Penny Machine 42 / Integration guide
Controlled one-payment pilot. Read current service status before signing. Only when purchasable is true can the first valid buyer pay 0.01 native USDC on Base. Admission pauses during settlement and closes after success. No sale or customer payment is claimed until independently confirmed.
A deterministic second check before a product-data import: repeated SKUs, blank required SKU values, inconsistent name/price/currency/barcode values across repeated SKUs, and suspicious prices. Returns a structured JSON report and a review CSV. Duplicate rows and uncertain identifiers/prices are preserved for human or upstream workflow review.
The intended caller is an agent or importer that already has a small, permitted product CSV. It needs no Shopify account or store access. This is not a complete Shopify CSV importer, stock synchroniser, GTIN checker, currency conversion service or Merchant Center compliance certificate.
POST /v1/catalog/audit with Content-Type: application/json. Body must contain exactly one string field: csv. Use comma-separated UTF-8 with a header row. The required column is exactly sku; recognise optional fields by their exact lower-case names: name,price,compare_at_price,currency,barcode. Map export headers locally first; raw Shopify Variant SKU is not accepted as sku.
Maximum 100 data rows, 30 columns, 30,000 UTF-8 CSV bytes, 2,048 Unicode characters per cell, and 40,000 bytes for the entire JSON request. Price checks use decimal values from 0.01 to 100000; these thresholds do not prove a commercial price is correct. Missing barcode/currency columns are not automatically errors. No remote URL fetching or external APIs are used by the audit engine.
Synthetic request JSON · Synthetic CSV · Actual engine output for that CSV
curl -i https://eloquent-brioche-25bbc9.netlify.app/health curl -i -X POST https://eloquent-brioche-25bbc9.netlify.app/v1/catalog/audit \ -H 'Content-Type: application/json' \ --data-binary @request.json
While payments are disabled, expect 503 with live_payments_disabled_no_payment_attempted. The downloadable result was generated locally from the synthetic file; it is not a paid API receipt and contains no invented payment reference.
First read service status. Proceed only when purchasable:true and an actual runtime 402 challenge supplies non-empty requirements. A compatible x402 v2 client uses the buyer's own authorisation; never transmit private keys to this API. Check Base eip155:8453, native USDC 0x833589fcd6edb6e08f4c7c32d4f71b54bda02913, and amount 10000 atomic units. EOA EIP-3009 only; contract-wallet and Permit2 schemes are unsupported.
| Status | Caller action |
|---|---|
| 200 | Read report, review CSV, payment transaction and PAYMENT-RESPONSE. A successful payment is not import approval. |
| 202 | Pending confirmations. Retain and retry the exact same body and PAYMENT-SIGNATURE after Retry-After. Do not create another payment. |
| 400 / 415 | Correct malformed/oversized CSV or content type. Do not repeatedly pay for invalid input. |
| 402 | Inspect the runtime challenge or rejection. Never blindly sign a second authorisation for a pending order. |
| 409 / 503 | Stop automatic new payment attempts. Reconcile the existing transaction; retry only the identical retained proof/body where instructed. |
report.import_approved remains false. Review CSV can contain formula-like values, so import it as text rather than opening untrusted cells as executable formulas. No product ownership, physical inventory, GTIN assignment or currency validity is established. Product data only: do not send customer, medical or secret information.
Application storage keeps payment identifiers, request hashes and reconciliation records, not uploaded CSV or signatures. Hosting and network providers may retain operational request metadata; this is not a zero-logging guarantee.