GoldBean API (goldbean-api.xyz) — 120 endpoints fail batchTest after successful discovery

[wuzenghai616-lang]

Summary

GoldBean API (https://goldbean-api.xyz) is a comprehensive pay-per-call API marketplace on Base chain with 120 x402-enabled endpoints. The discovery check succeeds (checkDiscovery returns ound: true, resourceCount: 120), but all 120 endpoints fail �atchTest with [402] No valid x402 response found.

x402 V2 402 Response

Our 402 response is fully compliant with x402 V2 specification:

`http
HTTP/1.1 402 Payment Required
Payment-Required: eyJzY2hlbWUiOiJleGFjdCIsIm5ldHdvcmsiOiJlaXAxNTU6ODQ1MyIsImFzc2V0IjoiMHg4MzM1ODlmQ0Q2ZURiNkUwOGY0YzdDMzJENGY3MWI1NGJkQTAyOTEzIiwiYW1vdW50Ijo0MDAwMCwicGF5VG8iOiIweDc0ODRiMGJjYTI1ZDJlZTU2ZTliMDUzNTU3MmQ0Y2Y0NGEwNDdkOTgiLCJtYXhUaW1lb3V0U2Vjb25kcyI6MzAwfQ==
Cache-Control: no-store
Content-Length: 2

{}
`

Decoded Payment-Required header:
json {"scheme":"exact","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","amount":40000,"payTo":"0x7484b0bca25d2ee56e9b0535572d4cf44a047d98","maxTimeoutSeconds":300}

• ✅ 402 status code
• ✅ base64-encoded Payment-Required header with correct V2 JSON
• ✅ amount as integer (atomic units, 40000 = .04 USDC)
• ✅ Cache-Control: no-store
• ✅ Clean body: {} (no v1 accepts array)

Discovery endpoints

• /.well-known/x402 → 200 ✅
• /openapi.json → complete OpenAPI 3.1 spec ✅
• /.well-known/x402-bazaar → 200 ✅

Issue

We initially submitted the URL when the 402 format was not fully compliant (had v1-style �ccepts in body, �mount as string). All subsequent re-scans through the web form at x402scan.com/resources/register return the same cached results — still showing 120 errors despite the format being fully corrected now.

Request

Please clear the scan cache for https://goldbean-api.xyz and trigger a fresh batchTest, or advise on how we can force a re-scan. We've verified via direct curl that every /paid/* endpoint returns a valid 402 with correct Payment-Required header.

Thank you!

[wuzenghai616-lang]

Update — 2026-05-24 19:24 GMT+8

🎉 Progress: 31 resources successfully registered

After fixing the Payment-Required header format to match x402 V2 spec (x402Version: 2, accepts array, resource object — verified with x402-check tool), 31 of 120 endpoints passed batchTest and were registered successfully.

⚠️ Remaining 89: OpenAPI cache issue

The 89 remaining endpoints all fail with:

validation: Missing input schema

However, our OpenAPI spec already has:

• Required query parameter with schema on all 120 endpoints
• requestBody on all 31 POST endpoints
• x-payment-info, responses.402, and protocols on all endpoints

Root cause: x402scan OpenAPI cache

x402scan cached our OpenAPI from the first scan and is not re-fetching. The bustCache param only affects discovery, not the OpenAPI fetch.

Request

Please clear the OpenAPI cache for https://goldbean-api.xyz and trigger a fresh re-scan of the remaining 89 endpoints.

All payment headers and schemas are correct — verified with x402-check (zero errors, zero warnings).

[craigbidenbot]

Took a look — root cause was in x402scan's probe, not OpenAPI caching.

Your spec is correctly served (120 paths, every one with both parameters and requestBody schemas — verified live). The bug: GoldBean's payment middleware fires before HTTP method routing, so a probe to /paid/<endpoint> returns 402 for both GET and POST. The discovery probe correctly picks up the spec's per-method inputSchema for GET, but x402scan's pickX402Advisory was preferring POST by method-preference, then rewriting .method to the declared method ("GET") — preserving the registration's method but silently dropping the GET advisory's schema. Result: "Missing input schema" on every endpoint with no x402-bazaar input.body block.

Fix in #933: when the OpenAPI-declared method matches an advisory directly, return that advisory unchanged. Falls back to method-preference + rewrite only when no advisory matches the declared method.

Once that merges, recommend re-running batchTest against https://goldbean-api.xyz — the remaining 89 endpoints should clear.

A human on the team will review and merge the PR.