Gateway API

Management routes accept a wallet session, personal API key, or administrative operator key.

Method	Path	Description
`GET`	`/v1/wrappers`	List wrappers owned by the authenticated user
`GET`	`/v1/wrappers/slug?name=`	Return an available normalized endpoint slug
`POST`	`/v1/wrappers`	Create a disabled or enabled wrapper
`PATCH`	`/v1/wrappers/:id`	Update mutable configuration
`POST`	`/v1/wrappers/:id/enable`	Publish the gateway and Bazaar record
`POST`	`/v1/wrappers/:id/disable`	Stop traffic and remove discovery listing
`DELETE`	`/v1/wrappers/:id`	Delete an owned wrapper
`GET`	`/v1/wrappers/:id/analytics`	Aggregate requests, latency, bytes, and payments
`GET`	`/v1/vault/secrets`	List secret metadata only
`POST`	`/v1/vault/secrets`	Encrypt and store a new scoped credential
`GET`	`/openapi.json`	Discover every enabled public USDC xWrapper through OpenAPI 3.1
`GET`	`/.well-known/x402`	Compatibility fan-out document for x402 discovery crawlers
`GET`	`/favicon.ico`	AutoLayer origin icon used by external discovery catalogs

Public traffic uses ANY /gateway/:slug/*. The buyer receives canonical PAYMENT-REQUIRED terms, retries with PAYMENT-SIGNATURE, and receives PAYMENT-RESPONSE after settlement. Slugs are generated from names and checked against PostgreSQL. A collision receives a short suffix; the backend repeats uniqueness checking transactionally and remains authoritative over UI availability hints.

Origin discovery

/openapi.json is generated from enabled xWrappers and is the canonical contract for origin-level registration on compatible discovery services such as x402scan. Each operation includes its public gateway path, description, tags, output schema, HTTP 402 response, structured x-payment-info, and a non-standard x-stellar-payment block retaining the CAIP-2 network, SEP-41 asset, atomic amount, decimal precision, scheme, and fee-sponsorship signal. OpenAPI prices are decimal USD, while runtime x402 amounts remain integer Stellar USDC base units. AutoLayer converts the values with integer string arithmetic and seven decimal places; for example, runtime amount 10000 is advertised as 0.0010000 USD. Rows using an unknown custom SEP-41 asset are not mislabeled as USD and remain discoverable through the native AutoLayer Bazaar. Before registering an origin, audit the deployed service rather than localhost:

npx -y @agentcash/discovery@latest discover "https://core.autolayer.fi"
npx -y @agentcash/discovery@latest check \
  "https://core.autolayer.fi/gateway/YOUR_SLUG"

Registration is an external publication step. Review every discovered method, route, price, and authentication mode, then explicitly approve registration only after all critical parser and runtime probes pass. The hosted document publishes support@autolayer.fi as its origin-level contact and serves the AutoLayer mark at /favicon.ico. Self-hosters must replace DISCOVERY_CONTACT_EMAIL and DISCOVERY_CONTACT_URL with contact details for their own public origin. Seller account emails are never published automatically.

Vault plaintext is never returned after creation and is injected only into the configured upstream request after successful payment settlement.

Identity

Automation

x402

Discovery

Gateway

Agents

Origin discovery

​Origin discovery

Origin discovery