLUSD on the XRP Ledger, this is not a guarantee that no funds moved. Every paid operation carries `x-payment-info` with the exact price, asset, network and payTo of its Base entry; these match the 402 challenge and https://horizonpulse.dev/.well-known/x402. The 402 challenge also offers the same price in USDC on Solana mainnet (`exact`, network solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp, USDC mint EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v, payTo BjY98A6dS3GGLZdz2zHy8wK7XAwnQgNhCc66mfmBTRPz, PayAI facilitator https://facilitator.payai.network), and in native USDC on Polygon PoS mainnet (`exact`, network eip155:137, USDC 0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359, payTo 0x5b32c973596078a967562ca652761404f19be0e9, facilitator: Coinbase CDP), and in RLUSD on the XRP Ledger mainnet (`exact`, network xrpl:0, currency RLUSD = 524C555344000000000000000000000000000000, issuer rMxCKbEDwqr76QuheSUMdEGf4B9xJ8m5De, payTo r3FbirL83RAB2CwnUdxE5pCohMkuo6LQcf, verified on the validated ledger). Recorded example responses (fixed input, dated, informational; not paid operations): GET /api/demo/{route}.


    Agent integration: step-by-step skill at https://horizonpulse.dev/skill.md; guide with MCP setup at https://horizonpulse.dev/agents (hosted MCP at https://horizonpulse.dev/mcp for x402-aware clients, plus a local stdio MCP server in the repo''s mcp/ folder that pays from your own wallet with spend caps).


    Services for API owners (web pages, not API operations; not paid via x402): Bazaar listing fix at https://horizonpulse.dev/listing-fix; agent promotion at https://horizonpulse.dev/agent-promotion.'
  contact:
    name: Horizon Pulse
    email: horizonpulse.co@proton.me
    url: https://horizonpulse.dev
  x-guidance: 'Read PAYMENT-REQUIRED (base64 JSON). Pay exact USDC on Base (CDP), Solana (PayAI feePayer), Polygon, or RLUSD on XRPL at the listed payTo. Unpaid samples: /api/demo/{route}. Skill: /skill.md. Hosted MCP: /mcp (Base USDC only).'
servers:
- url: https://horizonpulse.dev
  description: Production
security:
- x402: []
tags:
- name: Vuln
paths:
  /api/vuln/check:
    get:
      operationId: getVulnCheck
      summary: Known-vulnerability check (CVE or package) ($0.02)
      description: 'CVE/package lookup: NVD CVSS, KEV status, GHSA ranges. USDC on Base or Polygon. Sources: NVD API, CISA KEV (CC0), GitHub Advisory Database (CC BY 4.0, https://github.com/advisories). This product uses the NVD API but is not endorsed or certified by the NVD. Not affiliated with or endorsed by NIST, CISA, DHS or GitHub. Not financial, investment, tax, legal or health advice. Quotes about tokens, securities or other financial products are not a recommendation to buy, sell or hold anything. On USDC on Base, errors are not charged, apart from the exceptions noted on a route. On USDC on Solana, and RLUSD on the XRP Ledger, a refused or failed request may still be charged. On Polygon (native USDC), a request is settled only when it succeeds (HTTP status below 400). Failed requests are not charged.'
      x-payment-info:
        protocol: x402
        x402Version: 2
        scheme: exact
        network: eip155:8453
        asset: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913'
        assetSymbol: USDC
        decimals: 6
        priceUsd: $0.02
        amount: '20000'
        payTo: '0x5b32c973596078a967562ca652761404f19be0e9'
        facilitator: https://api.cdp.coinbase.com/platform/v2/x402
        networks:
        - eip155:8453
        - eip155:137
        polygon:
          network: eip155:137
          asset: '0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359'
          payTo: '0x5b32c973596078a967562ca652761404f19be0e9'
      responses:
        '200':
          description: Result.
          content:
            application/json:
              schema:
                type: object
        '400':
          description: Bad input. Not charged.
          content:
            application/json:
              schema:
                type: object
        '402':
          description: 'Payment required: PAYMENT-REQUIRED header, $0.02 USDC on Base or Polygon.'
          content:
            application/json:
              schema:
                type: object
      tags:
      - Vuln
  /api/vuln/lockfile:
    post:
      operationId: postVulnLockfile
      summary: npm package-lock triage ($0.05)
      description: 'Batch triage of one npm package-lock.json (v2 or v3) against an injected reviewed-advisory snapshot. Returns affected locked versions, GHSA links, and the advisory''s reported patched versions, ordered by severity and patchability. Lockfile presence is not a runtime install and is not a reachability finding. Ambiguous entries are UNKNOWN. Not a security audit. USDC on Base only. The EIP-3009 nonce is lockfileBindingNonce over the exact POST body. Signing instructions: https://horizonpulse.dev/lockfile-signing. A client-chosen random nonce is rejected.'
      x-payment-info:
        protocol: x402
        x402Version: 2
        scheme: exact
        network: eip155:8453
        asset: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913'
        assetSymbol: USDC
        decimals: 6
        priceUsd: $0.05
        amount: '50000'
        payTo: '0x5b32c973596078a967562ca652761404f19be0e9'
        facilitator: https://api.cdp.coinbase.com/platform/v2/x402
      responses:
        '200':
          description: Result.
          content:
            application/json:
              schema:
                type: object
        '400':
          description: Bad input. Not charged.
          content:
            application/json:
              schema:
                type: object
        '402':
          description: 'Payment required: PAYMENT-REQUIRED header, $0.05 USDC on Base only.'
          content:
            application/json:
              schema:
                type: object
      tags:
      - Vuln
components:
  securitySchemes:
    x402:
      type: apiKey
      in: header
      name: PAYMENT-SIGNATURE
      description: x402 v2 payment payload (base64 JSON), built from the 402 PAYMENT-REQUIRED challenge. No account or API key. See https://www.x402.org/.
externalDocs:
  description: 'Agent guide: discovery, the x402 pay flow, skill file and MCP setup'
  url: https://horizonpulse.dev/agents