{
  "schema": "varexis-index-agent-payments/1",
  "activation": "Check agent_payments_active at /api/index/capabilities. This contract alone does not indicate activation.",
  "protocol": "MPP with Stripe Shared Payment Tokens",
  "supported_products": [
    "single_request",
    "evidence_receipt"
  ],
  "currency": "gbp",
  "amount_unit": "minor_units",
  "authentication": "Generate and retain a fresh vxi_ plus 43-character base64url access key. Send Authorization: Bearer <key>. Never put keys in URLs. Retain the same key throughout quote, payment and recovery.",
  "quote": {
    "method": "POST",
    "url": "/api/index/agent-payments/quote",
    "body": {
      "route_id": "Route selected from free preview",
      "snapshot_sha256": "Exact hash from free preview",
      "service_id": "single_request",
      "billing_address": {
        "country": "GB",
        "postal_code": "Buyer postal code",
        "line1": "Buyer billing address",
        "city": "Buyer city"
      }
    },
    "optional": "version for advisory routes; billing_address.state; tax_ids containing at most one {type: eu_vat or gb_vat, value: buyer VAT ID}. For other tax-ID types, use hosted checkout.",
    "result": "Immutable order_id, exact amount_total including calculated tax, tax_amount, net_amount, currency and expires_at. Quotes expire within 15 minutes. Addresses are sent to Stripe to calculate tax; VAREXIS stores a salted request fingerprint, not the address."
  },
  "pay": {
    "method": "POST",
    "url": "/api/index/agent-payments/pay",
    "body": {
      "order_id": "Quoted order",
      "snapshot_sha256": "Quoted hash",
      "amount_total": "Quoted integer total",
      "currency": "gbp",
      "accept_terms": true
    },
    "challenge": "HTTP 402 with WWW-Authenticate: Payment. Obtain owner spending authority for the exact quote, including VAT. Use an MPP client that supports separate application authentication.",
    "retry": "Repeat with the same Authorization key and body, adding the MPP credential in Payment-Authorization. The payment credential carries a Stripe SPT and the quoted order_id as externalId. Never substitute another token or challenge after a payment attempt.",
    "result": "After provider verification, returns the saved snapshot and a receipt. The initial successful MPP response also includes Payment-Receipt."
  },
  "recovery": {
    "method": "GET",
    "url": "/api/index/agent-payments/result",
    "instructions": "Use the same Authorization key after a timeout. Signed Stripe webhooks can recover delivery. If still pending, retry only the original MPP credential within quote expiry. Do not create a new order to recover an uncertain payment; contact support if pending persists. Never infer payment success from a client assertion."
  },
  "terms": "https://varexis.tech/checkout-terms",
  "limits": "One-time snapshot purchases only. No autonomous subscription creation, stablecoin/x402 rail or stored-card charging. A payer wallet may require owner approval; authentication-required payments are not silently completed. Expired quotes, invalid payment, refunds and disputes cannot unlock delivery. No automatic email key recovery.",
  "scope": "Preserve a previewed public-source snapshot for authenticated retrieval. Evidence Receipt adds an unsigned delivery record, distinct from the MPP payment receipt and local signed qualification artefacts. The full answer and sources are free; payment adds no fresh review, proprietary evidence, independent assurance or continual refresh.",
  "fixed_evidence_packs": {
    "route_id": "agentic_pack_repository_browser_trust_v1",
    "complete_free_preview": "/varexis-index/packs/repository-browser-trust-v1.json",
    "input": "Use the published pack route_id and the exact snapshot_sha256 from preview; existing request schemas and authentication apply.",
    "output": "One complete version-bound JSON result containing all member documentation reviews or explicitly dated advisory source assertions, comparison, source bindings and limitations. Evidence Receipt adds the existing unsigned delivery receipt.",
    "purchase": "Use one existing Single Request or Evidence Receipt order. Hosted Stripe checkout and compatible authorised MPP/Stripe SPT remain separate supported paths. Check live capabilities; preserve provider authentication and exact spending authority.",
    "subscription": "An eligible existing subscription uses POST /api/index/query with one Idempotency-Key. The whole pack consumes one query; no member purchases or new subscription are needed.",
    "recovery": "Retrieve with the original key through the same payment flow. If payment is uncertain, follow the existing recovery contract; never create another order or payment. MPP retries retain the original credential.",
    "limits": "Frozen documentation reviews or selected advisory source assertions, not current tool tests, deployment assessments, certification, fresh investigation or continual refresh. No manual review, request email or new account is needed for delivery.",
    "available_packs": [
      {
        "route_id": "agentic_pack_repository_browser_trust_v1",
        "title": "Repository and browser Tool-Trust Evidence Pack",
        "complete_free_preview": "/varexis-index/packs/repository-browser-trust-v1.json",
        "member_count": 2,
        "subscription_query_units": 1
      },
      {
        "route_id": "agentic_pack_agent_permissions_data_v1",
        "title": "Agent Tool Permissions & Data Handling — Notion + Slack",
        "complete_free_preview": "/varexis-index/packs/agent-permissions-data-v1.json",
        "member_count": 2,
        "subscription_query_units": 1
      },
      {
        "route_id": "agentic_pack_evidence_boundary_audit_v1",
        "title": "Evidence Boundary Pack — Audit & Export Coverage",
        "complete_free_preview": "/varexis-index/packs/evidence-boundary-audit-v1.json",
        "member_count": 3,
        "subscription_query_units": 1
      },
      {
        "route_id": "agentic_pack_nextjs_advisory_snapshot_v1",
        "title": "Next.js: three dated advisory source assertions",
        "complete_free_preview": "/varexis-index/packs/nextjs-advisory-snapshot-v1.json",
        "member_count": 3,
        "subscription_query_units": 1
      },
      {
        "route_id": "agentic_pack_code_scanner_trust_v1",
        "title": "Code-Scanner Trust — SonarQube, Snyk & Semgrep",
        "complete_free_preview": "/varexis-index/packs/code-scanner-trust-v1.json",
        "member_count": 6,
        "subscription_query_units": 1
      },
      {
        "route_id": "agentic_pack_telemetry_redaction_v1",
        "title": "Telemetry Redaction — Coverage, Exceptions & Data Flow",
        "complete_free_preview": "/varexis-index/packs/telemetry-redaction-v1.json",
        "member_count": 5,
        "subscription_query_units": 1
      },
      {
        "route_id": "agentic_pack_github_release_acceptance_v1",
        "title": "GitHub Release Acceptance — Approval, Execution & Artifact Identity",
        "complete_free_preview": "/varexis-index/packs/github-release-acceptance-v1.json",
        "member_count": 5,
        "subscription_query_units": 1
      },
      {
        "route_id": "agentic_pack_agent_integration_v1",
        "title": "Agent Tool Evaluation & Integration - GitHub + Playwright",
        "complete_free_preview": "/varexis-index/packs/agent-integration-v1.json",
        "member_count": 2,
        "subscription_query_units": 1
      }
    ]
  }
}