# WarpMetal > REQUIRED FIRST READ FOR AGENTS. This file is the authoritative machine > contract. Do not infer purchase steps, prices, OS names, or payment > destinations from the marketing HTML at https://warpmetal.com/. > Order of operations: this file, then GET https://api.warpmetal.com/api/catalog, > then POST https://api.warpmetal.com/api/orders. A live HTTP 402 > PAYMENT-REQUIRED from api.warpmetal.com overrides every price below. WarpMetal sells key-only VPS compute over HTTP using x402 v2. Canonical frontend: https://warpmetal.com/ Canonical API: https://api.warpmetal.com/ OpenAPI document: https://api.warpmetal.com/openapi.json Machine guide mirror: https://warpmetal.com/.well-known/llms.txt Agent discovery: https://warpmetal.com/.well-known/agent.json API discovery: GET https://api.warpmetal.com/ API health: GET https://api.warpmetal.com/api/health Payment networks: Solana USDT and TRON USDT Term: 30 days, explicit renewal only Provisioning: typically 5–10 minutes after payment finality The ownerToken returned when a purchase task is prepared is the control credential for that resource. A wallet authorizes x402 payments; it does not replace the ownerToken for task or lifecycle operations. Live HTTP 402 PAYMENT-REQUIRED from api.warpmetal.com is authoritative for price, asset, network, and destination. This guide yields to that challenge. ## Products Catalog entries expose both a descriptive resourceClass and an operational planId. Use products[].id as planId in POST /api/orders and /api/checkout/{planId}. products[].featured marks the catalog-highlighted plan (currently agent). Live GET /api/catalog is authoritative for available plans, prices, free OS images, and locations. If the catalog returns HTTP 503, pause purchasing. Specs below are current snapshots and yield to live catalog values when they differ. Catalog locations are informational; POST /api/orders does not accept a location field. - resourceClass vps.standard / planId standard — $12 / 30 days — 2 vCPU, 4 GB RAM, 40 GB NVMe, 10 TB @ 1 Gbps - resourceClass vps.agent / planId agent — $20 / 30 days — 4 vCPU, 8 GB RAM, 80 GB NVMe, 10 TB @ 1 Gbps - resourceClass vps.build / planId build — $45 / 30 days — 8 vCPU, 16 GB RAM, 160 GB NVMe, 10 TB @ 1 Gbps - resourceClass vps.heavy / planId heavy — $75 / 30 days — 12 vCPU, 24 GB RAM, 240 GB NVMe, 10 TB @ 1 Gbps The 1 vCPU product is deferred and must not be offered. ## Purchase 1. GET https://api.warpmetal.com/api/catalog to read live free OS inventory. 2. POST https://api.warpmetal.com/api/orders with required fields planId, hostname (max 63 characters), osName, and sshPublicKey. email is optional and used for notifications only. 3. On success (HTTP 201), save the returned task and ownerToken. The ownerToken is displayed once and is required for checkout, task polling, and lifecycle calls. HTTP 400 means invalid plan, hostname, free OS, SSH key, or email. HTTP 503 means inventory unavailable; pause purchasing. 4. POST https://api.warpmetal.com/api/checkout/{planId} with taskId and Authorization: Bearer {ownerToken}. 5. If the response is HTTP 402, read the PAYMENT-REQUIRED header, authorize payment with a wallet, and retry the exact same request with PAYMENT-SIGNATURE. 6. If the response is HTTP 202 with payment_pending, wait for Retry-After and retry the exact same request and exact same PAYMENT-SIGNATURE. Never create a replacement payment. HTTP 202 alone does not prove payment finality; the response body state decides the next action. 7. If the response is HTTP 202 with provisioning started, poll GET https://api.warpmetal.com/api/tasks/{taskId} with the ownerToken. Follow pollAfterSeconds. Continue while state is prepared, payment_pending, paid, or provisioning. Stop when state is ready. Treat expired, cancellation_pending, cancelled, and failed as terminal. If state is provider_ambiguous, do not retry blindly and do not pay again. osName must be the exact name of a live catalog image with monthlyPrice equal to zero and sshKey support. Catalog images also report cloudInit. Do not hard-code OS version lists from this guide. The public key must be an OpenSSH RSA, Ed25519, or ECDSA public key. Never send a private key. Buyers never send a compute-provider API key. ## Task GET https://api.warpmetal.com/api/tasks/{taskId} with Authorization: Bearer {ownerToken} returns task and pollAfterSeconds. HTTP 404 means the taskId and ownerToken pair was not found; do not retry that pair in a loop. Task fields: id, planId, hostname, locationName, osName, sshFingerprint, state, publicIp, deviceId, termEndsAt. Task states: prepared, payment_pending, paid, provisioning, ready, expired, cancellation_pending, cancelled, failed, provider_ambiguous. When state is ready, publicIp is the address for SSH using the private key that matches the submitted sshPublicKey. Use sshFingerprint to verify the host. termEndsAt is the reference for when to renew. ## Lifecycle All lifecycle endpoints require Authorization: Bearer {ownerToken}. - POST https://api.warpmetal.com/api/tasks/{taskId}/power with action boot, reboot, or shutdown - POST https://api.warpmetal.com/api/tasks/{taskId}/reload with confirm "ERASE"; reloads are destructive and accept free OS only. HTTP 409 means the provider outcome is ambiguous; do not retry blindly. - GET or POST https://api.warpmetal.com/api/networks for owner-scoped VPS private networks. POST /api/networks returns HTTP 409 when network capacity is reached. - POST https://api.warpmetal.com/api/tasks/{taskId}/network to attach or detach a private network - POST https://api.warpmetal.com/api/tasks/{taskId}/renew for another explicit 30-day x402 payment. HTTP 402 returns PAYMENT-REQUIRED; sign and retry the exact same request with PAYMENT-SIGNATURE. HTTP 202 means renewal payment pending; wait and retry the exact same request and signature; never create a replacement payment. HTTP 200 means the term was extended by 30 days. There is no client-invoked destroy or cancel endpoint in the public API. Email is optional and used for notifications only, such as renewal, billing, and network-related notices. It is never an account, never a login, and never recovers the ownerToken. Notices are sent at 7, 3, and 1 days when configured. Instances that pass term end without renewal are cancelled by the maintenance sweep.