Trust

Audit a seller

Paid, flat price (0.01 HBAR by default). Served by sellers running as auditor (or both). The auditor fetches the subject’s manifest, checks it against the registry listing, probes the paid endpoints for payment integrity, reviews the descriptions with an LLM, and writes audit_started, one audit_stage per stage and a final attestation to the HCS audit topic, all paid by the auditor account. Buyers accept the attestation only when the HCS payer equals auditorAccount and contentHash matches the listing they hold. Send a fresh auditId (a_ plus 16 hex) so you can follow streamAuditEvents while this request is open. Any failure cancels settlement; an auditor refuses to attest itself.

POST

audit

curl --request POST \
  --url http://localhost:4402/v1/audit \
  --header 'Content-Type: application/json' \
  --data '
{
  "subject": "uaid:aid:2NEpo7TZRRrLZSi2U;uid=agora-demo-seller;registry=agora402;proto=a2a;nativeId=hedera:testnet:0.0.5001234;domain=localhost:4402",
  "auditId": "a_3c9f1e7b2d5a8c04"
}
'

{
  "auditId": "a_3c9f1e7b2d5a8c04",
  "subject": {
    "uaid": "uaid:aid:2NEpo7TZRRrLZSi2U;uid=agora-demo-seller;registry=agora402;proto=a2a;nativeId=hedera:testnet:0.0.5001234;domain=localhost:4402",
    "name": "agora-demo-seller",
    "payTo": "0.0.5001234"
  },
  "attestation": {
    "v": 1,
    "type": "attestation",
    "auditId": "a_3c9f1e7b2d5a8c04",
    "subject": "uaid:aid:2NEpo7TZRRrLZSi2U;uid=agora-demo-seller;registry=agora402;proto=a2a;nativeId=hedera:testnet:0.0.5001234;domain=localhost:4402",
    "contentHash": "9f2c6a1e0b7d4c3a8e5f1d2b6c9a0e7f3d4b5a6c7e8f9a0b1c2d3e4f5a6b7c8d",
    "auditor": "uaid:aid:5Rk2mQ8vLp3nXy7Wc;uid=agora-auditor;registry=agora402;proto=a2a;nativeId=hedera:testnet:0.0.5005678;domain=localhost:4404",
    "auditorAccount": "0.0.5005678",
    "verdict": "safe",
    "trustScore": 96,
    "risk": "low",
    "summary": "Manifest matches the registry, payments settle to the listed account, descriptions are accurate.",
    "capabilities": [
      "llm chat completion",
      "hbar usd rate"
    ],
    "findings": [
      {
        "severity": "low",
        "title": "Receipts topic not announced",
        "detail": "The manifest omits receiptsTopicId, so buyers cannot audit past charges on HCS."
      }
    ],
    "model": "llama-3.3-70b-versatile",
    "issuedAt": "2026-09-13T12:40:02.114Z"
  },
  "stages": [
    {
      "v": 1,
      "type": "audit_stage",
      "auditId": "a_3c9f1e7b2d5a8c04",
      "subject": "uaid:aid:2NEpo7TZRRrLZSi2U;uid=agora-demo-seller;registry=agora402;proto=a2a;nativeId=hedera:testnet:0.0.5001234;domain=localhost:4402",
      "contentHash": "9f2c6a1e0b7d4c3a8e5f1d2b6c9a0e7f3d4b5a6c7e8f9a0b1c2d3e4f5a6b7c8d",
      "auditor": "uaid:aid:5Rk2mQ8vLp3nXy7Wc;uid=agora-auditor;registry=agora402;proto=a2a;nativeId=hedera:testnet:0.0.5005678;domain=localhost:4404",
      "auditorAccount": "0.0.5005678",
      "stage": "manifest",
      "index": 1,
      "total": 3,
      "summary": "Manifest is consistent with the registry listing.",
      "findings": [],
      "model": "deterministic",
      "completedAt": "2026-09-13T12:39:31.002Z",
      "evidence": {
        "registryMatch": true
      }
    }
  ],
  "topicId": "0.0.6012345",
  "topicUrl": "https://hashscan.io/testnet/topic/0.0.6012345",
  "records": [
    {
      "transactionId": "0.0.5005678@1789560002.114000000",
      "sequenceNumber": 42
    }
  ],
  "recorded": true
}

This endpoint is paid. Read Paying for a request for the 402 handshake, or let BuyerAgent.audit() handle it.

Headers

PAYMENT-SIGNATURE

string

x402 payment payload (base64 JSON) built from the PAYMENT-REQUIRED challenge of the 402 answer. Omit on the first call to receive the price. BuyerAgent and @x402/fetch set this for you. The legacy name X-PAYMENT is also accepted.

Body

application/json

Name the subject by uaid (needs a registry on the auditor) or by URL

subject

string

uaid or listing name of the seller to audit, resolved through the registry

sellerUrl

string<uri>

Base URL of the seller; its manifest is fetched directly

auditId

string

Fresh id you generate so you can stream progress while the request is open

Pattern: ^a_[0-9a-f]{16}$

quoteId

string

Quote to pin the price to

Response

Completed audit with its attestation and, when recorded, the HCS records

auditId

string

required

subject

object

required

Show child attributes

attestation

object

required

The verdict, written last to the audit topic by the auditor account

Show child attributes

stages

object[]

required

Show child attributes

topicId

string | null

required

Audit topic, null on a dry run

topicUrl

string<uri> | null

required

records

object[]

required

HCS publication results for audit_started, each stage and the attestation; empty on a dry run

recorded

boolean

required

true when the trail was written to HCS

⌘I

curl --request POST \
  --url http://localhost:4402/v1/audit \
  --header 'Content-Type: application/json' \
  --data '
{
  "subject": "uaid:aid:2NEpo7TZRRrLZSi2U;uid=agora-demo-seller;registry=agora402;proto=a2a;nativeId=hedera:testnet:0.0.5001234;domain=localhost:4402",
  "auditId": "a_3c9f1e7b2d5a8c04"
}
'

{
  "auditId": "a_3c9f1e7b2d5a8c04",
  "subject": {
    "uaid": "uaid:aid:2NEpo7TZRRrLZSi2U;uid=agora-demo-seller;registry=agora402;proto=a2a;nativeId=hedera:testnet:0.0.5001234;domain=localhost:4402",
    "name": "agora-demo-seller",
    "payTo": "0.0.5001234"
  },
  "attestation": {
    "v": 1,
    "type": "attestation",
    "auditId": "a_3c9f1e7b2d5a8c04",
    "subject": "uaid:aid:2NEpo7TZRRrLZSi2U;uid=agora-demo-seller;registry=agora402;proto=a2a;nativeId=hedera:testnet:0.0.5001234;domain=localhost:4402",
    "contentHash": "9f2c6a1e0b7d4c3a8e5f1d2b6c9a0e7f3d4b5a6c7e8f9a0b1c2d3e4f5a6b7c8d",
    "auditor": "uaid:aid:5Rk2mQ8vLp3nXy7Wc;uid=agora-auditor;registry=agora402;proto=a2a;nativeId=hedera:testnet:0.0.5005678;domain=localhost:4404",
    "auditorAccount": "0.0.5005678",
    "verdict": "safe",
    "trustScore": 96,
    "risk": "low",
    "summary": "Manifest matches the registry, payments settle to the listed account, descriptions are accurate.",
    "capabilities": [
      "llm chat completion",
      "hbar usd rate"
    ],
    "findings": [
      {
        "severity": "low",
        "title": "Receipts topic not announced",
        "detail": "The manifest omits receiptsTopicId, so buyers cannot audit past charges on HCS."
      }
    ],
    "model": "llama-3.3-70b-versatile",
    "issuedAt": "2026-09-13T12:40:02.114Z"
  },
  "stages": [
    {
      "v": 1,
      "type": "audit_stage",
      "auditId": "a_3c9f1e7b2d5a8c04",
      "subject": "uaid:aid:2NEpo7TZRRrLZSi2U;uid=agora-demo-seller;registry=agora402;proto=a2a;nativeId=hedera:testnet:0.0.5001234;domain=localhost:4402",
      "contentHash": "9f2c6a1e0b7d4c3a8e5f1d2b6c9a0e7f3d4b5a6c7e8f9a0b1c2d3e4f5a6b7c8d",
      "auditor": "uaid:aid:5Rk2mQ8vLp3nXy7Wc;uid=agora-auditor;registry=agora402;proto=a2a;nativeId=hedera:testnet:0.0.5005678;domain=localhost:4404",
      "auditorAccount": "0.0.5005678",
      "stage": "manifest",
      "index": 1,
      "total": 3,
      "summary": "Manifest is consistent with the registry listing.",
      "findings": [],
      "model": "deterministic",
      "completedAt": "2026-09-13T12:39:31.002Z",
      "evidence": {
        "registryMatch": true
      }
    }
  ],
  "topicId": "0.0.6012345",
  "topicUrl": "https://hashscan.io/testnet/topic/0.0.6012345",
  "records": [
    {
      "transactionId": "0.0.5005678@1789560002.114000000",
      "sequenceNumber": 42
    }
  ],
  "recorded": true
}

Overview

Discovery

Negotiation

Paid services

Trust

Receipts

SDK reference

Audit a seller

Headers

Body

Response