# goodsong

> Deterministic, evidence-backed verification APIs for AI agents. Pay-per-call via x402 (USDC on Base) -- no signup, no account, no API key. Every response returns a verdict (confirmed/contradicted/unknown) plus evidence -- never a guess.

## Products

### RealCite -- citation, URL, and legal case verification

Dedicated page: https://goodsong.dev/realcite

POST https://goodsong.dev/verify/citation
Verify a citation: does it exist, is it retracted, and does the given title/authors/year/journal match the canonical record? Checked against Crossref (includes Retraction Watch data) and OpenAlex.
Body: {"doi": "10.1234/example.doi"} -- or {"title": "...", "authors": ["..."], "year": 2020, "journal": "..."}. doi and/or title required, rest optional.

POST https://goodsong.dev/verify/url
Verify a URL: does it resolve, what's the final status and redirect chain, is it archived on the Wayback Machine? Checked via direct fetch and the Internet Archive.
Body: {"url": "https://example.com/blog/some-article"} -- expected_content and expected_date are optional.

POST https://goodsong.dev/verify/case
Verify a legal case citation: does it exist, and does the given case name match the canonical record? Checked against CourtListener. Catches a fabricated case citation, including a real-looking citation number paired with an invented case name. Existence only -- does not check whether a case is still good law.
Body: {"citation": "576 U.S. 644"} -- case_name is optional, cross-checked when given.

POST https://goodsong.dev/verify/filing
Verify an SEC filing: given a filer's CIK and a claimed accession number, does that filing actually exist, and does its form type/filing date match what's claimed? Checked against SEC EDGAR's submissions API. Catches a fabricated or misattributed filing citation, including a real-looking accession number paired with an invented form type or date.
Body: {"cik": "320193", "accession_number": "0000320193-23-000106"} -- form_type and filed_date are optional, cross-checked when given.

POST https://goodsong.dev/verify/filings
A filer's recent SEC filings, optionally filtered by form type -- a feed, not a single-claim check (see /verify/filing for that). Checked against SEC EDGAR's submissions API, scoped to the filer's recent filings window.
Body: {"cik": "320193", "form_type": "10-K"} -- form_type is optional; limit is optional, default 5, capped at 20.

POST https://goodsong.dev/verify/drug
Verify an FDA drug record: given a claim_type (approval, ndc, or recall) and its identifier, does that record actually exist, and does the given name match the canonical record? Checked against openFDA. Catches a fabricated or misattributed drug approval, NDC listing, or recall citation. Existence/status only -- not medical advice.
Body: {"claim_type": "approval", "identifier": "NDA020702"} -- claim_type must be approval, ndc, or recall; expected_name is optional, cross-checked when given.

POST https://goodsong.dev/verify/grant
Verify an NIH grant: given a full project number, does that grant actually exist, and does the claimed principal investigator and/or awardee institution match the canonical record? Checked against NIH RePORTER. Catches a fabricated or misattributed grant citation, including a real-looking project number paired with an invented PI or institution.
Body: {"grant_number": "1ZIAHG200389-11"} -- grant_number must include its support-year suffix (a number without it matches every year of that grant, not one record); expected_pi and expected_org are optional, cross-checked when given.

### RealDep -- package and repo existence and safety verification

Dedicated page: https://goodsong.dev/realdep

POST https://goodsong.dev/verify/package
Verify a package: does it exist, is it deprecated or yanked, and does it have known vulnerabilities? Checked against the npm/PyPI/crates.io registry plus OSV.dev advisories. Catches "slopsquatting" -- an agent trusting its own hallucinated package name into installing malware.
Body: {"ecosystem": "npm", "name": "left-pad"} -- ecosystem must be npm, pypi, or crates; version is optional (defaults to latest).

POST https://goodsong.dev/verify/repo
Verify a GitHub repo: does it exist, is it archived, is it disabled? Checked against the GitHub REST API. Catches an agent recommending or depending on an abandoned or hallucinated repo.
Body: {"owner": "expressjs", "repo": "express"}

### RealX402 -- is this x402 seller legit before you pay it

Dedicated page: https://goodsong.dev/x402-safety (same backend/quota as everything else here, just aimed at x402-specific discovery).

POST https://goodsong.dev/verify/seller
Verify an x402 seller: does it exist and respond with a well-formed 402 challenge, is its own declared input/output schema internally consistent, and is its payout address sanctioned? Checked live against the seller itself, a sanctions oracle, and on-chain wallet history (Base payTo addresses only); if the exact seller has a published Cairn (cairnwake.com) conformance report, its verdict is cited as supplementary evidence too -- a dated independent finding, not a live check. A pre-payment check for a marketplace with no real vetting of its own -- confirms the checkable things check out, not a guarantee of trustworthiness.
Body: {"resource_url": "https://api.example.com/paid-endpoint"} -- method is optional, defaults to POST (set to GET if that's what triggers the seller's 402).

POST https://goodsong.dev/verify/wallet
Verify an EVM wallet address before sending or accepting funds: is it on a sanctions list, and how old/active is it on-chain? Checked live against a sanctions oracle and on-chain wallet history (Base addresses only). Same sanctions/history checks as /verify/seller's payTo check, standalone for any address -- not only an x402 seller's declared payout.
Body: {"address": "0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045"}

## Auth

- x402 only: no key, no account. Send the request with no auth header; a 402 response carries the payment challenge (USDC on Base, $0.005/call -- $0.01 for /verify/case). An x402-aware client or agent framework settles it and retries automatically.

## Integration

- OpenAPI spec: https://goodsong.dev/openapi.json (interactive docs at https://goodsong.dev/docs).

## Response contract

Every endpoint, across all products, returns the same shape:

{"verdict": "confirmed|contradicted|unknown", "checks": {...}, "canonical": {...}|null, "evidence": [{"source": "...", "url": "...", "retrieved_at": "ISO8601"}], "latency_ms": 0, "cost": {"amount": "...", "currency": "USDC"}}

"unknown" is a valid, honest answer, returned when a source itself is unreachable -- it is never charged.

This shape is deliberately machine-first: a bounded verdict enum (not free text), boolean checks (not prose), and the identical envelope across every endpoint -- parse it once, use it for all eleven tools.

## Why not just call Crossref/npm/GitHub/SEC EDGAR/openFDA/NIH RePORTER/Chainalysis yourself

You can -- they're all free, public sources. What you're paying for is the part after the fetch: normalizing a messy source response into a real confirmed/contradicted/unknown, handling pagination and edge cases correctly (e.g. an old SEC filing isn't "not found" just because it's missing from the first page of a filer's recent history -- see /verify/filing), and getting back the identical verdict/checks/evidence shape regardless of which of the ten sources was checked, instead of writing and maintaining ten different source-specific parsers.