# api.search1api.com/screenshot is MPP-only: a standard x402 client cannot pay it

Checked 2026-10-30, no payment header sent.

## What came back

```
GET https://api.search1api.com/screenshot  ->  402
www-authenticate: Payment id="UEU4OzanPaJlrwmAveJ7gx88MxkOtsckLNjfv4Us0T8",
                  realm="api.search1api.com", method="tempo", intent="charge", request="eyJhbW91bnQi..."
payment-required: (absent)
```

The challenge is an MPP one: `method="tempo"`, with the payment request base64-packed inside `www-authenticate`.

## Why that is a problem

A standard x402 client reads the payment requirements from the base64 JSON `Payment-Required`
header. It does not parse `www-authenticate`, and it does not read a body on a 402. With that
header absent the client cannot construct a payment, so the endpoint is unreachable for every
x402-native buyer even though it answers 402 with the right status code.

The MPP rail is valid on its own. The two headers are not interchangeable.

## Second gap: no discovery listing

`GET https://api.search1api.com/.well-known/x402-listing` -> 404.

Directory crawlers look for that path on the domain root. With it missing the endpoint is not
listed anywhere they search.

## Machine-checkable result

```json
{
 "url": "https://api.search1api.com/screenshot",
 "checks": {
  "C0_http_402": true,
  "C1_payment_required_header": false,
  "C6_discovery_listing": false
 },
 "fail": ["C6 /.well-known/x402-listing = 404"],
 "score": "1/3",
 "verdict": "PARTIAL/FAIL",
 "report_sha256": "5485fa131b5c716b6a09c1708665bad116dbbdb71cf0ab8097d120fbf4e035fd"
}
```

Same input, same hash. Re-run the request above and you get this file's contents back.

## The fix

Emit the same challenge as a base64 JSON `Payment-Required` header next to `www-authenticate`.
Dual-stack, not a replacement: MPP clients keep using the header they already read.

## Method

These are the first three checks of a deterministic audit I run on any x402 endpoint: status code,
`Payment-Required` header present, and whether the SDK can parse that header into requirements with
the fields a v2 client needs (scheme, network, amount, asset, payTo, maxTimeoutSeconds, resource).
The paid version runs 44 probes across 20 attack classes with per-class remediation; this free pass
is three requests and needs no account.