Docs / Start here

Glossary

Short definitions, alphabetical. Each links to the page where the term is defined precisely.

Active: Service state: stake is at or above min_stake. The only state in which offers are issued and the buyer SDK pays. States
allowed_status: P4 parameter: the HTTP statuses the seller may charge for. A receipt with any other status proves a breach. P4
Bond Registry: The contract that holds stake per service and stores each service’s terms versions and signing keys. Only the Claims contract may slash. Reference
Buyer: The agent or app that pays per request. The receipt names the buyer, and any payout goes to that address.
Chain binding: The chain-specific parts of LOPW: encoding, signature scheme, contract functions and the payment-rail binding. Stellar is the first. Bindings
Claim: One transaction submitting a signed offer and receipt (plus a second receipt for P1) to the Claims contract. Outcome: paid, rejected, or an error with nothing recorded. Claims
Claim window: Seconds after served_at during which a claim may be filed. Part of the terms; at most 24 hours, at most one hour when P6 is offered.
Claims contract: Verifies evidence, applies the seven checks, calls the validator, and pays or rejects. Claims
Closed: Service state after a full withdrawal. No offers, no claims. Final.
data_as_of: Receipt field: Unix seconds the data was true as of; 0 when not applicable. Drives P3.
Domain separation: The type tag, network ID and registry address hashed in front of every signed body, so a signature is valid for one type, one network and one deployment only. Hashing and signing
Epoch (slash epoch): A period one unbonding delay long during which total slashes may not exceed 50% of the stake held at its start. Slash rate limit
Facilitator: The x402 service that verifies and settles the payment. Unchanged by LOPW.
Fee (protocol fees): A one-off registration fee and an annual fee on stake, in the stake token, paid to a treasury. Both may be zero. Fees
Key version: Index of a service’s Ed25519 signing key. Rotation retires the old version with a timestamp; receipts served before it stay verifiable. Rotate a key
max_claim: Offer field: the most a single receipt can pay out. The payout is min(max_claim, stake remaining), and never above the launch limit max_payout if one is set.
min_stake: A service parameter set at registration: the stake below which the service is Suspended. At least 100 USDC.
NotProven / NotVerifiable: The two reasons a validator can give for not proving a breach. Both are recorded on-chain as a rejected claim; neither penalises anyone.
Offer (warranty offer): The seller’s signed promise for one call, carried in the 402 response under extensions.lopw. Fields
offer_nonce: 32 random bytes that make every offer hash unique. The buyer SDK refuses to pay an offer it has already paid.
Oracle (SEP-40): An on-chain price feed with price(asset, timestamp) and decimals(). P6 reads one named in the terms. P6
payment_reference: Receipt field: the settlement transaction hash. Together with service_id it keys the one-paid-claim-per-payment rule.
Pending: Service state after registration until deposits reach min_stake. No offers can exist, so stake can be withdrawn at once.
Predicate: One breach condition a contract can decide from the evidence alone. Six exist: P1 Equivocation, P2 Terms mismatch, P3 Stale data, P4 Bad status, P5 Size limit, P6 Oracle deviation. Predicates
Receipt (service receipt): The seller’s signed statement of what it served and under which offer, carried in PAYMENT-RESPONSE under extensions.lopw. Fields
request_hash / response_hash: SHA-256 bindings of the request (method, path with query, body hash) and of the response body. The buyer SDK recomputes both.
Seller: Runs a paid API, stakes the bond, signs offers and receipts with a dedicated signing key.
Service: One registered API with its own stake, terms versions, signing keys and state, identified by a 32-byte service_id.
Signing key: An Ed25519 key separate from the seller’s account. It signs offers and receipts and cannot move stake.
Slash: The registry transferring part of a service’s stake to a buyer on a proven claim. Callable only by the Claims contract.
Stake (bond): USDC a seller locks per service in the Bond Registry. The only money a claim can pay from; a service’s total payouts can never exceed it.
Suspended: Service state when a slash or a fee takes stake below min_stake. No new offers; claims still paid while stake remains.
Terms: A service’s list of predicates with parameters plus a claim window. Hashed into terms_hash; old versions stay readable so old receipts can still be claimed. Fields
Time lock: The 26-hour delay on admin changes to who may slash, which validator decides a predicate, fees and loosened limits, so every seller can withdraw first. Time locks
Unbonding: Service state while a full exit waits out the unbonding delay: the largest claim window ever registered plus one hour. Stake stays slashable.
Untrusted response: The buyer SDK’s verdict on a receipt that fails verification (bad signature, wrong offer, buyer, payment, hashes or status). Not claimable.
Validator: A contract with one function, validate(terms, offer, receipt, extra), that decides one predicate. The Claims contract keeps an allowlist of validators by predicate ID.
x402: The HTTP payment protocol LOPW extends. The offer and receipt travel in its v2 extension slot named lopw; verify and settle are unchanged. x402 extension