{"schema_version":"1.0","name":"HubVibe Site Compliance Auditing Suite","base_url":"https://hubvibe-io.com","description":"Rule-based, verifiable site audits -- accessibility (axe-core), SEO, security headers, and performance -- callable a la carte or as a single bundle. Every result is a deterministic check against the actual page; nothing here is an LLM guessing at quality, and a check that couldn't run is never reported as a false pass.","pricing":{"model":"per-call","currency":"USD","single_audit_usd":0.03,"bundle_usd":0.1,"note":"Per-call pricing is the product and is what a machine caller should use -- no account, no minimum, no subscription."},"payment":{"methods":["x402"],"challenge":"Unauthenticated calls return HTTP 402 with a machine-readable `accepts` array in the body and, for MPP, one signed WWW-Authenticate: Payment challenge per method.","note":"Only methods actually configured on this deployment are listed; an empty list means no machine payment rail is live right now.","receipt":"A settled x402 payment returns the facilitator's settle response -- transaction hash, network, payer -- on the 200 in the PAYMENT-RESPONSE header (X-PAYMENT-RESPONSE for v1 clients). Over MCP the same receipt is in the tool result's _meta[\"x402/payment-response\"].","mcp":"The /mcp endpoint speaks the x402 MCP protocol: an unpaid tools/call returns isError with the v2 PaymentRequired in structuredContent; send the signed PaymentPayload in params._meta[\"x402/payment\"] (the x402.mcp client does this for you). HTTP headers X-PAYMENT / PAYMENT-SIGNATURE / X-API-Key on the POST work too."},"limits":{"rate_limit_per_minute":600,"on_limit":"HTTP 429 with Retry-After; nothing is billed."},"discovery":{"openapi":"https://hubvibe-io.com/openapi.json","mcp_endpoint":"https://hubvibe-io.com/mcp","mcp":"https://hubvibe-io.com/mcp.json","llms_txt":"https://hubvibe-io.com/llms.txt","docs":"https://hubvibe-io.com/docs"},"guarantees":["You are charged only for an audit that produced a result. A check that could not run returns HTTP 502, is never settled, and is never reported as a pass -- a payment is verified to grant access but only settled after the audit has actually delivered.","Rate-limited requests are rejected before any payment is settled, so a 429 never costs you anything.","Results are deterministic rule-based checks against the live page, never an LLM's opinion."],"endpoints":[{"path":"/audit/wcag","method":"POST","payment_required":true,"price_usd":0.03,"input":{"html":"string (optional)","url":"string (optional, one of html/url required)"},"input_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","title":"Live URL or raw HTML to audit","properties":{"url":{"type":"string","format":"uri","description":"Live, fetchable http(s) URL to audit.","examples":["https://example.com"]},"html":{"type":"string","description":"Raw HTML source to audit instead of fetching a URL."}},"anyOf":[{"required":["url"]},{"required":["html"]}]},"output_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"status":{"type":"string","const":"ok","description":"Present only on a completed audit."},"pass":{"type":"boolean","description":"Whether every rule in this dimension passed."},"engine":{"type":"string","const":"axe-core"},"violations":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","description":"axe-core rule id."},"impact":{"type":["string","null"],"description":"axe-core impact level."},"help":{"type":["string","null"]},"help_url":{"type":"string","format":"uri"},"nodes_affected":{"type":"integer","minimum":0}},"required":["id"]}}},"required":["pass"]},"returns":"pass (bool), violations[] with id/impact/help/help_url/nodes_affected.","description":"WCAG 2.1 A/AA accessibility audit via axe-core.","auth":"WHICH of these a given deployment accepts is not fixed and this schema cannot know it: read `payment.methods` in /.well-known/agent.json, or the `accepts[]` array in any 402 response. Both list only rails that can genuinely settle right now. The headers each scheme uses: X-API-Key (a prepaid key bought through the MPP top-up rail and spent per call at the same rates; there are no subscriptions); X-PAYMENT (x402 -- price/network/payTo arrive in the 402 body); Authorization: Payment ... (MPP -- Stripe SPT for fiat or Tempo for crypto, challenges arrive in the WWW-Authenticate headers on a 402)","payment_methods":["x402"],"example_request":{"url":"https://hubvibe-io.com/audit/wcag","method":"POST","headers":{"Content-Type":"application/json","X-API-Key":"<your key>"},"body":{"url":"https://example.com"}}},{"path":"/audit/seo","method":"POST","payment_required":true,"price_usd":0.03,"input":{"html":"string (optional)","url":"string (optional, one of html/url required)"},"input_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","title":"Live URL or raw HTML to audit","properties":{"url":{"type":"string","format":"uri","description":"Live, fetchable http(s) URL to audit.","examples":["https://example.com"]},"html":{"type":"string","description":"Raw HTML source to audit instead of fetching a URL."}},"anyOf":[{"required":["url"]},{"required":["html"]}]},"output_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"status":{"type":"string","const":"ok","description":"Present only on a completed audit."},"pass":{"type":"boolean","description":"Whether every rule in this dimension passed."},"findings":{"type":"array","description":"One entry per rule that did not pass. Empty when the check is clean.","items":{"type":"object","properties":{"id":{"type":"string","description":"Stable rule identifier."},"severity":{"type":"string","description":"Rule severity."},"detail":{"type":"string","description":"What failed and where."}},"required":["id"]}}},"required":["pass"]},"returns":"pass (bool), findings[] with id/severity/detail.","description":"Title, meta description, H1 structure, canonical link, OpenGraph tags, structured data, and lang attribute.","auth":"WHICH of these a given deployment accepts is not fixed and this schema cannot know it: read `payment.methods` in /.well-known/agent.json, or the `accepts[]` array in any 402 response. Both list only rails that can genuinely settle right now. The headers each scheme uses: X-API-Key (a prepaid key bought through the MPP top-up rail and spent per call at the same rates; there are no subscriptions); X-PAYMENT (x402 -- price/network/payTo arrive in the 402 body); Authorization: Payment ... (MPP -- Stripe SPT for fiat or Tempo for crypto, challenges arrive in the WWW-Authenticate headers on a 402)","payment_methods":["x402"],"example_request":{"url":"https://hubvibe-io.com/audit/seo","method":"POST","headers":{"Content-Type":"application/json","X-API-Key":"<your key>"},"body":{"url":"https://example.com"}}},{"path":"/audit/security","method":"POST","payment_required":true,"price_usd":0.03,"input":{"url":"string (required)"},"input_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","title":"Live URL to audit","properties":{"url":{"type":"string","format":"uri","description":"Live, fetchable http(s) URL to audit.","examples":["https://example.com"]}},"required":["url"]},"output_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"status":{"type":"string","const":"ok","description":"Present only on a completed audit."},"pass":{"type":"boolean","description":"Whether every rule in this dimension passed."},"findings":{"type":"array","description":"One entry per rule that did not pass. Empty when the check is clean.","items":{"type":"object","properties":{"id":{"type":"string","description":"Stable rule identifier."},"severity":{"type":"string","description":"Rule severity."},"detail":{"type":"string","description":"What failed and where."}},"required":["id"]}}},"required":["pass"]},"returns":"pass (bool), findings[] with id/severity/detail.","description":"HTTPS, HSTS, CSP, X-Content-Type-Options, clickjacking protection, Referrer-Policy, and CORS from a live HTTP response -- not a TLS/cipher scan or a penetration test.","auth":"WHICH of these a given deployment accepts is not fixed and this schema cannot know it: read `payment.methods` in /.well-known/agent.json, or the `accepts[]` array in any 402 response. Both list only rails that can genuinely settle right now. The headers each scheme uses: X-API-Key (a prepaid key bought through the MPP top-up rail and spent per call at the same rates; there are no subscriptions); X-PAYMENT (x402 -- price/network/payTo arrive in the 402 body); Authorization: Payment ... (MPP -- Stripe SPT for fiat or Tempo for crypto, challenges arrive in the WWW-Authenticate headers on a 402)","payment_methods":["x402"],"example_request":{"url":"https://hubvibe-io.com/audit/security","method":"POST","headers":{"Content-Type":"application/json","X-API-Key":"<your key>"},"body":{"url":"https://example.com"}}},{"path":"/audit/performance","method":"POST","payment_required":true,"price_usd":0.03,"input":{"url":"string (required)"},"input_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","title":"Live URL to audit","properties":{"url":{"type":"string","format":"uri","description":"Live, fetchable http(s) URL to audit.","examples":["https://example.com"]}},"required":["url"]},"output_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"status":{"type":"string","const":"ok","description":"Present only on a completed audit."},"pass":{"type":"boolean","description":"Whether every rule in this dimension passed."},"metrics":{"type":"object","properties":{"dom_node_count":{"type":"integer","minimum":0},"total_bytes_transferred":{"type":"integer","minimum":0},"request_count":{"type":"integer","minimum":0}}},"findings":{"type":"array","description":"One entry per rule that did not pass. Empty when the check is clean.","items":{"type":"object","properties":{"id":{"type":"string","description":"Stable rule identifier."},"severity":{"type":"string","description":"Rule severity."},"detail":{"type":"string","description":"What failed and where."}},"required":["id"]}}},"required":["pass"]},"returns":"pass (bool), metrics{}, findings[] with id/severity/detail.","description":"DOM node count, transferred bytes, and request count from one real page load -- not a full Lighthouse audit.","auth":"WHICH of these a given deployment accepts is not fixed and this schema cannot know it: read `payment.methods` in /.well-known/agent.json, or the `accepts[]` array in any 402 response. Both list only rails that can genuinely settle right now. The headers each scheme uses: X-API-Key (a prepaid key bought through the MPP top-up rail and spent per call at the same rates; there are no subscriptions); X-PAYMENT (x402 -- price/network/payTo arrive in the 402 body); Authorization: Payment ... (MPP -- Stripe SPT for fiat or Tempo for crypto, challenges arrive in the WWW-Authenticate headers on a 402)","payment_methods":["x402"],"example_request":{"url":"https://hubvibe-io.com/audit/performance","method":"POST","headers":{"Content-Type":"application/json","X-API-Key":"<your key>"},"body":{"url":"https://example.com"}}},{"path":"/audit/bundle","method":"POST","payment_required":true,"price_usd":0.1,"input":{"url":"string (required)"},"input_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","title":"Live URL to audit","properties":{"url":{"type":"string","format":"uri","description":"Live, fetchable http(s) URL to audit.","examples":["https://example.com"]}},"required":["url"]},"output_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"status":{"type":"string","const":"ok","description":"Present only on a completed audit."},"pass":{"type":"boolean","description":"Whether every rule in this dimension passed."},"wcag":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"status":{"type":"string","const":"ok","description":"Present only on a completed audit."},"pass":{"type":"boolean","description":"Whether every rule in this dimension passed."},"engine":{"type":"string","const":"axe-core"},"violations":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","description":"axe-core rule id."},"impact":{"type":["string","null"],"description":"axe-core impact level."},"help":{"type":["string","null"]},"help_url":{"type":"string","format":"uri"},"nodes_affected":{"type":"integer","minimum":0}},"required":["id"]}}},"required":["pass"]},"seo":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"status":{"type":"string","const":"ok","description":"Present only on a completed audit."},"pass":{"type":"boolean","description":"Whether every rule in this dimension passed."},"findings":{"type":"array","description":"One entry per rule that did not pass. Empty when the check is clean.","items":{"type":"object","properties":{"id":{"type":"string","description":"Stable rule identifier."},"severity":{"type":"string","description":"Rule severity."},"detail":{"type":"string","description":"What failed and where."}},"required":["id"]}}},"required":["pass"]},"security":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"status":{"type":"string","const":"ok","description":"Present only on a completed audit."},"pass":{"type":"boolean","description":"Whether every rule in this dimension passed."},"findings":{"type":"array","description":"One entry per rule that did not pass. Empty when the check is clean.","items":{"type":"object","properties":{"id":{"type":"string","description":"Stable rule identifier."},"severity":{"type":"string","description":"Rule severity."},"detail":{"type":"string","description":"What failed and where."}},"required":["id"]}}},"required":["pass"]},"performance":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"status":{"type":"string","const":"ok","description":"Present only on a completed audit."},"pass":{"type":"boolean","description":"Whether every rule in this dimension passed."},"metrics":{"type":"object","properties":{"dom_node_count":{"type":"integer","minimum":0},"total_bytes_transferred":{"type":"integer","minimum":0},"request_count":{"type":"integer","minimum":0}}},"findings":{"type":"array","description":"One entry per rule that did not pass. Empty when the check is clean.","items":{"type":"object","properties":{"id":{"type":"string","description":"Stable rule identifier."},"severity":{"type":"string","description":"Rule severity."},"detail":{"type":"string","description":"What failed and where."}},"required":["id"]}}},"required":["pass"]}},"required":["pass"]},"returns":"pass (bool) plus wcag{}, seo{}, security{}, performance{} sub-results.","description":"Runs wcag + seo + security + performance against one URL, billed as a single call. Atomic: if any dimension fails to run, the whole call fails and nothing is billed.","auth":"WHICH of these a given deployment accepts is not fixed and this schema cannot know it: read `payment.methods` in /.well-known/agent.json, or the `accepts[]` array in any 402 response. Both list only rails that can genuinely settle right now. The headers each scheme uses: X-API-Key (a prepaid key bought through the MPP top-up rail and spent per call at the same rates; there are no subscriptions); X-PAYMENT (x402 -- price/network/payTo arrive in the 402 body); Authorization: Payment ... (MPP -- Stripe SPT for fiat or Tempo for crypto, challenges arrive in the WWW-Authenticate headers on a 402)","payment_methods":["x402"],"example_request":{"url":"https://hubvibe-io.com/audit/bundle","method":"POST","headers":{"Content-Type":"application/json","X-API-Key":"<your key>"},"body":{"url":"https://example.com"}}},{"path":"/audit","method":"POST","payment_required":true,"price_usd":0.03,"input":{"html":"string (optional)","url":"string (optional, one of html/url required)"},"input_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","title":"Live URL or raw HTML to audit","properties":{"url":{"type":"string","format":"uri","description":"Live, fetchable http(s) URL to audit.","examples":["https://example.com"]},"html":{"type":"string","description":"Raw HTML source to audit instead of fetching a URL."}},"anyOf":[{"required":["url"]},{"required":["html"]}]},"output_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"status":{"type":"string","const":"ok","description":"Present only on a completed audit."},"pass":{"type":"boolean","description":"Whether every rule in this dimension passed."},"engine":{"type":"string","const":"axe-core"},"violations":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","description":"axe-core rule id."},"impact":{"type":["string","null"],"description":"axe-core impact level."},"help":{"type":["string","null"]},"help_url":{"type":"string","format":"uri"},"nodes_affected":{"type":"integer","minimum":0}},"required":["id"]}}},"required":["pass"]},"auth":"WHICH of these a given deployment accepts is not fixed and this schema cannot know it: read `payment.methods` in /.well-known/agent.json, or the `accepts[]` array in any 402 response. Both list only rails that can genuinely settle right now. The headers each scheme uses: X-API-Key (a prepaid key bought through the MPP top-up rail and spent per call at the same rates; there are no subscriptions); X-PAYMENT (x402 -- price/network/payTo arrive in the 402 body); Authorization: Payment ... (MPP -- Stripe SPT for fiat or Tempo for crypto, challenges arrive in the WWW-Authenticate headers on a 402)","payment_methods":["x402"],"note":"Alias of /audit/wcag, kept for backward compatibility."}]}