{"name":"OceanAlt Compliant Payment Gateway","lang":"en","desc":"Every payment passes 11 gates before settlement (9 always on, 2 off by default and opt-in): Attribution (KYA) → Revocation check → Identity proof (anti-impersonation) → KYC gate (optional) → Per-payment limit → Daily cumulative limit → Payee allowlist → Mandate-intent match (anti prompt-injection) → AML sanctions & risk screening → Behavioral anomaly detection (optional) → Replay & double-spend prevention. The public tier simulates settlement; the authenticated tier (x-pay-key) can settle on-chain.","gates":[{"key":"kya","name":"Attribution (KYA)","nameZh":"身份归因（KYA）","nameEn":"Attribution (KYA)","optional":false},{"key":"revoked","name":"Revocation check","nameZh":"授权吊销检查","nameEn":"Revocation check","optional":false},{"key":"proof","name":"Identity proof (anti-impersonation)","nameZh":"身份证明（防冒用）","nameEn":"Identity proof (anti-impersonation)","optional":false},{"key":"kyc","name":"KYC gate (optional)","nameZh":"KYC 准入（可选）","nameEn":"KYC gate (optional)","optional":true},{"key":"limit","name":"Per-payment limit","nameZh":"单笔额度","nameEn":"Per-payment limit","optional":false},{"key":"velocity","name":"Daily cumulative limit","nameZh":"单日累计额度","nameEn":"Daily cumulative limit","optional":false},{"key":"allowlist","name":"Payee allowlist","nameZh":"收款白名单","nameEn":"Payee allowlist","optional":false},{"key":"mandate","name":"Mandate-intent match (anti prompt-injection)","nameZh":"授权意图比对（防提示注入）","nameEn":"Mandate-intent match (anti prompt-injection)","optional":false},{"key":"aml","name":"AML sanctions & risk screening","nameZh":"AML 制裁与风险筛查","nameEn":"AML sanctions & risk screening","optional":false},{"key":"anomaly","name":"Behavioral anomaly detection (optional)","nameZh":"行为异常检测（可选）","nameEn":"Behavioral anomaly detection (optional)","optional":true},{"key":"replay","name":"Replay & double-spend prevention","nameZh":"防重放 / 防双花","nameEn":"Replay & double-spend prevention","optional":false}],"auth":"Registration issues an agentSecret. Send it in the x-agent-secret header on every later call to prove you are that agent. Secrets can be rotated; a mandate can be revoked at any time and takes effect immediately (RAP pillar 2).","rateLimit":"40 requests/min per IP; 20 requests/min per agent. Over the limit returns 429.","data_retention":{"version":"1.5","decided_on":"2026-09-16","query_records_days":366,"call_stats_days":366,"evidence_records_days":730,"ip_anonymised_after_days":181,"statement":"Query records (including call statistics) are kept for 366 days — a full year plus one day, enough for a year-over-year comparison — with the source IP blanked after 181 days while the record stays; compliance-evidence records for 730 days (about two years). A daily job actually performs the deletion; this is not a documentation-only claim.","anonymised":[{"data":"Source IP inside API call records","days":181,"why":"An IP is a personal identifier. The counts need a full year for comparisons; the IP does not: it is blanked after 181 days while the record stays."},{"data":"Pending requests to loosen an API key's limits (the requested scopes, source-IP allowlist and expiry)","days":2,"why":"The confirmation link stops working after 24 hours, which leaves the request of no further use; the extra day only covers the gap until the daily cleanup job runs. Confirming or cancelling clears it immediately, without waiting for this rule."}],"rules":[{"data":"API key records that were never activated and never used (email, key hash, the name you gave it)","days":30,"why":"Requested but never activated and never used — we have no use for that email address, so the record goes after 30 days. Keys in actual use are untouched."},{"data":"API call records (endpoint, time, source IP, user agent — not the address or URL you looked up)","days":366,"why":"Used for capacity planning and adoption metrics. 366 days allows a year-over-year comparison for the same month, and stops one day past a full year."},{"data":"Page view counts (coarse referrer domain, no personal identifiers)","days":366,"why":"Same tier as call statistics, so traffic mix can be compared year over year. It never contained personally identifying fields to begin with."},{"data":"Article read events","days":366,"why":"For editorial analytics. Kept in the same tier as other query records so content mix can be compared with the same month a year earlier."},{"data":"Share events (which channel, which article; linked to an account for signed-in users, unlinked on account deletion)","days":366,"why":"For editorial analytics, kept in the same tier as other query records."},{"data":"Rate-limit counter windows","days":7,"why":"Windowed by the minute and useless once expired. Seven days is only for investigating traffic anomalies."},{"data":"Idempotency records (a copy of the first response to a payment request, so a retry after a network failure is safe)","days":2,"why":"They stop being used after 24 hours; the extra day only covers the gap until the daily cleanup job runs."},{"data":"Webhook delivery records (each attempt to reach the webhook URL you configured: event type, message body, status code, duration, error summary)","days":30,"why":"Used to investigate why a message did not arrive and to confirm failures were retried. 30 days covers a full monthly cycle; the block evidence itself is kept separately for 2 years."},{"data":"Block records (which gate, why, target address)","days":730,"why":"This is compliance evidence. If a dispute arises you must be able to reconstruct why a payment was blocked, and that window is measured in years."},{"data":"Payment verdict records","days":730,"why":"Same — approvals need evidence too. Logging only blocks leaves you unable to explain why something was let through."},{"data":"Admin action trail","days":730,"why":"Who changed what, and when. Shorter than two years means no meaningful internal accountability."}],"not_auto_deleted":[{"data":"Risk address lists and entity labels","why":"Public-source intelligence, not anyone's behavioural record. Deleting it would destroy the product itself."},{"data":"Published content and rating profiles","why":"Anything published is a public record, governed by the editorial process rather than a timer."},{"data":"Control-baseline attestations","why":"These carry an explicit one-year validity and a withdrawal mechanism; expiry and withdrawal are shown truthfully rather than silently deleted."}],"policy_url":"https://oceanalt.com/en/privacy"},"standard":"https://oceanalt.com/en/rap","usage":{"POST /api/pay { action:'preview', amountUsdc, to, purpose, agentId?, network? }":"① 付款前无状态预检（不结算/不消费nonce/不需凭证）：先问『这笔过不过闸』，逐项返回。AML 收款方风险筛查对所有人有效；额度/白名单/用途需已 register 的 mandate 才生效。network 可传 base/solana/ethereum（x402 主要在 base、solana），决定链上分析查哪条链。x402 场景推荐的第一个调用。","POST /api/pay { action:'register', agentId, entity, label?, mandate? }":"归因 agent（KYA，落库）→ 返回 agentSecret；可同时设本 agent 的授权信封 mandate:{maxUsdc,dailyUsdc,payees:[],purpose}","POST /api/pay { action:'set-mandate', agentId, mandate } + x-agent-secret":"设置/更新本 agent 的授权信封（多租户：每个 agent 自己的额度/白名单/用途）","POST /api/pay { action:'set-discoverable', agentId, discoverable, publicName? } + x-agent-secret":"Choose whether to publish this agent's chain of accountability (agent → principal → mandate → credential → wallet) to the identity registry. Off by default; only posture is shown, never the values. Resolve at GET /api/registry/agent?agentId=","POST /api/pay { action:'status', agentId } + x-agent-secret":"查看本 agent 的授权信封 + 今日已花 + 最近被拦记录","POST /api/pay { action:'check', agentId }":"查询归因状态","POST /api/pay { action:'rotate', agentId } + x-agent-secret":"轮换凭证（旧的即刻作废）","POST /api/pay { action:'revoke', agentId } + x-agent-secret":"吊销授权（即刻生效；终态，不可自助恢复）","POST /api/pay { agentId, amountUsdc, to, purpose, nonce } + x-agent-secret":"发起合规支付（nonce 须唯一一次性，防重放/双花）。金额 ≥ mandate.holdOverUsdc 时返回 202+holdId 挂起等人工批准","POST /api/pay { action:'hold-status', holdId }":"轮询挂起支付的批准结果（pending 待批准 / approved 已批准并结算 / rejected 已拒绝）","Idempotency-Key: <uuid>  (request header; payment call and rotate)":"The payment call and rotate accept an Idempotency-Key request header (a UUID is recommended). When retrying after a network failure, keep the same key, the same nonce and the same body: within 24 hours you get the original response back (with an Idempotent-Replayed: true header). Nothing runs twice and nothing is recorded as a replay attack. Same key with a different body → 422; original still running → 409 (resend unchanged after retry-after seconds). A replay must present the same x-agent-secret as the original. Calls without the header behave exactly as before; other actions ignore it."},"mandate":{"maxUsdc":0.1,"dailyUsdc":0.3,"allowedPayees":["0x0200000000000000000000000000000000000402"],"purpose":"unlock-premium","holdOverUsdc":null},"example":"curl -X POST https://oceanalt.com/api/pay -H 'content-type: application/json' -d '{\"action\":\"register\",\"agentId\":\"bot-1\",\"entity\":\"Acme (KYC)\"}'"}