Mmpp.ninja safe scan

Service record

Zerion API

https://api.zerion.io/
observed-mpp

Interpreted onchain wallet data for apps and agents: portfolios, token and DeFi positions, PnL, labeled transaction history, NFTs, token prices and swap quotes across 40+ chains and Solana. Enriched and human-readable, not raw RPC logs. Pay per call in USDC via x402 or MPP — no API key, no signup. Full documentation: https://developers.zerion.io

Implementation fingerprint
custom 35% confidence
Fingerprint evidence
valid 402 Payment challenge observed without implementation-specific marker
First seen
Aug 25, 2026, 6:43 PM UTC
Last seen
Oct 9, 2026, 6:24 PM UTC
Origin
https://api.zerion.io
Tags
None advertised

Payment surface

37 MPP endpoints

This count includes endpoints established by catalog, OpenAPI, or valid runtime 402 evidence. It does not count every URL the harmless scanner attempted.

This bounded detail view shows 25 endpoints. Continue with the next API page or the endpoint index.

JSON record →
GET
https://api.zerion.io/v1/chains/
Supported chains
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 9, 12:21 PM UTC
tempochargechallenge10000 0x20C000000000000000000000b9537d11c60E8b50
Recipient
0xD07C06a650a88bBCF4f0c4fbf2c6c08c9a60AcC6
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://api.zerion.io/v1/chains/%7Bchain_id%7D
Chain by ID
Status: not probedTLS: not-testedRedirects: unknownChallenge: not observedLast probe: unknown time
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://api.zerion.io/v1/dapps/
Listed dapps
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 9, 12:20 PM UTC
tempochargechallenge10000 0x20C000000000000000000000b9537d11c60E8b50
Recipient
0xD07C06a650a88bBCF4f0c4fbf2c6c08c9a60AcC6
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://api.zerion.io/v1/dapps/%7Bdapp_id%7D
Dapp by ID
Status: not probedTLS: not-testedRedirects: unknownChallenge: not observedLast probe: unknown time
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://api.zerion.io/v1/fungibles/
Search fungible tokens
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 9, 12:19 PM UTC
tempochargechallenge10000 0x20C000000000000000000000b9537d11c60E8b50
Recipient
0xD07C06a650a88bBCF4f0c4fbf2c6c08c9a60AcC6
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://api.zerion.io/v1/fungibles/%7Bfungible_id%7D
Fungible token by ID
Status: not probedTLS: not-testedRedirects: unknownChallenge: not observedLast probe: unknown time
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://api.zerion.io/v1/fungibles/%7Bfungible_id%7D/charts/%7Bchart_period%7D
Token price chart
Status: not probedTLS: not-testedRedirects: unknownChallenge: not observedLast probe: unknown time
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://api.zerion.io/v1/fungibles/by-implementation
Token by chain implementation address
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 9, 06:22 PM UTC
tempochargechallenge10000 0x20C000000000000000000000b9537d11c60E8b50
Recipient
0xD07C06a650a88bBCF4f0c4fbf2c6c08c9a60AcC6
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://api.zerion.io/v1/fungibles/by-implementation/charts/%7Bchart_period%7D
Token price chart by implementation address
Status: not probedTLS: not-testedRedirects: unknownChallenge: not observedLast probe: unknown time
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://api.zerion.io/v1/gas-prices/
Gas prices across chains
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 8, 06:28 PM UTC
tempochargechallenge10000 0x20C000000000000000000000b9537d11c60E8b50
Recipient
0xD07C06a650a88bBCF4f0c4fbf2c6c08c9a60AcC6
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://api.zerion.io/v1/nfts/
NFTs by IDs
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 9, 12:26 PM UTC
tempochargechallenge10000 0x20C000000000000000000000b9537d11c60E8b50
Recipient
0xD07C06a650a88bBCF4f0c4fbf2c6c08c9a60AcC6
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://api.zerion.io/v1/nfts/%7Bnft_id%7D
NFT metadata by ID
Status: not probedTLS: not-testedRedirects: unknownChallenge: not observedLast probe: unknown time
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://api.zerion.io/v1/swap/fungibles/
Swappable tokens
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 9, 12:21 PM UTC
tempochargechallenge10000 0x20C000000000000000000000b9537d11c60E8b50
Recipient
0xD07C06a650a88bBCF4f0c4fbf2c6c08c9a60AcC6
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://api.zerion.io/v1/swap/offers/
Swap and bridge offers
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 9, 06:19 AM UTC
tempochargechallenge10000 0x20C000000000000000000000b9537d11c60E8b50
Recipient
0xD07C06a650a88bBCF4f0c4fbf2c6c08c9a60AcC6
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://api.zerion.io/v1/swap/quotes/
Swap and bridge quotes
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 9, 06:23 PM UTC
tempochargechallenge10000 0x20C000000000000000000000b9537d11c60E8b50
Recipient
0xD07C06a650a88bBCF4f0c4fbf2c6c08c9a60AcC6
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://api.zerion.io/v1/tx-subscriptions/
List transaction subscriptions
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 9, 06:24 PM UTC
tempochargechallenge10000 0x20C000000000000000000000b9537d11c60E8b50
Recipient
0xD07C06a650a88bBCF4f0c4fbf2c6c08c9a60AcC6
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
POST
https://api.zerion.io/v1/tx-subscriptions/
Create a transaction subscription (webhook)
Status: not probedTLS: not-testedRedirects: unknownChallenge: not observedLast probe: unknown time
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
DELETE
https://api.zerion.io/v1/tx-subscriptions/%7Bsubscription_id%7D
Delete a subscription
Status: not probedTLS: not-testedRedirects: unknownChallenge: not observedLast probe: unknown time
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://api.zerion.io/v1/tx-subscriptions/%7Bsubscription_id%7D
Subscription by ID
Status: not probedTLS: not-testedRedirects: unknownChallenge: not observedLast probe: unknown time
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
PATCH
https://api.zerion.io/v1/tx-subscriptions/%7Bsubscription_id%7D/callback_url
Update subscription webhook URL
Status: not probedTLS: not-testedRedirects: unknownChallenge: not observedLast probe: unknown time
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
PATCH
https://api.zerion.io/v1/tx-subscriptions/%7Bsubscription_id%7D/chain_ids
Update subscription chains
Status: not probedTLS: not-testedRedirects: unknownChallenge: not observedLast probe: unknown time
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
PATCH
https://api.zerion.io/v1/tx-subscriptions/%7Bsubscription_id%7D/disable
Disable a subscription
Status: not probedTLS: not-testedRedirects: unknownChallenge: not observedLast probe: unknown time
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
PATCH
https://api.zerion.io/v1/tx-subscriptions/%7Bsubscription_id%7D/enable
Enable a subscription
Status: not probedTLS: not-testedRedirects: unknownChallenge: not observedLast probe: unknown time
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://api.zerion.io/v1/tx-subscriptions/%7Bsubscription_id%7D/wallets
Wallets in a subscription
Status: not probedTLS: not-testedRedirects: unknownChallenge: not observedLast probe: unknown time
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
PATCH
https://api.zerion.io/v1/tx-subscriptions/%7Bsubscription_id%7D/wallets
Add or remove subscription wallets
Status: not probedTLS: not-testedRedirects: unknownChallenge: not observedLast probe: unknown time
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.01 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.

Probe coverage

49 harmless observations

These are bounded unauthenticated requests and scanner-policy stops. A response without MPP evidence remains a discovery result, not a security failure.

GET https://api.zerion.io/v1/tx-subscriptions/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 6:24 PM UTC

GET https://api.zerion.io/v1/swap/quotes/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 6:23 PM UTC

GET https://api.zerion.io/v1/fungibles/by-implementation

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 6:22 PM UTC

GET https://api.zerion.io/v1/nfts/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 12:26 PM UTC

GET https://api.zerion.io/v1/swap/fungibles/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 12:21 PM UTC

GET https://api.zerion.io/v1/chains/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 12:21 PM UTC

GET https://api.zerion.io/v1/dapps/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 12:20 PM UTC

GET https://api.zerion.io/v1/fungibles/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 12:19 PM UTC

GET https://api.zerion.io/v1/swap/offers/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 6:19 AM UTC

GET https://api.zerion.io/v1/gas-prices/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 8, 2026, 6:28 PM UTC

GET https://api.zerion.io/.well-known/api-catalog

HTTP 404

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 4, 2026, 6:24 AM UTC

GET https://api.zerion.io/openapi.json

HTTP 200

45,084 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 3, 2026, 12:18 PM UTC

GET https://api.zerion.io/

HTTP 200

411 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 2, 2026, 6:20 AM UTC

GET https://api.zerion.io/v1/tx-subscriptions/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 30, 2026, 6:23 PM UTC

GET https://api.zerion.io/v1/swap/quotes/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 30, 2026, 6:22 PM UTC

GET https://api.zerion.io/v1/fungibles/by-implementation

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 30, 2026, 6:22 PM UTC

GET https://api.zerion.io/v1/nfts/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 30, 2026, 12:21 PM UTC

GET https://api.zerion.io/v1/swap/fungibles/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 30, 2026, 12:20 PM UTC

GET https://api.zerion.io/v1/chains/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 30, 2026, 12:20 PM UTC

GET https://api.zerion.io/v1/dapps/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 30, 2026, 12:19 PM UTC

GET https://api.zerion.io/v1/fungibles/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 30, 2026, 12:19 PM UTC

GET https://api.zerion.io/v1/swap/offers/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 30, 2026, 6:20 AM UTC

GET https://api.zerion.io/v1/gas-prices/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 29, 2026, 6:18 PM UTC

GET https://api.zerion.io/.well-known/api-catalog

HTTP 404

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 25, 2026, 12:25 AM UTC

GET https://api.zerion.io/openapi.json

HTTP 200

45,084 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 24, 2026, 6:18 AM UTC

GET https://api.zerion.io/

HTTP 200

411 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 23, 2026, 6:17 AM UTC

GET https://api.zerion.io/v1/tx-subscriptions/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 21, 2026, 12:23 PM UTC

GET https://api.zerion.io/v1/swap/quotes/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 21, 2026, 12:22 PM UTC

GET https://api.zerion.io/v1/fungibles/by-implementation

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 21, 2026, 12:21 PM UTC

GET https://api.zerion.io/v1/nfts/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 21, 2026, 6:23 AM UTC

GET https://api.zerion.io/v1/swap/fungibles/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 21, 2026, 6:22 AM UTC

GET https://api.zerion.io/v1/chains/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 21, 2026, 6:21 AM UTC

GET https://api.zerion.io/v1/dapps/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 21, 2026, 6:20 AM UTC

GET https://api.zerion.io/v1/fungibles/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 21, 2026, 6:19 AM UTC

GET https://api.zerion.io/v1/swap/offers/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 21, 2026, 12:20 AM UTC

GET https://api.zerion.io/v1/gas-prices/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 20, 2026, 6:19 PM UTC

GET https://api.zerion.io/.well-known/api-catalog

HTTP 404

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 16, 2026, 12:24 AM UTC

GET https://api.zerion.io/openapi.json

HTTP 200

45,084 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 15, 2026, 6:18 AM UTC

GET https://api.zerion.io/

HTTP 200

411 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 14, 2026, 6:18 AM UTC

GET https://api.zerion.io/v1/tx-subscriptions/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 12, 2026, 6:25 AM UTC

GET https://api.zerion.io/v1/swap/quotes/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 12, 2026, 6:24 AM UTC

GET https://api.zerion.io/v1/fungibles/by-implementation

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 12, 2026, 6:23 AM UTC

GET https://api.zerion.io/v1/nfts/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 12, 2026, 6:21 AM UTC

GET https://api.zerion.io/v1/swap/fungibles/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 12, 2026, 6:20 AM UTC

GET https://api.zerion.io/v1/chains/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 12, 2026, 6:19 AM UTC

GET https://api.zerion.io/v1/dapps/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 12, 2026, 12:27 AM UTC

GET https://api.zerion.io/v1/fungibles/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 12, 2026, 12:26 AM UTC

GET https://api.zerion.io/v1/swap/offers/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 12, 2026, 12:20 AM UTC

GET https://api.zerion.io/v1/gas-prices/

HTTP 402

241 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 11, 2026, 6:23 PM UTC

Evidence model

Security properties

Every result names its evidence state. Unknown and not tested never mean secure.

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 6:24 PM UTC

bounded_response

Tested — pass

241 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 6:24 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 6:24 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 6:24 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 6:24 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:24 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 6:24 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 6:24 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 6:24 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 6:24 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 6:24 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 6:24 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:24 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 6:24 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 6:23 PM UTC

bounded_response

Tested — pass

241 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 6:23 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 6:23 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 6:23 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 6:23 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:23 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 6:23 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 6:23 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 6:23 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 6:23 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 6:23 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 6:23 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:23 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 6:23 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 6:22 PM UTC

bounded_response

Tested — pass

241 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 6:22 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 6:22 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 6:22 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 6:22 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:22 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 6:22 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 6:22 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 6:22 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 6:22 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 6:22 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 6:22 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:22 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 6:22 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 12:26 PM UTC

bounded_response

Tested — pass

241 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 12:26 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 12:26 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 12:26 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 12:26 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 12:26 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 12:26 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 12:26 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 12:26 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 12:26 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 12:26 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 12:26 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 12:26 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 12:26 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 12:21 PM UTC

bounded_response

Tested — pass

241 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 12:21 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 12:21 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 12:21 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 12:21 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 12:21 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 12:21 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 12:21 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 12:21 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 12:21 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 12:21 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 12:21 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 12:21 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 12:21 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 12:21 PM UTC

bounded_response

Tested — pass

241 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 12:21 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 12:21 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 12:21 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 12:21 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 12:21 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 12:21 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 12:21 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 12:21 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 12:21 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 12:21 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 12:21 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 12:21 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 12:21 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 12:20 PM UTC

bounded_response

Tested — pass

241 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 12:20 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 12:20 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 12:20 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 12:20 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 12:20 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 12:20 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 12:20 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 12:20 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 12:20 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 12:20 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 12:20 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 12:20 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 12:20 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 12:19 PM UTC

bounded_response

Tested — pass

241 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 12:19 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 12:19 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 12:19 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 12:19 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 12:19 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 12:19 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 12:19 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 12:19 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 12:19 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 12:19 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 12:19 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 12:19 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 12:19 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 6:19 AM UTC

bounded_response

Tested — pass

241 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 6:19 AM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 6:19 AM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 6:19 AM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 6:19 AM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:19 AM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 6:19 AM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 6:19 AM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 6:19 AM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 6:19 AM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 6:19 AM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 6:19 AM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:19 AM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 6:19 AM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 8, 2026, 6:28 PM UTC

bounded_response

Tested — pass

241 bytes within scanner limit

Basis: harmless scanner · Oct 8, 2026, 6:28 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 8, 2026, 6:28 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 8, 2026, 6:28 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 8, 2026, 6:28 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 8, 2026, 6:28 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 8, 2026, 6:28 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 8, 2026, 6:28 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 8, 2026, 6:28 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 8, 2026, 6:28 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 8, 2026, 6:28 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 8, 2026, 6:28 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 8, 2026, 6:28 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 8, 2026, 6:28 PM UTC

api_catalog_parse

Observed

No RFC 9727 API catalog was available at this URL (HTTP 404); prior advertised links were withdrawn

Basis: RFC 9727 discovery response · Oct 4, 2026, 6:24 AM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 4, 2026, 6:24 AM UTC

bounded_response

Tested — pass

0 bytes within scanner limit

Basis: harmless scanner · Oct 4, 2026, 6:24 AM UTC

challenge_parse

Unknown

No MPP Payment challenge observed

Basis: unauthenticated HTTP response · Oct 4, 2026, 6:24 AM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 4, 2026, 6:24 AM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 4, 2026, 6:24 AM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 4, 2026, 6:24 AM UTC

economic_exposure_metadata

Unknown

No current Payment challenge exposes session or authorization inputs

Basis: observable challenge values only · Oct 4, 2026, 6:24 AM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 4, 2026, 6:24 AM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 4, 2026, 6:24 AM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 4, 2026, 6:24 AM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 4, 2026, 6:24 AM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 4, 2026, 6:24 AM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 4, 2026, 6:24 AM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 4, 2026, 6:24 AM UTC

openapi_parse

Tested — pass

76 payment offer(s) accepted

Basis: harmless discovery response · Oct 3, 2026, 12:18 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 2, 2026, 6:20 AM UTC

bounded_response

Tested — pass

411 bytes within scanner limit

Basis: harmless scanner · Oct 2, 2026, 6:20 AM UTC

challenge_parse

Unknown

No MPP Payment challenge observed

Basis: unauthenticated HTTP response · Oct 2, 2026, 6:20 AM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 2, 2026, 6:20 AM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 2, 2026, 6:20 AM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 2, 2026, 6:20 AM UTC

economic_exposure_metadata

Unknown

No current Payment challenge exposes session or authorization inputs

Basis: observable challenge values only · Oct 2, 2026, 6:20 AM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 2, 2026, 6:20 AM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 2, 2026, 6:20 AM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 2, 2026, 6:20 AM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 2, 2026, 6:20 AM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 2, 2026, 6:20 AM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 2, 2026, 6:20 AM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 2, 2026, 6:20 AM UTC

History

Service changes

Showing the latest 50 of 251 changes. Continue in the changes API view.

— security-property-changed

security:bounded_response: {"state":"tested-pass","evidence":"45084 bytes within scanner limit","basis":"harmless scanner"} → {"state":"tested-pass","evidence":"0 bytes within scanner limit","basis":"harmless scanner"}

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:bounded_response: {"state":"tested-pass","evidence":"0 bytes within scanner limit","basis":"harmless scanner"} → {"state":"tested-pass","evidence":"45084 bytes within scanner limit","basis":"harmless scanner"}

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:bounded_response: {"state":"tested-pass","evidence":"45084 bytes within scanner limit","basis":"harmless scanner"} → {"state":"tested-pass","evidence":"0 bytes within scanner limit","basis":"harmless scanner"}

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:bounded_response: {"state":"tested-pass","evidence":"0 bytes within scanner limit","basis":"harmless scanner"} → {"state":"tested-pass","evidence":"45084 bytes within scanner limit","basis":"harmless scanner"}

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:bounded_response: {"state":"tested-pass","evidence":"45084 bytes within scanner limit","basis":"harmless scanner"} → {"state":"tested-pass","evidence":"0 bytes within scanner limit","basis":"harmless scanner"}

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:bounded_response: {"state":"tested-pass","evidence":"0 bytes within scanner limit","basis":"harmless scanner"} → {"state":"tested-pass","evidence":"45084 bytes within scanner limit","basis":"harmless scanner"}

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:api_catalog_parse: {"state":"observed","evidence":"API catalog source returned HTTP 404; prior advertised links were withdrawn","basis":"R… → {"state":"observed","evidence":"No RFC 9727 API catalog was available at this URL (HTTP 404); prior advertised links we…

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:bounded_response: {"state":"tested-pass","evidence":"45084 bytes within scanner limit","basis":"harmless scanner"} → {"state":"tested-pass","evidence":"0 bytes within scanner limit","basis":"harmless scanner"}

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:bounded_response: {"state":"tested-pass","evidence":"0 bytes within scanner limit","basis":"harmless scanner"} → {"state":"tested-pass","evidence":"45084 bytes within scanner limit","basis":"harmless scanner"}

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:challenge_parse: {"state":"tested-pass","evidence":"1 Payment challenge(s) observed on HTTP 402","basis":"unauthenticated HTTP response"} → {"state":"tested-pass","evidence":"1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validat…

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:challenge_parse: {"state":"tested-pass","evidence":"1 Payment challenge(s) observed on HTTP 402","basis":"unauthenticated HTTP response"} → {"state":"tested-pass","evidence":"1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validat…

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:challenge_parse: {"state":"tested-pass","evidence":"1 Payment challenge(s) observed on HTTP 402","basis":"unauthenticated HTTP response"} → {"state":"tested-pass","evidence":"1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validat…

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:challenge_parse: {"state":"tested-pass","evidence":"1 Payment challenge(s) observed on HTTP 402","basis":"unauthenticated HTTP response"} → {"state":"tested-pass","evidence":"1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validat…

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:challenge_parse: {"state":"tested-pass","evidence":"1 Payment challenge(s) observed on HTTP 402","basis":"unauthenticated HTTP response"} → {"state":"tested-pass","evidence":"1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validat…

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:challenge_parse: {"state":"tested-pass","evidence":"1 Payment challenge(s) observed on HTTP 402","basis":"unauthenticated HTTP response"} → {"state":"tested-pass","evidence":"1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validat…

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:challenge_parse: {"state":"tested-pass","evidence":"1 Payment challenge(s) observed on HTTP 402","basis":"unauthenticated HTTP response"} → {"state":"tested-pass","evidence":"1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validat…

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:challenge_parse: {"state":"tested-pass","evidence":"1 Payment challenge(s) observed on HTTP 402","basis":"unauthenticated HTTP response"} → {"state":"tested-pass","evidence":"1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validat…

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:challenge_parse: {"state":"tested-pass","evidence":"1 Payment challenge(s) observed on HTTP 402","basis":"unauthenticated HTTP response"} → {"state":"tested-pass","evidence":"1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validat…

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:challenge_parse: {"state":"tested-pass","evidence":"1 Payment challenge(s) observed on HTTP 402","basis":"unauthenticated HTTP response"} → {"state":"tested-pass","evidence":"1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validat…

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:api_catalog_parse: {"state":"tested-fail","evidence":"API catalog source returned HTTP 404; prior advertised links were withdrawn","basis"… → {"state":"observed","evidence":"API catalog source returned HTTP 404; prior advertised links were withdrawn","basis":"R…

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:bounded_response: {"state":"tested-pass","evidence":"45084 bytes within scanner limit","basis":"harmless scanner"} → {"state":"tested-pass","evidence":"0 bytes within scanner limit","basis":"harmless scanner"}

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:bounded_response: {"state":"tested-pass","evidence":"0 bytes within scanner limit","basis":"harmless scanner"} → {"state":"tested-pass","evidence":"45084 bytes within scanner limit","basis":"harmless scanner"}

Evidence: Repeated harmless observation changed the modeled property

— probe-observation

tls_state: not-tested → tested-pass

Evidence: harmless unauthenticated HTTP observation

— probe-observation

redirect_count → 0

Evidence: harmless unauthenticated HTTP observation

— endpoint-source-discovered

source:challenge → active

Evidence: https://api.zerion.io/v1/tx-subscriptions/