A permission-aware business layer for agents.

What access buys

1. Search the directory

Discover published profiles by keyword, city, state, or human-readable industry slug. Results are capped at 25 and use an opaque cursor for stable pagination.

curl 'https://shield.dealport.com/api/v1/profiles/search?q=industrial&state=TX&limit=20'

2. Resolve an exact business

Use a normalized website domain, or an exact name plus city and two-letter state. Results include canonical HTML and JSON URLs and are capped at five.

By domain

curl 'https://shield.dealport.com/api/v1/profiles/resolve?domain=example.com'

By name and location

curl 'https://shield.dealport.com/api/v1/profiles/resolve?name=Example%20Industrial%20Services&city=Tulsa&state=OK'

3. Retrieve the profile

Follow profileApiUrl from a resolution match. A profile includes human-readable business facts, sanitized provenance, freshness, messaging state, agentAccess, ownerConnection, and stable action links.

curl 'https://shield.dealport.com/api/v1/profiles/example-industrial-tulsa-ok'

4. Pay to place an eligible owner message

First retrieve the business profile. If ownerConnection.paidAgentMessage.available is true, POST to its advertised endpoint. Shield rejects overt spam, unsafe content, and owner-preference mismatches before settlement. An eligible settled message enters the owner’s configured immediate, digest, or review flow.

curl -X POST 'https://shield.dealport.com/api/v1/agent/profiles/OWNER_ADVERTISED_SLUG/messages/x402' \
  -H 'Idempotency-Key: agent-message-2026-08-27-001' \
  -H 'Content-Type: application/json' \
  -d '{"agentName":"Partner Agent","agentEmail":"agent@example.com","agentOrganization":"Example Labs","subject":"Partnership inquiry","body":"We would like to discuss a relevant partnership for your business.","purpose":"other"}'

The first response is HTTP 402 and includes the exact x402 requirements. The endpoint is Base mainnet (eip155:8453), the asset is native USDC, and one message costs $0.50 (500000 atomic units). Signing does not disclose the wallet key to Shield.

Copy-and-run Node client

Use Node 22 or newer. Pass the exact endpoint advertised by the profile; do not construct or guess an endpoint for an unavailable owner.

npm install @x402/fetch @x402/evm viem

BASE_PAYER_PRIVATE_KEY=0x… node --experimental-strip-types paid-message.ts \
  'https://shield.dealport.com/api/v1/agent/profiles/OWNER_ADVERTISED_SLUG/messages/x402'

import { randomUUID } from "node:crypto";
import { wrapFetchWithPaymentFromConfig } from "@x402/fetch";
import { ExactEvmScheme } from "@x402/evm";
import { privateKeyToAccount } from "viem/accounts";

const endpoint = process.argv[2];
const privateKey = process.env.BASE_PAYER_PRIVATE_KEY as `0x${string}`;
if (!endpoint || !privateKey) throw new Error("endpoint and BASE_PAYER_PRIVATE_KEY are required");

const payer = privateKeyToAccount(privateKey);
const x402Fetch = wrapFetchWithPaymentFromConfig(fetch, {
  schemes: [{ network: "eip155:8453", client: new ExactEvmScheme(payer) }],
});
const body = JSON.stringify({
  agentName: "Partner Agent",
  agentEmail: "agent@example.com",
  agentOrganization: "Example Labs",
  subject: "Partnership inquiry",
  body: "We would like to discuss a relevant partnership for your business.",
  purpose: "other",
});

// The wrapper performs: 402 → sign → Payment-Signature → exact retry.
const response = await x402Fetch(endpoint, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Idempotency-Key": randomUUID(),
  },
  body,
});
const result = await response.json();
if (response.status !== 202) throw new Error(JSON.stringify(result));

const receiptResponse = await fetch(result.data.receiptUrl);
const receipt = await receiptResponse.json();
console.log({ message: result.data, receipt: receipt.data });

Keep the same Idempotency-Key, URL, and JSON body for any application retry. The first request receives 402; the client signs its requirements, sends Payment-Signature, and retries those exact bytes. A successful response is 202 with an opaque receiptUrl. Poll that URL until its status is placed_with_owner or not_delivered. Replaying the same completed request returns the existing receipt without another payment or owner message.

5. Use machine-scale data access

Shield API keys use Authorization: Bearer. Every metered request also uses an Idempotency-Key, so a retry cannot consume the same unit twice.

curl -X POST 'https://shield.dealport.com/api/v1/agent/profiles/batch' \
  -H 'Authorization: Bearer dsh_…' \
  -H 'Idempotency-Key: your-stable-request-id' \
  -H 'Content-Type: application/json' \
  -d '{"requests":[{"domain":"example.com"}]}'

When no entitlement is present, premium endpoints return HTTP 402 Payment Required. Subscribe through Stripe to receive a one-time API key. The x402 per-request rail is available. Both paths return only public facts.

Owner permission

ownerConnection.policy is open, review, or closed. paidAgentMessage.available and its endpoint are authoritative. Payment never changes either value. If an action URL is absent, do not infer or locate a private address.

Discovery

Agents can begin at /.well-known/dealshield.json or /llms.txt. Search is intentionally paginated rather than offered as a bulk export. Every profile page includes an application/json alternate link, and every API response includes canonical and self links.

Provenance and privacy

provenance reports the public field, observation time, and one of four safe source categories: public_record, company_website, owner_verified, or other_public_source. Database tables, record IDs, owner email addresses, and private contacts are excluded.