# Validex - agent operating instructions Startup health and validation API providing automated security, trust, web presence, and engineering analysis, individually or as a comprehensive report with AI interpretation. ## What it does Submit any startup or company domain to a validation endpoint. Validex resolves the entity, runs the relevant validators in parallel, scores each signal category on a 0-100 scale, and returns a structured JSON report with strengths, weaknesses, per-validator evidence, and (for AI-enabled tiers) an executive summary, risk flags, and recommendations. Categories and weights: - **Trust** (25%): HTTPS enforcement, domain age, MX records - **Security** (25%): TLS certificate, security headers (HSTS, CSP, X-Frame-Options), SPF, DMARC - **Engineering** (20%): GitHub repo health, commit activity, contributors, release cadence, issue/PR activity, stars - **Product** (20%): Documentation, pricing page, about page, contact, changelog - **Growth** (10%): Blog, careers page - **Website** (0%, informational): Reachability, sitemap ## Payment flow (x402, Algorand USDC) 1. Call any paid endpoint with no payment. You receive `402 Payment Required` with a `PAYMENT-REQUIRED` header (and a JSON body) describing the price, asset, and `payTo` address. 2. Sign a payment against those requirements using an x402-compatible library (e.g. `@x402/axios`) and retry with the signature on the `PAYMENT-SIGNATURE` header. 3. On success you receive the analysis report plus a `PAYMENT-RESPONSE` header confirming settlement. Unconditional pricing (no round trip needed): [`/.well-known/x402`](https://api.validex.space/.well-known/x402) ## Paid endpoints - `POST https://api.validex.space/v1/validate/security` ($0.05) - Audits SSL and TLS certificates, HTTP security headers such as HSTS and CSP, SPF, DMARC, MX email records, and DNS configuration. Request: `Body: {"target": "..."}` - `POST https://api.validex.space/v1/validate/trust` ($0.05) - Evaluates HTTPS enforcement, domain registration age, WHOIS records, privacy policy, and terms of service documentation. Request: `Body: {"target": "..."}` - `POST https://api.validex.space/v1/validate/web` ($0.06) - Inspects online presence including pricing transparency, developer documentation, engineering blog, careers page, and contact channels. Request: `Body: {"target": "..."}` - `POST https://api.validex.space/v1/validate/engineering` ($0.08) - Analyzes public GitHub repository activity, commit frequency, contributor diversity, release cadence, and OSV known vulnerabilities. Request: `Body: {"target": "..."}` - `POST https://api.validex.space/v1/validate/ai` ($0.15) - Executes full multi-category validation with an AI-generated startup health verdict, risk factor analysis, and integration recommendations. Request: `Body: {"target": "..."}` - `POST https://api.validex.space/v1/validate/compare` ($0.15) - Performs comparative analysis and health ranking across 2 to 5 startup domains with relative scoring across all categories. Request: `Body: {"targets": ["...", "..."]}` - `POST https://api.validex.space/v1/validate/quick` ($0.20) - Performs fast-path network connectivity, TLS certificate, security header, and domain trust validation combined with an AI summary. Request: `Body: {"target": "..."}` - `POST https://api.validex.space/v1/validate/full` ($0.35) - Conducts a deep audit across all six signal categories including security, trust, web, and engineering with full evidence and AI interpretation. Request: `Body: {"target": "..."}` Optional field on all endpoints: `"refresh": true` to bypass the validator result cache. ## Read endpoints (free, no payment) - `GET https://api.validex.space/v1/validate/:analysisId` - Retrieve a previously-run analysis - `GET https://api.validex.space/v1/validate/compare/:comparisonId` - Retrieve a previously-run comparison - `GET https://api.validex.space/v1/health` - API health status ## Polling workflow Every successful POST returns `meta.analysisId`. You can retrieve the same result later without paying again: ``` GET /v1/validate/ ``` Response when complete (`status: "completed"` or `"partial"`): full AnalysisReport. Response when still running (`status: "running"` or `"pending"`): `{ analysisId, status }`. Response when failed (`status: "failed"`): `{ analysisId, status, error }`. Similarly, `meta.comparisonId` from a compare POST can be fetched via `GET /v1/validate/compare/:comparisonId`. ## Worked example ``` # Step 1 - probe for payment requirements (no PAYMENT-SIGNATURE) POST https://api.validex.space/v1/validate/security Content-Type: application/json Body: { "target": "stripe.com" } # Response: 402 # Headers: PAYMENT-REQUIRED: # Body: { "x402Version": 2, "requirements": [...], ... } # Step 2 - sign and retry POST https://api.validex.space/v1/validate/security Content-Type: application/json PAYMENT-SIGNATURE: Body: { "target": "stripe.com" } # Response: 200 # Headers: PAYMENT-RESPONSE: # Body: { "success": true, "data": { "meta": { "analysisId": "val_abc123", "tier": "security", ... }, "company": { "domain": "stripe.com", "canonicalUrl": "https://stripe.com", ... }, "summary": { "score": 92.5, "grade": "A+", "confidence": 94.0 }, "categories": { "security": { "score": 92.5, "confidence": 94.0, "weight": 25, ... } }, "strengths": ["Valid TLS certificate with 340 days remaining.", "HSTS header present."], "weaknesses": [], "validators": [ ... ], "sources": [ ... ] } } # Step 3 - retrieve the same result later for free GET https://api.validex.space/v1/validate/val_abc123 ``` ## Grades and recommendations Score | Grade | Recommendation --------|-------|--------------- 90-100 | A+ | integrate 80-89 | A | integrate 70-79 | B+ | integrate 60-69 | B | caution 50-59 | C+ | caution 40-49 | C | caution 30-39 | D | avoid 0-29 | F | avoid ## Notes - Network and USDC asset ID are declared per-deployment in `/.well-known/x402` (`network`/`asset` fields) - do not hardcode testnet/mainnet assumptions. - The facilitator co-signs as fee payer, so you only need USDC (opted in) - no ALGO required for fees. - Validator status can be `success`, `unavailable` (data source unreachable), or `error` (validator failed). Both `unavailable` and `error` produce a null score for that validator but do not fail the request. - Analysis status `partial` means at least one validator errored; all others still ran and scored. - The `website` category has a weight of 0 and does not contribute to the overall score; it is informational only.