561 Group Market

CycloneDX 1.6 SBOM and ML-BOM Structural Diagnostics

CycloneDX1.6 SBOM/ML-BOM structure with both fixed OWASP Apache-2.0 references. Ingress requires1.6; the official schema alone accepts other version strings. idn-email/iri-reference not asserted. No inventory/provenance truth, signature verification, vulnerability or legal verdict. Invalid documents are paid diagnostics. Source: https://github.com/CycloneDX/specification/tree/ad83dae28b236b8760286399da4daba77592de86/schema

Price
$0.01 USDC per request
Network
Base mainnet, eip155:8453, settled in USDC through the Coinbase CDP facilitator
Method and URL
POST https://market.561.group/v1/assurance/cyclonedx-1-6/schema-check
Response type
application/json
Seller
Causeway Services (561 Group)

Input contract

Input that fails this contract is refused with a 4xx status before any payment is requested.

{
  "maxBytes": 131072,
  "bodySchema": {
    "type": "object",
    "description": "Submit the CycloneDX JSON BOM itself with specVersion exactly1.6, up to131072 UTF-8 bytes. The route refuses other/missing editions before computation; the unchanged official schema alone does not enforce the version. Both fixed reference schemas are included; no remote retrieval.",
    "required": [
      "specVersion"
    ],
    "properties": {
      "specVersion": {
        "const": "1.6",
        "description": "This route selects1.6 explicitly; the unmodified official schema alone accepts arbitrary version strings."
      }
    }
  }
}

Example request

{
  "method": "POST",
  "url": "https://market.561.group/v1/assurance/cyclonedx-1-6/schema-check",
  "headers": {
    "accept": "application/json",
    "content-type": "application/json"
  },
  "body": {
    "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
    "bomFormat": "CycloneDX",
    "specVersion": "1.6",
    "serialNumber": "urn:uuid:ed5c5ba0-2be6-4b58-ac29-01a7fd375123",
    "version": 1,
    "components": [
      {
        "bom-ref": "huggingface.co-meta-llama-Llama-2-7b",
        "group": "meta-llama",
        "name": "Llama-2-7b",
        "type": "machine-learning-model",
        "supplier": {
          "name": "Hugging Face"
        },
        "publisher": "meta",
        "externalReferences": [
          {
            "type": "distribution",
            "url": "https://huggingface.co/meta-llama/Llama-2-7b"
          }
        ],
        "modelCard": {
          "considerations": {
            "environmentalConsiderations": {
              "energyConsumptions": [
                {
                  "activity": "training",
                  "energyProviders": [
                    {
                      "description": "Meta data-center, US-East",
                      "organization": {
                        "name": "Meta",
                        "address": {
                          "country": "United States",
                          "region": "New Jersey",
                          "locality": "Newark"
                        }
                      },
                      "energySource": "natural-gas",
                      "energyProvided": {
                        "value": 0.4,
                        "unit": "kWh"
                      }
                    }
                  ],
                  "activityEnergyCost": {
                    "value": 0.4,
                    "unit": "kWh"
                  },
                  "co2CostEquivalent": {
                    "value": 31.22,
                    "unit": "tCO2eq"
                  },
                  "co2CostOffset": {
                    "value": 31.22,
                    "unit": "tCO2eq"
                  }
                }
              ]
            }
          }
        }
      }
    ]
  }
}

Output

{
  "schema": {
    "type": "object",
    "required": [
      "valid",
      "issues"
    ],
    "properties": {
      "valid": {
        "type": "boolean",
        "description": "True means only that the submitted JSON passes the frozen upstream SPDX 2.3 JSON Schema. Automatic JSON shape diagnostics against the exact official SPDX 2.3 draft-07 schema. Find missing required fields, wrong nested types, enum violations and unexpected properties with JSON-pointer paths. Exact historical schema only: it does not enforce all textual SPDX requirements (including version/license values, timestamps or documentNamespace presence), inventory truth, digest validity, cross-reference integrity, CVE absence, signatures or legal compliance. SPDX 2.3.1 and 3.x are not covered. Invalid SBOMs are paid diagnostic results; initial experimental price $0.05. Schema by SPDX Project, CC-BY-3.0, unchanged at SHA256 239208b7ac287b3cf5d9a9af23f9d69863971102a5e1587a27a398b43490b89b. Source and attribution: https://github.com/spdx/spdx-spec/blob/aadf3b0b8dbbabdb4d880b0fc714255fea436ff7/schemas/spdx-schema.json"
      },
      "issues": {
        "type": "array",
        "items": {
          "type": "object",
          "required": [
            "kind",
            "path",
            "keyword",
            "message"
          ],
          "properties": {
            "kind": {
              "enum": [
                "instance",
                "schema"
              ]
            },
            "path": {
              "type": "string"
            },
            "keyword": {
              "type": "string"
            },
            "message": {
              "type": "string"
            }
          }
        }
      }
    },
    "description": "Native JSON Schema diagnostics against the pinned official CycloneDX1.6 schema and its complete explicit reference corpus. valid:true does not authenticate model cards, attestations, signatures, inventory, cryptographic algorithms or legal compliance. idn-email and iri-reference formats are annotations in this evaluator. A kind:schema issue means engine/schema failure, never a finding against the document. No support for other CycloneDX editions is implied. The route separately admits specVersion1.6; the official schema alone permits arbitrary version strings."
  },
  "example": {
    "valid": true,
    "issues": []
  }
}

How to buy with x402

  1. Send the request without payment. The server answers 402 Payment Required with a base64 JSON PAYMENT-REQUIRED header holding the amount, asset, network and payee.
  2. Have your wallet sign an EIP-3009 transferWithAuthorization for exactly those terms (an x402 client library does this for you).
  3. Repeat the identical request with the signed payload in the PAYMENT-SIGNATURE header.
  4. The server verifies, runs the operation, settles, and returns 200 with the result and a PAYMENT-RESPONSE header carrying the settlement receipt.

Read the price without paying

curl --include --request POST --header 'accept: application/json' --header 'content-type: application/json' --data-raw '{"$schema":"http://cyclonedx.org/schema/bom-1.6.schema.json","bomFormat":"CycloneDX","specVersion":"1.6","serialNumber":"urn:uuid:ed5c5ba0-2be6-4b58-ac29-01a7fd375123","version":1,"components":[{"bom-ref":"huggingface.co-meta-llama-Llama-2-7b","group":"meta-llama","name":"Llama-2-7b","type":"machine-learning-model","supplier":{"name":"Hugging Face"},"publisher":"meta","externalReferences":[{"type":"distribution","url":"https://huggingface.co/meta-llama/Llama-2-7b"}],"modelCard":{"considerations":{"environmentalConsiderations":{"energyConsumptions":[{"activity":"training","energyProviders":[{"description":"Meta data-center, US-East","organization":{"name":"Meta","address":{"country":"United States","region":"New Jersey","locality":"Newark"}},"energySource":"natural-gas","energyProvided":{"value":0.4,"unit":"kWh"}}],"activityEnergyCost":{"value":0.4,"unit":"kWh"},"co2CostEquivalent":{"value":31.22,"unit":"tCO2eq"},"co2CostOffset":{"value":31.22,"unit":"tCO2eq"}}]}}}}]}' --url 'https://market.561.group/v1/assurance/cyclonedx-1-6/schema-check'

This request authorizes nothing; it returns the live payment terms. Read the full explanation of x402.

Machine-readable