# APEX Trust Layer

Before you pay USDC on Arc, get a signed verdict. The scheme name is `apex-upto-v1`.

## One payee

`GET https://apexfaucet.xyz/api/arc-payee-check?payee=<0x>&payer=<your wallet>&amount=<USDC>`

Five free checks a day. After that, `/api/x402/arc-payee-check` is $0.005.

The answer is one of DO_NOT_PAY, CAUTION, NO_MATCH_IN_INDEX, or COULD_NOT_READ. NO_MATCH_IN_INDEX is not the word "safe". It means this index found no poisoning, lookalike, sanction, or blacklist hit.

## The voucher

A voucher is present only when all three are true: the verdict code is 0, `payer` is the wallet that will send, and `amount` is at least 0.01 USDC. The voucher is the same EIP-712 PayeeVerdict. It caps the payment at that amount until `expiresAt` (10 minutes), and PayGuard will accept it once.

Other verdicts set `voucher` to null and do not include a pay call.

## PayGuard

Contract `0x942e886e4aa48346dd8bc594596f662aab57efeb` on Arc (chain id 5042). It holds no funds and has no owner. When a voucher exists, `payGuard.approve.data` and `payGuard.pay.data` are the two calls. They are not sent for you. USDC is `0x3600000000000000000000000000000000000000`.

## Arc Mandate

New boxes (arc-mandate-2, factory `0x91957bd6e6da2880bf49174eaa4b5d36627af9d3`, box code `0x9684274bb3533fa89c6a42152303937492b0f548`) pay only on a clean PayeeVerdict whose payer is the box. `pay()` uses a verdict once. x402 can reuse one unexpired verdict on each free daily slot, and the daily count still applies. Pass `payer` as the box address. Boxes from the v1 factory `0x69e444f722666e13e171181efe054a93e0976b26` do not read the verdict. The v2 factory and the v2 implementation are Sourcify exact matches. Page: https://apexfaucet.xyz/arc/mandate/

## A batch

`GET https://apexfaucet.xyz/api/x402/arc-payee-batch?payees=<0x>,<0x>&payer=<0x>&amount=<USDC>`

Up to 20 payees, $0.02 for the batch. Each row is its own signature. The free door is `/api/arc-payee-batch` and each payee counts as one of the five free checks. A batch that does not fit is refused whole.

## Verify

Attester, domain, and types: `GET https://apexfaucet.xyz/api/arc-payee-check/attester`

Machine policy: `GET https://apexfaucet.xyz/.well-known/apex-trust.json`

Live poisoning counts, not a fixed number: `GET https://apexfaucet.xyz/api/arc-poison-stats`

MCP tool `arc_payee_check` is first at `https://apexfaucet.xyz/api/mcp`. `arc_payee_batch` is next to it.