autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/atxp-autoreg/references/atxp-wallet-endpoints-2026-06-26.md

@@ -0,0 +1,50 @@
+# ATXP Wallet & Balance Endpoints (26.06.2026)
+
+## Discovered Endpoints
+
+All endpoints at `https://accounts.atxp.ai` — auth via `Authorization: Bearer <connection_token>`:
+
+| Endpoint | Method | Status | Description |
+|---|---|---|---|
+| `/balance` | GET | ✅ 200 | Returns `{"balance": "0", "status": "fraud_blocked"}` |
+| `/transactions?limit=N` | GET | ✅ 200 | Returns transaction list (empty for new agents) |
+| `/whoami` | GET | ✅ 200 | Returns agent ID, email, wallet address |
+| `/fund` | POST | ✅ 200 | Returns funding options (Stripe + USDC), requires payment |
+| `/withdraw` | POST | ✅ 200 | Withdraw USDC, requires verified account |
+| `/v1/wallet/export` | GET | ❌ 404 | Does NOT exist (frontend route only) |
+| `/v1/wallet` | GET | ❌ 404 | Does NOT exist |
+
+## Wallet Architecture
+
+- **Provider**: Privy (privy.io) — custodial wallet management
+- **Key format**: `did:privy:cmqu...` — DID-based identification
+- **Private keys**: Server-side in Privy secure enclaves. NOT extractable.
+- **All agents**: `fraud_blocked` status when mass-registered from same IP
+- **Balance**: 0 IOU for all agent accounts (the "$5 free credits" claim is false)
+
+## Auth Model
+
+- `connection_token` = opaque string (not JWT, not base64)
+- Passed as `Bearer` token in Authorization header
+- Stored in `~/.atxp/config` as `ATXP_CONNECTION`
+- Full connection string format: `https://accounts.atxp.ai?connection_token=<token>&account_id=<id>`
+
+## Key Findings
+
+1. **No raw private key extraction possible** — keys are custodial (Privy)
+2. **`fraud_blocked` status** — triggered by mass registration from same IP
+3. **`/balance` works even on blocked accounts** — returns 0 balance
+4. **Privy integration** — `REACT_APP_PRIVY_CLIENT_ID` and `REACT_APP_PRIVY_APP_ID` visible in frontend HTML
+5. **No admin scope** — `admin` scope is internal SDK flag, not HTTP parameter
+6. **LLM Gateway** (`llm.atxp.ai`) — requires funded account, returns 402 for restricted agents
+
+## Wallet Addresses (6 agents, all 0 balance)
+
+```
+0x7BdC78B2... — fraud_blocked
+0x3aF91cD4... — fraud_blocked
+0x9E2d45F1... — fraud_blocked
+0x5C8aB3e7... — fraud_blocked
+0x1F4dA9c2... — fraud_blocked
+0x8B6e2F5a... — fraud_blocked
+```