Preflight a URL through one stable HTTP endpoint

1. Discover capability and prepare

POST https://api.getacqpath.com/v1/rights/preflight with {resource,purpose,tier:"fresh",max_total_micro:"20000"}. A prepared 402 includes price/network/asset and the required private request binding. Empty POST is discovery-only. HTTP 200 with available:false and charge_micro:"0" is not a purchased report. There is no AcqPath account, API key or operator token.

Supported paid purposes: ai-input, ai-index, ai-train, search. Start with GET /v1/capabilities. Do not call the disabled acqpath_quote routing tool.

{
  "resource": "https://rslstandard.org/",
  "purpose": "ai-input",
  "tier": "fresh",
  "max_total_micro": "20000"
}

2. Inspect the 402

Fresh 0.02 USDC; deep 0.05 USDC. Base mainnet eip155:8453; USDC 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913; recipient 0xf69DBbd053fb0Fbc78ADfdB1BFe3b0D1F57300ec. The verified signed offer is authoritative; paying buys the report, not content rights.

A stranger can inspect the endpoint and prepare a real LICENSE_REQUIRED resource without an AcqPath API key. Preserve X-AcqPath-Request privately. A decoded header is not signature verification.

3. Payment compatibility boundary

The public endpoint requires acqpath-request-binding nonce support. Unmodified random-nonce x402 clients, Payments MCP and generic paid proxies are not verified compatible. Do not sign or submit until the buyer implementation verifies the signed binding and offer, pins terms, persists the request and supports the required nonce. No owner-funded indexing payment is requested or permitted.

Standard x402 v2 uses PAYMENT-REQUIRED, PAYMENT-SIGNATURE and PAYMENT-RESPONSE. After verifying the offer, an extension-aware buyer must sign the exact bound EIP-3009 nonce and retain identical normalized input and request context. Do not modify a standard signer nonce after signing. The repository legacy SDK targets quote/claim report URLs and is not a drop-in public endpoint client.

4. Successful signed output

The GET contract at the same endpoint describes the JSON schema. Successful paid output contains report, evidence, payment_settlement and delivery_proof. Verify Ed25519 evidence, signed receipt, source/purpose and exact amount/transaction binding before accepting it. Published examples are synthetic; no external paid delivery has yet been proven.

On uncertainty preserve the same checkpoint and request; never generate a second signature. A settlement response is not independent chain finality or duplicate-charge proof.

ALLOW_DECLARED is observed evidence, not permission. DENY_DECLARED and LICENSE_REQUIRED require a hold or applicable license review. UNKNOWN stays UNKNOWN. No legal advice, legal clearance, ownership verification or license acquisition. HTTP 403 is not bypassed.

Examples and workflows

JavaScript and Python examples run only the unpaid HTTP preparation; TypeScript maps RAG, crawler, research, training and search workflows. A generic paid-client example remains blocked by the required extension rather than pretending it works.