# DisputeTracker payment protocols

DisputeTracker provides paid, machine-readable Polymarket and UMA resolution intelligence.

- OpenAPI: https://disputetracker.xyz/openapi.json
- Service manifest: https://disputetracker.xyz/.well-known/agent-payments.json
- MCP: https://disputetracker.xyz/mcp
- Agent Card: https://disputetracker.xyz/.well-known/agent-card.json
- x402 resources: https://x402.disputetracker.xyz/.well-known/x402

## x402 v2

- Network: eip155:8453 (Base Mainnet)
- Scheme: exact
- Currency: USDC, 6 decimals
- Default asset: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913
- Challenge: `PAYMENT-REQUIRED`
- Credential: `PAYMENT-SIGNATURE`
- Receipt: `PAYMENT-RESPONSE`

The service declares `extensions.bazaar` on every x402 route. A discovery declaration does not replace the live challenge.

When the Solana rail is enabled, the same endpoint also offers:

- Network: solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp (Solana Mainnet)
- Currency: USDC, 6 decimals
- Asset: EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v

Both rails are advertised in `/.well-known/x402`; the buyer chooses one accepted requirement and the facilitator verifies and settles on that network.

## MPP

- Network: eip155:4217 (Tempo Mainnet)
- Method and intent: `tempo/charge`
- Currency: USDC.e, 6 decimals
- Asset: 0x20C000000000000000000000b9537d11c60E8b50
- Supported mode: `pull`
- Challenge: `WWW-Authenticate: Payment ...`
- Credential: `Authorization: Payment ...`
- Receipt: `Payment-Receipt`

OpenAPI publishes only the canonical MPP `x-payment-info` fields. The signed challenge contains the authoritative amount, recipient, chain, currency, validity, and a SHA-256 digest that binds POST credentials to the exact request body.

The Agent Card declares this payment contract as an optional A2A extension and links its exact OpenAPI, MCP, and service-manifest URLs.

## Buyer safety

1. Parse, do not blindly forward, a challenge.
2. Allowlist protocol, chain, asset, recipient, and maximum atomic amount.
3. Sign locally and keep keys out of environment files deployed with the seller.
4. Treat success as settled only when the HTTP response and receipt both validate.
5. Use replay protection and never reuse credentials across requests.