Every agent-payable API.

Paid ($0.05). ALWAYS runs a fresh 25-check scan of the origin (non-settling GET/HEAD + benign empty-POST probes), bypassing the 24h cache — use free GET /v1/report to read the cached result. Concurrent requests for the same origin join the in-flight scan rather than double-scanning. Returns grade, score, per-check status + evidence + fix instructions, and a shareable report URL. Unreachable/broken origins are a valid graded result (F). 504 processing responses and errors are never charged.

Paid ($0.10). The entire graded directory in one machine-shaped response: every listed origin with grade, score, grade history, legitimacy signals, branding, verification and featured status — the same record shape as /v1/directory plus gradeHistory, firstSeenAt, and scanCount. Capped at 10,000 records (truncated:true if hit). Grades measure protocol conformance only and are NOT endorsements.

Paid MCP endpoint — POST a JSON-RPC tools/call to get_content for public profile data (github, twitter, linkedin).

Paid quote for a bounded custom job. Returns accept, map_to_existing, or reject plus a fixed run SKU and price. One counter then stop. We decline if we cannot make money.

Curated named color palette with hex codes, mood, and CSS variables.

Palmyr: GET /domains

Palmyr: GET /domains/joingrange.xyz/dns

List your prepaid cards (status, last4, balance — never full card numbers; those are per-card via GET /cards/:id).

Refresh a card's live balance and transactions from the issuer (rate-limited upstream: 1 per 5 min per card).

Wait (blocking, up to 90s) for an SMS verification code / OTP to arrive on a phone number you own, and return the parsed code. Body (all optional): { timeout_s (default 60, max 90), lookback_s (default 10; pass 0 for reused numbers), pattern (custom regex, max 256 chars) }

Rent another 30 minutes on a live disposable temp number — each $0.20 call pushes expires_at 30 min further. Stackable up to 24h total; owner-only; expired temp leases cannot be revived (lease a fresh one).

Create an end-to-end encrypted email inbox keyed to your Solana wallet. Defaults to {name}@palmyr.ai; pass `domain` to provision on a Namecheap-registered domain you own (auto-sets MX/SPF/DKIM records).

Read decrypted messages from an inbox you own. Payment wallet must match the inbox wallet.

Read all SMS messages received on a phone number you own or have shared access to.

Place an outbound phone call from a number you own or have shared access to, with optional TTS or audio playback.

Poll the status of a domain registration you started (owner-only).

Post a video to a TikTok account you control (from video_base64 or video_url), now or scheduled. Optional schedule_at (ISO-8601) uses TikTok's OWN scheduler, which accepts only ~15 minutes to ~10 days ahead — there is no way to schedule further out. Async: returns an operation to poll.

Read stored per-post engagement history for a TikTok account you own (time series, latest, or growth).

Log in to TikTok on the server, into the account's own persistent browser profile. Returns a link to hand a human, who scans the QR with the TikTok app.

Like a TikTok video from an account you control. Async: returns an operation to poll.

List the TikTok accounts your wallet owns, with session health.

Delete a video from a TikTok account you control. Async: returns an operation to poll.

Academic literature search over OpenAlex (250M+ works with citation counts) or arXiv: title, authors, year, venue, DOI, abstract

Parse a URL into parts — host, path, query params as JSON, fragment, origin — or resolve a relative reference against a base URL correctly.

Parse and validate a cron expression — returns the next N run times as ISO timestamps in any IANA timezone. Cron schedule checker.

Parse CSV into JSON rows — auto-detects the delimiter, handles quoted fields and headers, optional type coercion. Returns columns, row count, and per-row parse errors.

Parse DMARC p= and rua= fields from a TXT record. Call when extracting DMARC policy from a caller-supplied record. Returns policy and rua as deterministic JSON for $0.001 USDC via x402 on Base. First-party local math only—no RPC, live market feed, API keys, storage, or mediagen. Advisory only; the caller owns capital, risk, and production controls.

Parses a receipt, invoice, or fiscal document image/PDF into structured JSON: vendor, date, currency, totals, tax, and line items.

Parse MX preference and host from an MX record string. Call when normalizing DNS MX answers for deliverability logic. Returns preference and host as deterministic JSON for $0.001 USDC via x402 on Base. First-party local math only—no RPC, live market feed, API keys, storage, or mediagen. Advisory only; the caller owns capital, risk, and production controls.

Parse raw receipt text into structured line items, subtotal, tax, and total. This endpoint does not perform image OCR.

Parse XML into JSON — validates first with line-numbered errors, preserves attributes, optional type coercion. Works for RSS feeds, sitemaps, and SOAP-ish payloads.

Parse a URL into parts. Call when splitting host, path, query, and fragment without fetching the URL. Returns structured URL parts; never performs network I/O. $0.001 USDC per successful call via x402 on Base—deterministic first-party JSON, no API key, no subscription, and nothing is billed on structured validation errors.

Parse a cron expression into human-readable explanation + next N execution times. Algorithmic — instant.

Parse a free-text address into structured components. Returns street, city, postal code, state/province, country. Works with addresses worldwide.

Parse a full name into components: first, middle, last, prefix, suffix, nickname. Handles 'Dr. Karl-Johan von Lindström III' correctly.

Parse ambiguous date strings into ISO 8601. Handles '3/4/25', 'March 4th', '4. mars 2025', '2025-W14'. Detects ambiguity.

Parse float with default on failure. Call when you need fail-soft float parsing for agent inputs. Returns value and ok for $0.001 USDC via x402 on Base. No network, no keys, no retention; first-party local JSON only. Results are advisory; the caller owns budgets, auth, and production controls.

Parse human durations like 1h30m for $0.001 USDC. Call when you need this bounded result without an API key or subscription. Returns machine-readable JSON via x402 on Base or Solana. Limitation: results cover only the supplied input or one bounded public endpoint at request time; callers must verify before acting.

Parse int with default on failure. Call when you need fail-soft integer parsing for agent inputs. Returns value and ok for $0.001 USDC via x402 on Base. No network, no keys, no retention; first-party local JSON only. Results are advisory; the caller owns budgets, auth, and production controls.

Parse magnitude/place from a USGS-like feature properties object. Call when normalizing already-fetched earthquake JSON. Returns mag and place as deterministic JSON for $0.001 USDC via x402 on Base. First-party local math only—no RPC, live market feed, API keys, storage, or mediagen. Advisory only; the caller owns capital, risk, and production controls.

Parse major.minor.patch from a semver string. Call when you compare agent dependency versions without a full parser. Returns valid, major, minor, patch for $0.001 USDC via x402 on Base. No network, no keys, no retention; first-party local JSON only. Results are advisory; the caller owns budgets, auth, and production controls.

Parse query pairs and redact credential-like keys without fetching — call when parsing query pairs and redacting secret-like keys. Use on text/URLs the agent already holds—adjacent to high-volume extract demand, never advertised as general web or X search. Returns deterministic machine-readable JSON for $0.003 USDC via x402 on Base. Execution is first-party, local-only, stateless, and memory-only with no paid upstream, no input retention, and no claim of live chain tip, web search, or media gen…

Parse size strings to bytes. Use when users type 1.5MB and your pipeline needs an integer byte budget. Returns integer bytes parsed from human size text. $0.001 USDC per successful call via x402 on Base—deterministic first-party JSON, no API key, no subscription, and nothing is billed on structured validation errors.

Parse truthy/falsey strings. Call when agents ingest messy flags like yes/no/1/0/true from tools or forms. Returns a boolean plus the normalized interpretation. $0.001 USDC per successful call via x402 on Base—deterministic first-party JSON, no API key, no subscription, and nothing is billed on structured validation errors.

Password - CASA Cybersecurity Assessment - Consolidates evidence on transport configuration, web surface hardening, and service behavior under load. Determines whether the deployed service meets baseline security and performance standards at the infrastructure level, independently of its protocol compliance.

Password - CASA Cybersecurity Assessment - Assesses service availability, responsiveness, and stability under normal load, sustained traffic, and request surges. It verifies whether the endpoint remains usable without excessive latency, failures, or degradation.

Password - CASA Cybersecurity Assessment - Groups web-layer security issues involving HTTP headers, caching, browser protections, resource policies, and response exposure. It complements transport and functional testing by evaluating application hardening and the security of the exposed web surface.

Password - CASA Cybersecurity Assessment - Runs the full assessment combining functional compliance, performance validation, web security findings, and transport security.

Password - CASA Cybersecurity Assessment - Evaluates whether the service correctly follows UCP and AP2 protocols, including identity, negotiation, validation, transaction, and business rules. It combines evidence from discovery, authorization, checkout integrity, state transitions, and request validation.

Password - CASA Cybersecurity Assessment - Consolidates evidence on secure communications, including certificate validity, hostname matching, protocol and cipher strength, forward secrecy, and TLS vulnerabilities. It determines whether the service uses a secure, authentic, and correctly configured transport channel.