Bitrovas

How L402 works

L402 is HTTP 402 Payment Required plus Lightning: an endpoint answers with a Lightning invoice and a token; after paying, the client repeats the same request with 'Authorization: L402 <token>:<preimage>' and receives the result. No account, no API key.

Services

• Bitrovas PSBT-Check

  Pre-sign check of an unsigned Bitcoin PSBT: recipients, amounts, change, fee/sat-vB, RBF, sighash, missing UTXO info, dust, address-poisoning lookalikes. Verdict ok|warn|danger, JSON + text DE/EN. Never signs or broadcasts.

  21 sats POST /v1/psbtcheck

• Bitrovas PoisonCheck

  Address-poisoning check: compares the address you are about to send to (used) with the address you know (expected) and detects lookalike/vanity patterns for Bitcoin, EVM and Tron. Level poison|review|clear, JSON + text DE/EN. Single 21 sats; batch up to 50 addresses 21 + 5 sats per address. Pattern, not proof; not a send approval.

  21 sats POST /v1/poisoncheck

• Bitrovas JSON Validate & Repair

  Validate and repair a JSON array of flat records (max 1000 rows): syntax repair (trailing commas, code fences, Python literals), whitespace trim, NULL normalization, duplicate removal, optional type standardization, e-mail check and JSON Schema (2020-12) validation with flag|drop. Returns cleaned JSON + machine-readable report. Deterministic; no data stored.

  10 sats POST /v1/jsonrepair

• Bitrovas Wallet-Adressen

  Watch-only address derivation from xpub/ypub/zpub/tpub or an output descriptor: receive + change addresses (configurable gap, max 1000) and ownership check of given addresses with derivation path. Offline, nothing stored. Private keys/seeds are rejected.

  21 sats POST /v1/walletaddr

• Bitrovas QR-Rechnung-Check

  Technical offline check of a Swiss QR-bill (SPC payload) or IBAN + reference: format, IBAN checksum, CH/LI, QR-IBAN vs reference type (QRR/SCOR/NON), QR-reference mod10, ISO 11649, amount/currency, mandatory fields, lengths, character set. Optional: compares the bill's IBAN with expected supplier IBAN(s) supplied by the customer (plain or SHA-256); mismatch = danger. Only checks structure and this comparison, not whether a bill is genuine. Verdict ok|warn|danger, DE/EN + JSON. Nothing stored or logged.

  10 sats POST /v1/qrbill

• Bitrovas FormatCheck

  Validate CSV, YAML, XML, TOML or JSON (data max 1 MiB, 1M elements). Price: 10 sats + 1 sat per started KB of data, free quote at POST /v1/formatcheck/quote. Converts to JSON (or flat JSON -> CSV); optional JSON Schema 2020-12 validation (local $ref only). Safe parsers (defusedxml, yaml.safe_load, tomllib), size and time limits, in-memory only. Invalid input = free 400 with error position. Nothing stored or logged.

  from 11 sats (10 + 1 per started KB) POST /v1/formatcheck

• Bitrovas Zeitstempel (OpenTimestamps)

  Bitcoin timestamp for a SHA-256 hash or Nostr event id via OpenTimestamps. Returns a pending .ots proof (base64) immediately; the free GET /v1/timestamp/<id> returns the upgraded proof and block height after confirmation (usually 1–12 h). Only the hash is sent, never the file.

  21 sats POST /v1/timestamp

Example

# 1) request -> 402 with invoice + token
curl -i -X POST https://api.bitrovas.ch/v1/<product> -H 'Content-Type: application/json' -d '{...}'
# 2) pay the 'invoice' (bolt11) with any Lightning wallet, keep the preimage
# 3) same request again with the credential
curl -X POST https://api.bitrovas.ch/v1/<product> -H 'Content-Type: application/json' \
     -H 'Authorization: L402 <token>:<preimage>' -d '{...}'

Links

• /.well-known/l402-services (machine-readable directory)
• https://github.com/bitrovas/bitrovas-psbtcheck (agent SDK / MCP tool)