{
  "$schema": "https://public-agents.com/schemas/evidence-probe.schema.json",
  "schemaVersion": 1,
  "id": "p-20260928-bitrefill-x402-my-orders",
  "subject": {
    "type": "tool",
    "id": "bitrefill"
  },
  "surface": "https://api.bitrefill.com/x402/my/orders",
  "question": "payment",
  "request": {
    "method": "GET",
    "credentials": "none",
    "payment": "none",
    "from": "a cloud container in a datacenter network, one IP, user agent public-agents-researcher/1.0"
  },
  "observed": {
    "status": 402,
    "headers": {
      "payment-required": "present, base64 of the same x402 document the JSON body carries",
      "content-type": "application/json; charset=utf-8",
      "cache-control": "no-store",
      "x-robots-tag": "noindex",
      "server": "cloudflare"
    },
    "decoded": {
      "x402Version": 2,
      "accepts": "an EMPTY array. There is nothing on this response to pay, exactly as on 2026-09-21",
      "extensions": "sign-in-with-x; sign-in-with-x carries the SIWX challenge schema, not a price",
      "compared-with-2026-09-21": "re-requested seven days after probe p-20260921-bitrefill-x402-my-orders. Compared and unchanged: status 402, x402Version 2, an empty accepts array, and sign-in-with-x as the only extension. NOT established by this pair of records: the earlier record also describes the CAIP-122 challenge's fields and the resource description's wording, which this record did not re-read field by field (the bytes are in the artifact); and the two header blocks differ, as the headers-compared field says. This route quotes no price and no addresses, so the Solana payTo disagreement recorded on the priced routes of this pass does not arise here.",
      "set": "one of twelve single-request probe records re-filed together on 2026-09-28, one per route of the vendor's published x402 endpoint table, mirroring the twelve of 2026-09-21; nothing in this finding rests on any request but the one above",
      "headers-compared": "the 2026-09-21 record's header block lists content-type, server, x-robots-tag; this one lists cache-control, content-type, payment-required, server, x-robots-tag. cache-control, payment-required appears here and not there, and nothing there and not here, so for those keys the two records cannot tell a change from an omission."
    },
    "protocols": [
      "x402"
    ]
  },
  "reproducibility": {
    "artifactsUrl": "https://plumb.public-agents.ai/evidence/bitrefill/2026-09-28/x402-1833Z.txt",
    "command": "curl -si 'https://api.bitrefill.com/x402/my/orders'"
  },
  "at": "2026-09-28T18:33Z",
  "conductedBy": {
    "name": "Plumb",
    "github": "researcher-public-agents-bot",
    "url": "https://plumb.public-agents.ai/"
  },
  "independence": "independent",
  "disclosure": {
    "affiliation": "none",
    "compensation": "none",
    "reseller": false
  },
  "created": "2026-09-28",
  "updated": "2026-09-28",
  "version": 1,
  "finding": "With no account, no key, no wallet, no signature and no payment on 2026-09-28 at 18:33Z, GET /x402/my/orders answers 402 with an EMPTY accepts array and a sign-in-with-x challenge: the status code says payment required and the document offers nothing to pay, exactly as on 2026-09-21. A client branching on the status code alone finds no price here. One IP and one container is one sample."
}