# Proofwire: verification-as-a-service for agents

> Close the loop on your own work with one paid call that returns a verdict plus Ed25519-signed, falsifiable evidence (verify signatures with GET /v1/keys). GET /v1/verify/http checks a URL is alive (redirect chain, TLS, latency, body hash). GET /v1/verify/dns resolves records and parses SPF/DMARC/DKIM. Email: POST /v1/verify/email/inbox issues a seed address; send mail to it, then GET /v1/verify/email?inbox=&token= returns delivery plus SPF/DKIM/DMARC alignment and raw headers (polls inside the paid window are free). Webhooks: POST /v1/verify/webhook arms a tripwire URL; register it upstream, then poll GET /v1/verify/webhook/{id}?token= for free. GET /v1/verify/page renders a page in a real browser, asserts a selector/text, and returns a screenshot URL. Failed work is never settled.

## When to use Proofwire

Use it when you need to prove something actually happened, not just assume it: a link works, an email arrived, a webhook fired, a page shows what you claim, DNS is set up. Every answer has a `verdict` (pass / fail / delivered / fired...), `evidence`, and an Ed25519 `signature` your human can verify at https://verify.reversecaptcha.fun/v1/keys.

## Recipes (copy these)

### Check a link before sharing it ($0.001)
GET https://verify.reversecaptcha.fun/v1/verify/http?url=https://example.com/page&expect_status=200
-> {"verdict":"pass","evidence":{"final_url":"...","final_status":200,"redirect_chain":[...],"tls":{"valid":true,"days_remaining":61},"body_sha256":"..."}}

### Check DNS / email setup ($0.002)
GET https://verify.reversecaptcha.fun/v1/verify/dns?domain=example.com&expect=v=spf1
GET https://verify.reversecaptcha.fun/v1/verify/dns?domain=example.com&selector=google   (DKIM key for selector "google")
-> {"verdict":"pass","evidence":{"records":{...},"email":{"spf":{...},"dmarc":{"policy":"reject"},"dkim":{...}}}}

### Prove an email was delivered (signup, password reset, campaign)
1. POST https://verify.reversecaptcha.fun/v1/verify/email/inbox  body {}  ($0.001)
   -> {"inbox":"check-7f3a1b2c","address":"check-7f3a1b2c@inbox.reversecaptcha.fun","token":"inb_..."}
2. Make the system you are testing send mail to that address.
3. GET https://verify.reversecaptcha.fun/v1/verify/email?inbox=check-7f3a1b2c&token=inb_...&from=noreply@sender.com&match_subject=welcome&window=120  ($0.01, once)
   -> {"verdict":"delivered","evidence":{"message":{"subject":"...","authentication":{"spf":{"result":"pass"},"dkim":[{"result":"pass","aligned":true}],"dmarc":{"result":"pass"}},"raw_headers":"..."}}}
   If the verdict is "not_delivered_yet", call the same URL again: polls inside the window are FREE (no payment needed). The call waits up to 25 s for mail to arrive.

### Prove a webhook fired (Stripe, GitHub, any system) or watch a cron heartbeat
1. POST https://verify.reversecaptcha.fun/v1/verify/webhook  body {"window_seconds":600,"label":"stripe checkout"}  ($0.005)
   -> {"hook_url":"https://verify.reversecaptcha.fun/hook/hk_...","id":"hk_...","watch_token":"wt_..."}
2. Register hook_url as the webhook target (or have your cron job call it). Add "expect_by_seconds":300 to flag a missed deadline.
3. GET https://verify.reversecaptcha.fun/v1/verify/webhook/hk_...?token=wt_...&wait=25   (FREE)
   -> {"verdict":"fired","evidence":{"hits":[{"method":"POST","headers":{...},"body":"...","source_ip":"..."}]}}

### Check what a page really shows / take a screenshot ($0.01)
GET https://verify.reversecaptcha.fun/v1/verify/page?url=https://example.com&expect_selector=h1&expect_text=Welcome&wait=1500
-> {"verdict":"pass","evidence":{"title":"...","extracted_text":"...","console_errors":[],"screenshot_url":"https://verify.reversecaptcha.fun/evidence/....png?exp=...&sig=..."}}
Use viewport=390x844 for a mobile view, full_page=true for a full-page screenshot. If the renderer is busy you get 503 (not charged): retry in ~20 s.

## Verdicts are signed

To verify a response: remove the `signature` field, serialize the rest as canonical JSON (keys sorted at every level, no spaces), and check `signature.value` (base64 Ed25519) against the key at https://verify.reversecaptcha.fun/v1/keys.

## How to pay (x402, no account, no API key)

1. Call any paid endpoint normally. You get HTTP 402 with a PAYMENT-REQUIRED header (base64 JSON) and an x402 v1 body.
2. Sign a USDC (Base, eip155:8453) EIP-3009 transferWithAuthorization for the quoted amount to 0x87e8d821649a61815e4fa61d892fca13b7d07028. Any x402 client does this for you (x402-fetch, @x402/fetch, agentcash, FluxA wallet, Coinbase AgentKit).
3. Retry the same request with header PAYMENT-SIGNATURE (x402 v2) or X-PAYMENT (x402 v1).
4. You get the result plus `payment.transaction` (the Base tx hash). Failed work is never settled, so you are not charged for our errors.

Identical repeat requests within ~30 seconds are served from cache for free. Each payment works exactly once.

## All endpoints

- GET https://verify.reversecaptcha.fun/v1/verify/http ($0.001): Is this URL alive? Real fetch with redirect chain, TLS, latency and body hash, returned as signed evidence.
- GET https://verify.reversecaptcha.fun/v1/verify/dns ($0.002): Resolved A/AAAA/CNAME/MX/TXT/NS/CAA from public resolvers with parsed SPF, DMARC and DKIM, for setup verification.
- POST https://verify.reversecaptcha.fun/v1/verify/email/inbox ($0.001): Issue a fresh seed inbox on the catch-all domain. Give the address to whatever sends the mail, then call verify/email.
- GET https://verify.reversecaptcha.fun/v1/verify/email ($0.01): Did the message actually arrive? Watches a seed inbox for a window (polls inside it are free) and returns delivery plus SPF/DKIM/DMARC alignment and raw headers.
- POST https://verify.reversecaptcha.fun/v1/verify/webhook ($0.005): Arm a one-time tripwire URL that records every hit (payload, headers, source IP) for a window of up to an hour; polls are free. Also works as a cron heartbeat with expect_by.
- GET https://verify.reversecaptcha.fun/v1/verify/page ($0.01): Does the page really show it? Full browser render (JS, network), waits, asserts a selector and/or text, returns extracted text, console errors and a screenshot URL.

## Machine-readable

- OpenAPI 3.1: https://verify.reversecaptcha.fun/openapi.json
- x402 discovery: https://verify.reversecaptcha.fun/.well-known/x402
- Signature public keys: https://verify.reversecaptcha.fun/v1/keys