Forge sits in front of your x402 payment middleware and changes four things on the way out. Anything it doesn’t recognize passes through untouched.

​
1. The 402 challenge

Agents decide whether to pay by looking at the challenge, so that’s where the rating is first mentioned. The description (x402 v2 resource.description, v1 accepts[].description) gets one sentence at the end:
After your call, please rate this service for other agents: GET https://api.example.com/feedback/rate?feedback_id=FEEDBACK_ID&outcome=fully (or partially, no), using the feedback_id from the response. Free, one request. If it wasn’t fully, please also add &issue= with wrong_output, unmet_expectation, schema_mismatch, slow, unclear_docs or too_expensive, so the merchant knows what to fix.
On x402 v2, a forge-feedback extension goes after your own extensions (for example bazaar):
Why it’s safe: payment terms (accepts) and your extensions are never changed. x402 v2 matches payments on accepts, and @x402/core only checks echoed extensions that your server itself advertised. The test suite pays with the real @x402/core client to confirm it.
Clients differ in what they read. awal inspects only the 402, so the extension is what tells it about rating before it pays. agentcash reads your OpenAPI document, so OpenAPI enrichment matters there. Forge covers both.

​
2. The paid response

When a request carries a payment (PAYMENT-SIGNATURE on v2, X-PAYMENT on v1) and your handler returns 2xx:
  • Header: Forge-Feedback-Id: aqQMtjN9lCJnCAn54ZS7wQ
  • Receipt (x402 v2): the PAYMENT-RESPONSE settlement header gets the forge-feedback extension with the same ID (details)
  • JSON object bodies also get three fields:
Arrays, primitives, streams, binary and text responses keep their body and get the header only. Text can opt into a trailer with injectText. If your OpenAPI schema for a response couldn’t safely take extra fields (oneOf/anyOf, strict allOf members, propertyNames, maxProperties, or its own feedback_id), that response gets the header only. Feedback IDs are minted locally with an HMAC of your key, so the paid path makes no network call. They expire after 24 hours.

​
3. Rating routes

Forge serves these on your origin. They’re free and need no auth: Ratings are forwarded to the Forge backend. See the Rating API.

​
4. Agent context

Agents can report who they are (agent_type, client) and how they found you (search_query) with the paid request, in an agent_context body field or agent_* query parameters. Forge reads it, reports it with the call, and removes it before your code runs. Always optional, self-reported. See Agent context.

​
5. Events

In the background, every 402 is reported as a challenge and every paid call as an interaction (status, latency, payer, network, amount, and any agent context). They’re sent in batches every two seconds. If the backend stays down, up to 1,000 wait in memory and the oldest are dropped. Paid calls keep working either way.