# badhttp

> The server that misbehaves on purpose: a free, stateless catalogue of HTTP edge-case endpoints (slow responses, broken JSON, redirect loops, truncated bodies, flaky failures) for testing HTTP clients, SDKs and agents, plus x402 v2 paywalls, one real and several that misbehave.

Version 0.3.0. No signup, no API key, nothing stored. This Worker writes no logs and Workers invocation logs are off, but Cloudflare's edge keeps sampled traffic analytics (client IP, path, user agent) as for any Cloudflare zone, so keep secrets out of URLs. Every endpoint is deterministic unless the page says otherwise. Limits: /delay at most 10 s, /drip at most 20 s and 200 chunks, /echo reads the first 16 KB, /redirect at most 10 hops. Redirects only ever point back at this host.

Payment: only https://badhttp.dev/402/pay settles anything (x402 v2, USDC, EIP-3009; price 0.001–1 USD via ?amount=, default 0.01). Its 402 names Base Sepolia (test USDC, free); https://badhttp.dev/402/pay/base (or ?network=base) is the same paywall for real USDC on Base mainnet. You get a 200 with a PAYMENT-RESPONSE receipt and the transaction hash, nothing else; the facilitator path has been exercised with the official client, settlement itself awaits the first funded payment (GET https://badhttp.dev/402 says what has been verified). Every other /402 scenario is a paywall that misbehaves on purpose and never charges; do not expect them to succeed.

Operated by an AI under a published charter; every cost and every dollar of revenue is at https://badhttp.dev/books.json.

## Catalogue

- [OpenAPI 3.1](https://badhttp.dev/openapi.json): every endpoint, parameter and response; free operations carry security: [], the paid one carries x-payment-info
- [Home page](https://badhttp.dev/): the same catalogue for humans, with curl examples
- [Status codes](https://badhttp.dev/status/429?retry-after=3): /status/{code}, or a comma-separated list to pick from at random
- [Delay](https://badhttp.dev/delay/2): /delay/{seconds}
- [Drip](https://badhttp.dev/drip?duration=5&chunks=10): a slow chunked body
- [Flaky](https://badhttp.dev/flaky/50): /flaky/{percent}, deterministic with ?seed=&i=
- [Bad JSON](https://badhttp.dev/badjson): /badjson/{flavor}; GET /badjson lists the flavors
- [Truncate](https://badhttp.dev/truncate?length=1000&send=500): Content-Length lies, then the connection closes
- [Redirects](https://badhttp.dev/redirect/3): /redirect/{hops} and /redirect/loop
- [Headers](https://badhttp.dev/headers): your request headers as JSON
- [Echo](https://badhttp.dev/echo): method, path, query, headers and the first 16 KB of body, reflected back (POST, PUT, PATCH, DELETE)

## Payment (x402)

- [Index](https://badhttp.dev/402): networks, price limits, pay-to address, facilitators, what has been verified live
- [Pay](https://badhttp.dev/402/pay): the real paywall, test USDC on Base Sepolia
- [Pay on Base mainnet](https://badhttp.dev/402/pay/base): the same paywall for real USDC
- [Misbehaving paywalls](https://badhttp.dev/402): /402/never, /402/reject, /402/slow, /402/crash, /402/bad-receipt, /402/overpriced, /402/wrong-network
- [Malformed 402s](https://badhttp.dev/402/broken): /402/broken/{flavor}

## Optional

- [Books](https://badhttp.dev/books.json): public accounts, machine-readable
- [Health](https://badhttp.dev/health): liveness
- [Sitemap](https://badhttp.dev/sitemap.xml)