# aptu.dev (full)

aptu.dev is machine-payable API infrastructure for autonomous agents. Instant per-call settlement via x402 using USDC on Base and Solana. No account, no API key, no signup.

## Site

The homepage is a single page: a dark JetBrains Mono landing page describing x402 per-call payment endpoints. No client-side JavaScript runs on the page.

## Machine surfaces

- GET /.well-known/x402: x402 discovery manifest. Returns JSON including `resources` (`"https://aptu.dev/v1/echo"`, `"https://aptu.dev/v1/resume-eval"`, `"https://aptu.dev/v1/agent-readiness"`, and `"https://aptu.dev/v1/btc-regime"`) and a `services` array with an echo entry (`method: "POST"`, `path: "/v1/echo"`, `amount: "$0.01"`), a resume-eval entry (`method: "POST"`, `path: "/v1/resume-eval"`, `amount: "$0.005"`), an agent-readiness entry (`method: "POST"`, `path: "/v1/agent-readiness"`, `amount: "$0.05"`), and a btc-regime entry (`method: "GET"`, `path: "/v1/btc-regime"`, `amount: "$0.003"`).
- GET /v1/catalog: JSON endpoint catalog. Returns `{"origin":"https://aptu.dev","resources":[{"method":"POST","path":"/v1/echo","description":"...","priceUsdc":"0.01"},{"method":"POST","path":"/v1/resume-eval","description":"...","priceUsdc":"0.005"},{"method":"POST","path":"/v1/agent-readiness","description":"...","priceUsdc":"0.05"},{"method":"GET","path":"/v1/btc-regime","description":"...","priceUsdc":"0.003"}],"discovery":[...]}`.
- GET /v1/openapi.json: OpenAPI 3.1 document for the free GET surfaces.
- GET /terms.txt: service terms (experimental, non-custodial, 424 failures do not settle).
- GET /v1/self-check: free deterministic resume-scorer and BTC-regime self-check; returns `{"fixtures":[{"name":"...","sha256":"..."}],"btcRegimeFixtures":[{"name":"...","sha256":"..."}]}` with a SHA-256 of the RFC 8785-style canonical JSON of each golden-fixture result.
- GET /v1/x401-probe: free x401 draft-0.2.0 demand probe (401 + PROOF-REQUEST).
- GET /llms.txt: site summary for machine readers.
- GET /llms-full.txt: this file.
- GET /skill.md: agent skill description (agentskills.io frontmatter).
- GET /rss.xml: RSS 2.0 changelog feed of paid endpoint and price changes; one item per registry endpoint with atom:updated; /atom.xml and /feed.xml 308-redirect here.
- GET /.well-known/api-catalog: RFC 9727 linkset JSON describing this site's LLM feeds.
- GET /.well-known/mcp.json: MCP server card (schemas.modelcontextprotocol.io server-card draft) naming the tools echo_probe, resume_eval, agent_readiness, and btc_regime; GET /.well-known/mcp/server-card.json 301-redirects here.
- POST /mcp: MCP Streamable HTTP transport exposing the four paid endpoints as tools (echo_probe, resume_eval, agent_readiness, btc_regime); tool calls settle via x402 like their /v1/* counterparts.
- GET /auth.md: agent registration declaration (anonymous access contract).
- GET /agents.txt: descriptive agent notes surface.
- GET /.well-known/agent-skills/index.json: agentskills.io discovery index.
- GET /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server: OAuth metadata for agent discovery (anonymous access, no tokens issued).
- GET /.well-known/ard.json: ARD v0.91 agent discovery manifest declaring every agent-readable surface on aptu.dev; GET /.well-known/ai-catalog.json 301-redirects here.
- GET /.well-known/webmcp.json: WebMCP tool manifest describing the browser-side tools registered on document.modelContext.
- POST /a2a: A2A v1.0 JSON-RPC transport. Send {"jsonrpc":"2.0","id":1,"method":"SendMessage","params":{"message":{"parts":[{"kind":"text","text":"search: regime"}]}}}; returns agent text with matching machine surfaces. Any other method returns -32601.
- GET /.well-known/agent-card.json: A2A agent card declaring the /a2a JSONRPC v1.0 interface and the search skill.
- GET /.well-known/http-message-signatures-directory: RFC 9421 Web Bot Auth key directory (application/http-message-signatures-directory+json) listing the aptu-dev-agent-readiness member and its publicKeyUrl; 503 until the public JWK is deployed.
- GET /.well-known/web-bot-auth.json: Ed25519 public JWK (application/jwk+json) whose RFC 8037 thumbprint is the keyid signing aptu.dev's outbound agent-readiness probe requests (draft-ietf-webbotauth-httpsig-protocol); signing is best-effort fail-open.
- GET /: content-negotiated root document. Send `Accept: application/json` for a JSON site document, `Accept: text/markdown` or `text/plain` for the text variant; browsers receive the HTML page. All variants are served inline with `Vary: Accept`.

## Payments

POST /v1/echo, POST /v1/resume-eval, POST /v1/agent-readiness, and GET /v1/btc-regime are live paid endpoints. Their payment requirements use the x402 protocol: an HTTP 402 challenge is returned as a Base64-encoded PAYMENT-REQUIRED header. Settlement is instant and per-call via x402 using USDC on Base or Solana (each 402 challenge carries both rails; pay with either).
Settlement verification routes through a primary facilitator (Coinbase) with automatic failover to a secondary (PayAI). If all facilitators fail, verification fails closed; unpaid 402 challenges are generated entirely offline.

### How to pay

- The 402 challenge arrives as a PAYMENT-REQUIRED header whose value is Base64url JSON; decode it by replacing `-` with `+`, replacing `_` with `/`, padding with `=` to a multiple of 4, then base64-decoding and JSON-parsing.
- Retry the request with a byte-identical body plus a PAYMENT-SIGNATURE header carrying the signed payment.
- Prerequisites: a USDC balance covering the endpoint price on the rail you pay with -- native USDC on Base mainnet, or native USDC (SPL mint EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v) on Solana mainnet; no ETH or SOL for gas is needed because the facilitator covers gas.
- The EIP-3009 payment nonce is single-use; a corrected retry needs a fresh signature.
- Standard clients can use @x402/fetch: build an x402Client, register ExactEvmScheme under eip155:8453 with a viem account signer on Base (or ExactSvmScheme under solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp with a Solana keypair for the Solana rail; the Solana accepts entry carries extra.feePayer, the facilitator's fee-sponsor key that funds the settle transaction's gas, not aptu.dev's receiving address), and wrap fetch with wrapFetchWithPayment; see skill.md for the full snippet.
- A settled response carries a PAYMENT-RESPONSE receipt with transaction, payer, and network, plus settledAmountUsdc, asset, and explorerUrl so settlement can be verified on-chain from the receipt alone.

### Paid endpoint response keys

- POST /v1/echo returns `{"echo": <your JSON body>}`; the echo key holds your request body verbatim.
- POST /v1/resume-eval returns `scores` (nested `impact_quantified`, `ats_parseable`, `executive_framing`, `contact_complete`), `total` (0-4), and `findings`; optional additive keys are `warnings` and `technical_depth`.
- POST /v1/agent-readiness returns `domain`, `score` (0-100), and `findings` (each with `check`, `pass`, `detail`, `ms`, and `hint` only on pass=false).
- GET /v1/btc-regime returns `regime`, `ma7`, `spotVsMa7Pct`, `action`, `closesSource`, `availability`, and `disclaimer`; optional keys are `fetchedAt` (Kraken reads) and `unavailableReason`.
- GET /v1/btc-regime with `availability: "unavailable"` returns `regime: "insufficient-data"` with null `ma7`, `spotVsMa7Pct`, and `action`; handle this case fail-closed (no trade action) rather than treating null as a signal.

## Error handling

Unknown paths return 404, never 500. Clients sending `Accept: application/json` receive `{"error":"not_found","path":"..."}`.