X402 Secure Demo Scenario

This scenario is the standard partner demo for X402 Secure with Verifiable Intent-style evidence, AP2 mandate references, and x402 payment binding.

It is designed for repeatable validation. The demo does not claim Mastercard certification. It shows how X402 Secure can consume VI-compatible evidence and AP2 context, bind that evidence to a concrete x402 payment, and enforce the Trustline decision before settlement.

Architecture

XRPL keeps the XRPL x402 Facilitator as the public edge and calls embedded X402 Secure internally before settlement. Base and Solana can call the hosted paid API or X402 Secure proxy path directly for the same risk-control layer.

Demo Actors

Allow Path

The allow path uses matching amount, asset, payee, resource, AP2 mandate, and trace context.

{
  "wallet_address": "0xBuyer",
  "agent_id": "agent_demo_001",
  "authorization": "paid-tool-token",
  "verifiable_intent": {
    "profile": "mastercard-vi-v0.1",
    "presentationRef": "vi://presentation/demo-001",
    "constraints": {
      "amount": "1.00",
      "currency": "USDC",
      "payee": "0xMerchant",
      "resource": "https://merchant.example/demo/music-pass"
    }
  },
  "ap2_context": {
    "intentMandateRef": "ap2://intent/demo-001",
    "paymentMandateRef": "ap2://payment/demo-001"
  },
  "payment_context": {
    "protocol": "x402",
    "chain": "base",
    "network": "base",
    "asset": "USDC",
    "amount": "1.00",
    "destination": "0xMerchant",
    "resource": "https://merchant.example/demo/music-pass"
  },
  "policy": {
    "requireVerifiableIntent": true,
    "requirePaymentMandate": true,
    "reviewMode": "block"
  }
}

Expected response:

{
  "decision": "allow",
  "risk_level": "low",
  "vi": {
    "present": true,
    "parsed": true,
    "constraint_satisfied": true,
    "violations": []
  },
  "binding": {
    "payment_bound": true,
    "violations": []
  },
  "dashboard_summary": {
    "decision": "allow",
    "constraint_violations": [],
    "binding_violations": []
  }
}

Acceptance checks:

• The Trustline assessment endpoint is called exactly once.
• X402 Secure returns an allow decision with an evidence reference.
• The upstream x402 facilitator or XRPL settlement path continues only after the allow decision.
• A settlement receipt is posted back to X402 Secure after successful settlement.

Block Path

The block path changes only one field: the payment amount exceeds the VI constraint.

{
  "wallet_address": "0xBuyer",
  "agent_id": "agent_demo_001",
  "authorization": "paid-tool-token",
  "verifiable_intent": {
    "profile": "mastercard-vi-v0.1",
    "presentationRef": "vi://presentation/demo-001",
    "constraints": {
      "amount": "1.00",
      "currency": "USDC",
      "payee": "0xMerchant"
    }
  },
  "ap2_context": {
    "paymentMandateRef": "ap2://payment/demo-001"
  },
  "payment_context": {
    "protocol": "x402",
    "chain": "base",
    "network": "base",
    "asset": "USDC",
    "amount": "25.00",
    "destination": "0xMerchant"
  },
  "policy": {
    "requireVerifiableIntent": true,
    "requirePaymentMandate": true,
    "reviewMode": "block"
  }
}

Expected response:

{
  "decision": "deny",
  "risk_level": "high",
  "vi": {
    "constraint_satisfied": false,
    "violations": [
      {
        "code": "AMOUNT_EXCEEDS_LIMIT"
      }
    ]
  },
  "dashboard_summary": {
    "decision": "deny",
    "constraint_violations": [
      {
        "code": "AMOUNT_EXCEEDS_LIMIT"
      }
    ]
  }
}

Acceptance checks:

• X402 Secure blocks before settlement.
• The upstream facilitator is not called in the blocked path.
• The dashboard summary exposes the violation code without requiring the caller to parse the raw Trustline object.
• A failed settlement receipt is not required unless the payment rail had already been attempted.

XRPL Demo Variant

For XRPL, the buyer or merchant sends extensions.x402Secure to the XRPL x402 Facilitator. The Facilitator normalizes the selected payment requirement and calls:

POST /internal/x402-secure/facilitator/evaluate

The demo should verify:

• The XRPL x402 Facilitator is the only public XRPL endpoint.
• The Facilitator does not call Trustline directly.
• X402 Secure receives XRPL amount, destination, asset, resource, payment hashes, VI evidence references, AP2 mandate references, and trace context.
• X402 Secure returns enough metadata for the Facilitator to produce a useful error without exposing private VI claims.

Final Demo Checklist