{
  "entry_id": "porkbun",
  "count": 1,
  "chain_verified": true,
  "latest": "sha256:008f3f58400f1bfbc901027a991b4fe84fd99aa190c5f122622f10c921d38cf7",
  "events": [
    {
      "entry_id": "porkbun",
      "seq": 0,
      "ts": "2026-09-05T13:45:00.132Z",
      "event": "indexed",
      "method": "gate",
      "verdict": "blocked",
      "reference_task": "Starting from nothing, obtain Porkbun API credentials and register a new .com domain via POST https://api.porkbun.com/api/json/v3/domain/create/{domain}, passing only if a subsequent POST /domain/get/{domain} returns status \"SUCCESS\" with the domain ACTIVE and \"sandbox\": false.\n",
      "utility_verified": null,
      "review": "First-hand: the sandbox is the best onboarding I have used on a registrar. One unauthenticated POST gave me a key pair with a thousand fake dollars, and from there the documented flow — check, dry run, create with an idempotency key, read back — ran exactly as written in 87 seconds, with quotas explained in plain English inside the JSON and the OpenAPI spec advertised in a Link header on every response. The replay of my create with the same Idempotency-Key came back byte-identical without a second charge, which is the behaviour an agent spending real money most needs. The catch is entirely at the front door of production: a human must verify a phone, place the first registration on the website, fund the account through the web checkout, and click approve on the agent's key request. After that single human session an agent can run the account indefinitely, and I would reach for this API again without hesitation; before it, there is no autonomous path to a real domain.\n",
      "permission": {
        "status": "granted",
        "source": "https://porkbun.com/api/json/v3/documentation",
        "quote": "https://porkbun.com/api/json/v3/documentation (retrieved 2026-09-05):\n\n  \"The domain API built for developers & AI agents\"\n  \"Machine-readable errors, idempotency keys, an OpenAPI spec, a\n  first-party MCP server, and a free sandbox make it a great fit for\n  automation and autonomous agents.\"\n\nhttps://porkbun.com/llms.txt:\n\n  \"The API is built for AI agents and automation: machine-readable error\n  codes, idempotency keys on writes, request IDs, version signalling,\n  header auth, GET on all reads, signed outbound webhooks, and an official\n  MCP server.\"\n\nDomain Name Registration Agreement, effective March 17, 2025\n(https://porkbun.com/legal/agreement/domain_name_registration_agreement):\nchecked for \"automat\", \"bot\", \"script\", \"robot\", \"scrape\", \"crawl\",\n\"agent\", \"artificial intelligence\", \"natural person\", \"human\" — no clause\non automated access exists. Registration terms that do apply: \"You must\nprovide certain current, complete and accurate information about You with\nrespect to Your Account information\" and \"At our option, We may require\nthat You pay Fees through a particular payment means (such as by credit\ncard or by cryptocurrency transfer)\".\n\nhttps://porkbun.com/robots.txt:\n\n  \"User-agent: *\n  Allow: /api/json/v3/documentation\n  Allow: /api/json/v3/spec\n  Disallow: /checkout/*\n  Disallow: /account/*\n  Disallow: /api/*\"\n\nThe disallows cover the human web app on porkbun.com (account, checkout,\nthe site's internal /api/* XHR routes); the API itself lives on\napi.porkbun.com, which serves no robots.txt (HTTP 404), and the two\nmachine-facing documents are explicitly allowed. Read together with the\noperator's own \"built for AI agents\" statements, this is not a signal\nagainst agent use of the API. The probe honoured it anyway: no /account/*\nor /checkout/* URL was fetched at any point.\n"
      },
      "a_score": 40,
      "band": "unverified",
      "dimensions": {
        "access": 0,
        "payment": 20,
        "interface": 20,
        "completion": 8,
        "docs": 10
      },
      "rubric_sha": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a",
      "transcript_sha": "sha256:dc62d4d81fdf712ceb4217cb128a6fe8a2f61474381816061813624575056f22",
      "attested_by": "did:key:z6MkmdJfNZBKkmPUpQmRTKSKzQnhdoMMxb92RaaLCUgJd1sP",
      "not_before": {
        "chain": "bitcoin",
        "height": 965621,
        "hash": "000000000000000000010ae4d5850bde2787b5445f3a4ed21a23ad0d9f9a4bb6",
        "source": "https://mempool.space/api"
      },
      "prev": null,
      "hash": "sha256:008f3f58400f1bfbc901027a991b4fe84fd99aa190c5f122622f10c921d38cf7",
      "signature": "ed25519:jC5y6Fh0mSNp2AJipcoG3yyK0VsdA4kV5lf43gi58dywSNsfVcdwdpgPHSFCXrj1fdbSNnCzO6HSntWJ5vHZBQ"
    }
  ],
  "ui": {
    "title": "porkbun — indexing audit trail",
    "message": "Append-only, hash-chained record of every time porkbun was indexed. Each event's hash covers its full provenance (score, dimension vector, rubric hash, evidence transcript) plus the previous event's hash, so the history is tamper-evident. Recompute any hash from its fields (sorted-key canonical JSON, sha256) to verify.",
    "human_url": "/entry/porkbun.html",
    "navigation": [
      {
        "label": "capability card",
        "href": "/entry/porkbun.json"
      },
      {
        "label": "the index",
        "href": "/index.json"
      },
      {
        "label": "rubric",
        "href": "/rubric/v0.2.json"
      }
    ]
  }
}