The paid operation
POST https://api.zerion.io/v1/wallets/simulation/transaction/
currently declares a 200 application/json response whose root requires
data, but the nested data schema does not require attributes.
For a machine buyer that needs simulation findings, data alone guarantees
only an envelope. The response contract does not guarantee data.attributes,
even though that field is described.
A credential-free static audit against the live OpenAPI returns:
- operation:
post_wallets_simulation_transaction
- price: 0.01 USD
- advertised protocols: x402 and MPP
- required root paths:
data
- buyer-required missing path:
data.attributes
- target POST requests sent: 0
- payments sent: 0
Reproduction:
git clone https://github.com/epistemedeus/agent-payment-integrity.git
cd agent-payment-integrity
git checkout v0.1.0-candidate.4
npm ci --ignore-scripts
node cli.mjs audit \
--origin https://api.zerion.io \
--method POST \
--route /v1/wallets/simulation/transaction/ \
--required-paths data.attributes \
--max-routes 1 \
--public-dns
Smallest contract repair, if every successful simulation always includes
attributes:
{
"type": "object",
"required": ["attributes"],
"properties": {
"attributes": {
"type": "object",
"description": "Resource attributes; see https://developers.zerion.io"
}
}
}If attributes is legitimately optional on a 200 response, then the operation
needs a different required decision field or a documented success variant that
lets buyers know what useful output is guaranteed.
This report does not claim a runtime delivery failure. It identifies only the
live OpenAPI guarantee needed before an autonomous buyer can authorize the paid
call.
The paid operation
POST https://api.zerion.io/v1/wallets/simulation/transaction/currently declares a 200
application/jsonresponse whose root requiresdata, but the nesteddataschema does not requireattributes.For a machine buyer that needs simulation findings,
dataalone guaranteesonly an envelope. The response contract does not guarantee
data.attributes,even though that field is described.
A credential-free static audit against the live OpenAPI returns:
post_wallets_simulation_transactiondatadata.attributesReproduction:
git clone https://github.com/epistemedeus/agent-payment-integrity.git cd agent-payment-integrity git checkout v0.1.0-candidate.4 npm ci --ignore-scripts node cli.mjs audit \ --origin https://api.zerion.io \ --method POST \ --route /v1/wallets/simulation/transaction/ \ --required-paths data.attributes \ --max-routes 1 \ --public-dnsSmallest contract repair, if every successful simulation always includes
attributes:
{ "type": "object", "required": ["attributes"], "properties": { "attributes": { "type": "object", "description": "Resource attributes; see https://developers.zerion.io" } } }If
attributesis legitimately optional on a 200 response, then the operationneeds a different required decision field or a documented success variant that
lets buyers know what useful output is guaranteed.
This report does not claim a runtime delivery failure. It identifies only the
live OpenAPI guarantee needed before an autonomous buyer can authorize the paid
call.