x402station.io API reference
Current decoy / zombie blacklist
Export currently flagged active endpoints so an agent can seed a local denylist.
This HTML page is served by GET /api/v1/catalog/decoys. The paid API operation remains POST /api/v1/catalog/decoys.
x402 challenge example
HTTP/1.1 402 Payment Required
payment-required: <base64 PaymentRequiredResponse>
www-authenticate: x402
content-type: application/json; charset=utf-8
{
"x402Version": 2,
"error": "Payment required",
"resource": {
"url": "https://x402station.io/api/v1/catalog/decoys",
"description": "Current decoy / zombie blacklist"
},
"accepts": [
{
"scheme": "exact",
"network": "eip155:8453",
"asset": "USDC",
"amount": "5000",
"payTo": "0x4053338C7cB38624C0bc23c900F78Cf8470b4E38",
"maxTimeoutSeconds": 300
}
]
}
Request body
{}
Success response
{
"generated_at": "2026-06-12T00:00:00.000Z",
"count": 2,
"endpoints": [
{
"url": "https://api.example.com/decoy",
"warnings": [
"decoy_price_extreme"
]
},
{
"url": "https://api.example.com/dead",
"warnings": [
"dead_7d"
]
}
]
}
Error codes
| status | meaning |
|---|---|
400 | Malformed JSON body, invalid URL, or missing required field. |
402 | Payment required. Decode payment-required, sign x402, retry. |
503 | Query/probe pipeline timeout. Treat as failed preflight; do not pay target blindly. |
Notes
- Internal catalog/probe data refreshes every few minutes; hourly pulls are enough.