> ## Documentation Index > Fetch the complete documentation index at: https://agora402.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Audit a seller > Paid, flat price (0.01 HBAR by default). Served by sellers running as auditor (or both). The auditor fetches the subject's manifest, checks it against the registry listing, probes the paid endpoints for payment integrity, reviews the descriptions with an LLM, and writes audit_started, one audit_stage per stage and a final attestation to the HCS audit topic, all paid by the auditor account. Buyers accept the attestation only when the HCS payer equals auditorAccount and contentHash matches the listing they hold. Send a fresh auditId (a_ plus 16 hex) so you can follow streamAuditEvents while this request is open. Any failure cancels settlement; an auditor refuses to attest itself. This endpoint is paid. Read [Paying for a request](/api/paying-for-a-request) for the 402 handshake, or let `BuyerAgent.audit()` handle it. ## OpenAPI ````yaml /openapi.yaml post /v1/audit openapi: 3.1.0 info: title: Agora402 seller API version: 1.0.0 description: >- HTTP API served by every Agora402 seller: free discovery documents, a free quote endpoint, and paid endpoints gated by x402 and settled on Hedera through the Blocky402 facilitator. Typical agent flow: getManifest (what is sold, at what price, paid to which account) -> requestQuote (lock a signed price, counter below list if you like) -> call the paid endpoint with the quoteId. The first call answers 402 with a PAYMENT-REQUIRED header; the retry carries PAYMENT-SIGNATURE; the response carries PAYMENT-RESPONSE with the Hedera transaction id. Then read listReceipts or the seller's HCS receipts topic to audit what was charged. All amounts are decimal strings in atomic units of the asset (tinybars for HBAR, 8 decimals); timestamps are ISO 8601 unless stated; quote expiry is unix seconds. servers: - url: http://localhost:4402 description: Local services seller (npm run dev) - url: http://localhost:4404 description: Local auditor (npm run dev) security: [] tags: - name: Discovery description: Free documents that describe the seller. Read these before paying anyone. - name: Negotiation description: Free, signed, time-limited price quotes. - name: Paid services description: x402-gated endpoints. Every call is a Hedera micropayment. - name: Trust description: Paid audits of other sellers, attested on the HCS audit topic. - name: Receipts description: What this seller has been paid for. paths: /v1/audit: post: tags: - Trust summary: Audit a seller description: >- Paid, flat price (0.01 HBAR by default). Served by sellers running as auditor (or both). The auditor fetches the subject's manifest, checks it against the registry listing, probes the paid endpoints for payment integrity, reviews the descriptions with an LLM, and writes audit_started, one audit_stage per stage and a final attestation to the HCS audit topic, all paid by the auditor account. Buyers accept the attestation only when the HCS payer equals auditorAccount and contentHash matches the listing they hold. Send a fresh auditId (a_ plus 16 hex) so you can follow streamAuditEvents while this request is open. Any failure cancels settlement; an auditor refuses to attest itself. operationId: requestAudit parameters: - $ref: '#/components/parameters/PaymentSignature' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AuditRequest' examples: bySubject: summary: Subject from the registry value: subject: >- uaid:aid:2NEpo7TZRRrLZSi2U;uid=agora-demo-seller;registry=agora402;proto=a2a;nativeId=hedera:testnet:0.0.5001234;domain=localhost:4402 auditId: a_3c9f1e7b2d5a8c04 byUrl: summary: Subject by URL, no registry needed value: sellerUrl: http://localhost:4402 auditId: a_3c9f1e7b2d5a8c04 responses: '200': description: >- Completed audit with its attestation and, when recorded, the HCS records headers: PAYMENT-RESPONSE: $ref: '#/components/headers/PaymentResponse' x-agora-usage: schema: type: string description: JSON {"auditId","subject","verdict","trustScore","stages"}. content: application/json: schema: $ref: '#/components/schemas/AuditResponse' example: auditId: a_3c9f1e7b2d5a8c04 subject: uaid: >- uaid:aid:2NEpo7TZRRrLZSi2U;uid=agora-demo-seller;registry=agora402;proto=a2a;nativeId=hedera:testnet:0.0.5001234;domain=localhost:4402 name: agora-demo-seller payTo: 0.0.5001234 attestation: v: 1 type: attestation auditId: a_3c9f1e7b2d5a8c04 subject: >- uaid:aid:2NEpo7TZRRrLZSi2U;uid=agora-demo-seller;registry=agora402;proto=a2a;nativeId=hedera:testnet:0.0.5001234;domain=localhost:4402 contentHash: >- 9f2c6a1e0b7d4c3a8e5f1d2b6c9a0e7f3d4b5a6c7e8f9a0b1c2d3e4f5a6b7c8d auditor: >- uaid:aid:5Rk2mQ8vLp3nXy7Wc;uid=agora-auditor;registry=agora402;proto=a2a;nativeId=hedera:testnet:0.0.5005678;domain=localhost:4404 auditorAccount: 0.0.5005678 verdict: safe trustScore: 96 risk: low summary: >- Manifest matches the registry, payments settle to the listed account, descriptions are accurate. capabilities: - llm chat completion - hbar usd rate findings: - severity: low title: Receipts topic not announced detail: >- The manifest omits receiptsTopicId, so buyers cannot audit past charges on HCS. model: llama-3.3-70b-versatile issuedAt: '2026-09-13T12:40:02.114Z' stages: - v: 1 type: audit_stage auditId: a_3c9f1e7b2d5a8c04 subject: >- uaid:aid:2NEpo7TZRRrLZSi2U;uid=agora-demo-seller;registry=agora402;proto=a2a;nativeId=hedera:testnet:0.0.5001234;domain=localhost:4402 contentHash: >- 9f2c6a1e0b7d4c3a8e5f1d2b6c9a0e7f3d4b5a6c7e8f9a0b1c2d3e4f5a6b7c8d auditor: >- uaid:aid:5Rk2mQ8vLp3nXy7Wc;uid=agora-auditor;registry=agora402;proto=a2a;nativeId=hedera:testnet:0.0.5005678;domain=localhost:4404 auditorAccount: 0.0.5005678 stage: manifest index: 1 total: 3 summary: Manifest is consistent with the registry listing. findings: [] model: deterministic completedAt: '2026-09-13T12:39:31.002Z' evidence: registryMatch: true topicId: 0.0.6012345 topicUrl: https://hashscan.io/testnet/topic/0.0.6012345 records: - transactionId: 0.0.5005678@1789560002.114000000 sequenceNumber: 42 recorded: true '400': description: >- Bad or reused auditId, subject not found, subject lookup without a registry, or the auditor auditing itself content: application/json: schema: $ref: '#/components/schemas/Error' examples: auditId: value: error: auditId must be fresh and match a_<16 hex> self: value: error: an auditor cannot attest itself subject: value: error: subject (uaid) or sellerUrl required '402': $ref: '#/components/responses/PaymentRequired' '502': description: >- The audit could not be completed. Settlement is cancelled; nothing is charged. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: audit could not be completed detail: seller manifest 503 at http://localhost:4402 components: parameters: PaymentSignature: name: PAYMENT-SIGNATURE in: header required: false schema: type: string description: >- x402 payment payload (base64 JSON) built from the PAYMENT-REQUIRED challenge of the 402 answer. Omit on the first call to receive the price. BuyerAgent and @x402/fetch set this for you. The legacy name X-PAYMENT is also accepted. schemas: AuditRequest: type: object description: Name the subject by uaid (needs a registry on the auditor) or by URL properties: subject: type: string description: >- uaid or listing name of the seller to audit, resolved through the registry sellerUrl: type: string format: uri description: Base URL of the seller; its manifest is fetched directly auditId: type: string pattern: ^a_[0-9a-f]{16}$ description: >- Fresh id you generate so you can stream progress while the request is open quoteId: type: string description: Quote to pin the price to AuditResponse: type: object required: - auditId - subject - attestation - stages - topicId - topicUrl - records - recorded properties: auditId: type: string subject: type: object properties: uaid: $ref: '#/components/schemas/Uaid' name: type: string payTo: $ref: '#/components/schemas/HederaEntityId' attestation: $ref: '#/components/schemas/Attestation' stages: type: array items: $ref: '#/components/schemas/AuditStage' topicId: type: - string - 'null' description: Audit topic, null on a dry run topicUrl: type: - string - 'null' format: uri records: type: array description: >- HCS publication results for audit_started, each stage and the attestation; empty on a dry run items: type: object additionalProperties: true recorded: type: boolean description: true when the trail was written to HCS Error: type: object required: - error properties: error: type: string description: Human-readable reason detail: type: string Uaid: type: string pattern: '^uaid:' description: HCS-14 universal agent id example: >- uaid:aid:2NEpo7TZRRrLZSi2U;uid=agora-demo-seller;registry=agora402;proto=a2a;nativeId=hedera:testnet:0.0.5001234;domain=localhost:4402 HederaEntityId: type: string pattern: ^\d+\.\d+\.\d+$ description: Hedera entity id, shard.realm.num example: 0.0.5001234 Attestation: type: object description: The verdict, written last to the audit topic by the auditor account required: - v - type - auditId - subject - contentHash - auditor - auditorAccount - verdict - trustScore - risk - summary - capabilities - findings - model - issuedAt properties: v: type: integer enum: - 1 type: type: string enum: - attestation auditId: type: string subject: $ref: '#/components/schemas/Uaid' contentHash: type: string pattern: ^[0-9a-f]{64}$ auditor: $ref: '#/components/schemas/Uaid' auditorAccount: $ref: '#/components/schemas/HederaEntityId' description: Must equal the HCS payer of the message for a buyer to accept it verdict: type: string enum: - safe - dangerous description: dangerous when any finding is high or critical trustScore: type: integer minimum: 0 maximum: 100 description: >- 100 minus penalties: low 4, medium 12, high 30, critical 60. Buyers default to a minimum of 70. risk: $ref: '#/components/schemas/Severity' description: Highest severity across stages summary: type: string capabilities: type: array items: type: string findings: type: array items: $ref: '#/components/schemas/AuditFinding' model: type: string issuedAt: type: string format: date-time AuditStage: type: object description: One completed stage, as written to the audit topic required: - v - type - auditId - subject - contentHash - auditor - auditorAccount - stage - index - total - summary - findings - model - completedAt properties: v: type: integer enum: - 1 type: type: string enum: - audit_stage auditId: type: string subject: $ref: '#/components/schemas/Uaid' contentHash: type: string pattern: ^[0-9a-f]{64}$ description: >- sha256 of the audited listing content (payTo, baseUrl, quotePath, facilitator, endpoints) auditor: $ref: '#/components/schemas/Uaid' auditorAccount: $ref: '#/components/schemas/HederaEntityId' stage: type: string index: type: integer minimum: 1 total: type: integer minimum: 1 summary: type: string findings: type: array items: $ref: '#/components/schemas/AuditFinding' model: type: string description: LLM that produced the stage, or deterministic completedAt: type: string format: date-time evidence: type: object additionalProperties: true description: >- Raw observations behind the stage (response only, not written to HCS) PaymentRequiredBody: type: object required: - error - endpoint - hint - quoteId properties: error: type: string enum: - payment required endpoint: type: string description: endpointId of the resource hint: type: string quoteId: type: - string - 'null' description: The quoteId you sent, if any Severity: type: string enum: - none - low - medium - high - critical AuditFinding: type: object required: - severity - title properties: severity: $ref: '#/components/schemas/Severity' title: type: string detail: type: string headers: PaymentResponse: schema: type: string description: >- x402 settlement result (base64 JSON) including the Hedera transaction id, e.g. 0.0.4009876@1789560131.552341000. Look it up on HashScan or through the mirror node. responses: PaymentRequired: description: >- No valid payment attached. The PAYMENT-REQUIRED header carries the x402 challenge (scheme exact, network, asset, amount, payTo, facilitator). Build the payment, retry with PAYMENT-SIGNATURE. headers: PAYMENT-REQUIRED: schema: type: string description: >- base64 JSON x402 challenge with the accepted payment options for this exact request content: application/json: schema: $ref: '#/components/schemas/PaymentRequiredBody' example: error: payment required endpoint: infer hint: >- POST /a2a/quote with {"endpointId":"infer"} to negotiate, then retry with the quoteId quoteId: null ````