x402 Preflight · blog · census
x402 Bazaar census: what 26,692 paid endpoints actually return
We probed every resource published in the x402 Bazaar: 26,692 endpoints across 2,470 hostnames and 1,188 registrable domains. No wallet, no credentials, no payment — just the unpaid call that a buying agent makes first. This is what came back.
The short version: the plumbing works far better than the folklore says, the economics are smaller than anyone assumes, and the catalogue has a concentration problem that no status code reveals.
Method, in one paragraph
We downloaded the full catalogue from the x402 discovery endpoint on 18 October 2026 (26,697 listings; the API reported 26,701 and the difference is pagination drift during the download). Each resource was probed with a plain GET; when the paid verb was not GET — or the route answered 405, 404 or 200 — we made one POST with an empty body. Two classes, rate limiting (429) and no response, were re-probed at low concurrency so that our own load could not be mistaken for the endpoint's behaviour.
What the catalogue returns
| Class | Resources | Share |
|---|---|---|
| Healthy — 402 on GET | 20,111 | 75.3% |
| Healthy — 402 only on POST | 3,298 | 12.4% |
| Template URL, not verifiable | 1,124 | 4.2% |
| Rate limited by the endpoint (429) | 703 | 2.6% |
| Dead listing (404 or 410 on both verbs) | 491 | 1.8% |
| No response | 476 | 1.8% |
| 405 with no reachable challenge | 206 | 0.8% |
| Other (400/406/415/5xx) | 168 | 0.6% |
| Returns 200 without charging | 69 | 0.3% |
| Auth gate before the challenge | 46 | 0.2% |
87.7% of the catalogue charges correctly, and every one of those healthy endpoints returned a challenge we could decode: amount, network, asset and receiver were all readable without guessing. The protocol layer is not the weak point.
Finding 1 — the dead-catalogue story is wrong
It is common to hear that most x402 listings are broken. On this data, the defensible defect rate is 3.0%: 491 dead listings, 206 routes that answer 405 without ever offering a challenge, 69 that return the payload for free, and 46 that put a login in front of the payment gate.
What is broken is discovery, not payment. 1,124 resources (4.2%) are URLs with an unresolved template parameter — :address, {id}, <id> — published exactly as they were written in the code. An agent cannot call those, and no status code says so: the URL is simply not a URL yet.
Finding 2 — the economy is fractions of a cent
Of 23,268 challenges with a readable amount, the median price is 0.01 USD. The distribution is even more lopsided than the median suggests:
| Price band | Resources |
|---|---|
| ≤ 0.001 USD | 2,249 |
| 0.001 – 0.01 USD | 13,530 |
| 0.01 – 0.1 USD | 6,102 |
| 0.1 – 1 USD | 1,219 |
| > 1 USD | 168 |
Fifty-eight percent of the catalogue sits between a tenth of a cent and one cent. Card rails cannot serve that price point; that is the entire reason x402 exists, and the data shows sellers already price like it.
Finding 3 — a handful of operators inflate the catalogue
26,692 resources do not mean 26,692 businesses. The catalogue is heavily concentrated:
mahastrategies.com— 1,155 resources, 780 with a defect.saylorinnovations.com— 1,027 resources, 294 with a defect.agentrxi.com— 229 resources, 228 with a defect.torbrooknews.com— 71 resources, 70 with a defect.
One domain can hold more endpoints than the next hundred operators combined. Any claim about "the size of the x402 economy" that counts listings instead of operators is measuring a handful of farms.
Finding 4 — the amount unit is not interoperable
We normalised amounts assuming USDC's six decimals, which is what the protocol expects. Most challenges parse cleanly. A slice of them do not: the declared amount only makes sense if it is already in dollars, or in wei, or in some other unit the seller chose.
The symptom is a mean price in the billions of dollars — obviously absurd, and the reason this article reports the median and the bands instead of an average. The consequence is not cosmetic: an agent that reads 1000000 cannot know whether it is being asked for one cent or one million dollars without a second source of truth.
Where the payments happen
Base dominates: 22,033 readable challenges name eip155:8453, plus 172 that spell it as the literal string base — an inconsistency worth fixing in discovery. Solana accounts for 898, 141 declare no network at all, 116 point at the Base testnet, and the rest scatter across a few chains. In other words: x402 is multi-chain in specification and effectively Base in practice.
How fast the gate answers
Median response time to the unpaid call is 968 ms, with a p90 of 4.2 s. That matters for agents that preflight a list of candidates: a slow gate is not a broken gate, but it changes which endpoint an agent tries first.
What this census does not prove
It proves that the payment gate is reachable and legible without credentials. It does not prove that a payment settles, that the paid response is delivered, that the data behind it is correct, or that a catalogue indexes the resource. Those need an actual purchase and a settlement check — a different, more expensive test.
Two classes also deserve their caveat: 429 can be a deliberate limit on anonymous clients rather than a defect, and "no response" includes hosts that accept a connection and never answer. Both were re-probed; the numbers above are the stable result, not the first pass.
Check your own endpoint
The same read-only check is free, one request, no wallet:
curl -s -X POST https://x402.chikocorp.com/api/preflight/inspect \
-H 'content-type: application/json' \
-d '{"resource_url":"https://your-api.example.com/resource","method":"GET","max_price_usd":1}'If it returns a decision with evidence, the numbers in this article are the context your endpoint is being judged in: 87.7% of the catalogue is healthy, so the bar is not "does it charge" — it is "can an agent read it on the first call".
Frequently asked questions
How many endpoints are in the x402 Bazaar?
On 18 October 2026 the discovery endpoint reported 26,701 listings; we audited 26,692 unique resources across 2,470 hostnames and 1,188 registrable domains.
What percentage of x402 endpoints actually charge?
87.7%: 20,111 on GET and another 3,298 only on POST. All of them returned a decodable challenge.
What is the typical price?
Median 0.01 USD, with more than half of the catalogue between 0.001 and 0.01 USD.
Does a healthy 402 prove the paid API works?
No. It proves the gate is reachable and legible. Settlement, delivery and correctness require an actual purchase.