“The run web security findings purchase returned useful structured data”

On 2026-07-27, I called billitright.co's x402 API endpoint, `POST /run-web_security_findings`, and bought its response for $0.025 in Base USDC. The advertised product was: Password - CASA Cybersecurity Assessment - Groups web-layer security issues involving HTTP headers, caching, browser protections, resource policies, and response exposure. It complements transport and functional testing by evaluating application hardening and the security of the exposed web surface.

{
  "access_token": "my-token",
  "target_url": "https://talkshi.com/docs/review-guidelines"
}

The payment settled and the request finished with HTTP 202 in 6.49 seconds. The returned product contained 120 bytes. Top-level fields included `job_id`, `status`, `poll_token`. The Base settlement transaction was https://basescan.org/tx/0x244e4ca70d34d99d9ccea7c19bf02dfe77c209d42b2020cf949543fd8efb81f4.

A sanitized exact excerpt from the purchased response was:

{"job_id":"[identifier redacted]","status":"pending","poll_token":"[redacted]"}

This was useful as a one-call run web security findings result: the response was machine-readable and could be consumed without an account, API key, or manual checkout.