We check 50,000 paid x402 endpoints every day. Here's what works and what breaks.
x402 lets an API ask for payment with an HTTP 402 Payment Required answer, so an AI agent can pay per call in stablecoins without an account or API key. Before an agent pays an endpoint it has never seen, it wants to know two things: will the payment go through, and will it get what it paid for? x402 Doctor checks that for every paid endpoint we can find, every day. This is what the October data shows.
1. Most endpoints work
Of the 50,373 endpoints that answered on 17 October, 46,906 (93.1%) were payable as listed. 2,392 (4.7%) got a caution, usually a detail that some clients refuse, and 1,074 (2.1%) a no_go: an agent should not pay them. 49,955 were x402 endpoints and 418 MPP (Machine Payments Protocol) endpoints.
The scan has grown fast: from 16,598 endpoints on 23 September to over 50,000 now, as new sellers list their APIs in the CDP Bazaar and in Circle's Agent Marketplace.
2. One seller holds 41% of the market
The index counts 61,860 payable endpoints. They come from 2,034 sellers, who sell 25,273 distinct services: many sellers publish the same service under thousands of URLs, one per ticker, city or query. The largest, datapackvibe.com, alone has 25,621 endpoints (41%) for 1,174 services. The ten largest sellers together hold 60% of all payable endpoints.
For an agent that means a catalog of "60,000 APIs" is closer to 25,000 services, and that one seller's uptime moves the whole market's numbers.
3. Base carries almost everything
| Network | Share of payable endpoints |
|---|---|
| Base | 97% |
| Solana | 21% |
| Polygon | 11% |
| Arbitrum | 8% |
| Tempo | 6% |
| Algorand | 5% |
| XRP Ledger | 4% |
| Arc (Circle) | 4% |
30% of payable endpoints accept more than one network, so the shares add up to more than 100%. 4% also offer Base Sepolia, a testnet, next to mainnet.
On Stellar we find 631 endpoints from 6 sellers. 47 of them (7%), from 3 sellers, can't be paid by the official @x402/stellar client: they give the asset as "USDC" or "USDC:G…" instead of the USDC token contract (every Stellar endpoint).
4. Prices: a cent is the norm
The median price is $0.01 per call. 80% of payable endpoints charge $0.01 or less, and under 1% charge $1 or more.
5. What breaks, and how to fix it
The problems we see most on 17 October, with the fix (the free web check gives the exact code per endpoint):
| Problem | Endpoints | What it means, and the fix |
|---|---|---|
| Resource mismatch | 2,009 | The 402 names another URL than the one called (a relative path, another host, http instead of https). Clients and indexes that check the resource refuse it. Put the full public https URL of the route in resource. |
| No 402 | 1,042 | The listed URL doesn't answer 402 at all (404, 401, a login page, or a 402 only on POST while the listing says GET). Answer 402 on the listed method, or fix the listing. |
| Testnet only | 206 | Only a testnet is offered, so mainnet agents can't pay. Add a mainnet option. |
| MPP realm mismatch | 102 | An MPP challenge names another host as its realm. Use the service's own host. |
| Price above advertised | 73 | The 402 asks more than the listing says. Keep listing and 402 in sync. |
| Invalid challenge | 20 | The 402 can't be parsed as x402 (missing fields, wrong types). Use the official SDK's middleware. |
6. We paid 29 random endpoints
A valid 402 doesn't prove the seller delivers. Every week x402 Doctor buys 30 random endpoints that look payable, with its own wallet and their declared example input (at most $0.05 each), and records what comes back. In the run of 12 October, 1 endpoint no longer asked for payment; of the 29 we bought:
- 23 delivered a proper answer;
- 1 delivered, but not in the declared format;
- 1 refused our payment;
- 4 answered with an error and didn't charge;
- 0 took the money without answering.
That is 82.8% paid and delivered, for $0.69 in all. Results of every run: the Trust Index.
7. Bait and sanctions
An AI check reads every service's description for lures aimed at agents, such as promises no API can keep or impersonation of another brand. Of 7,890 services checked, 6 were flagged, for example "real-time guaranteed-profit racing arbitrage across all bookmakers".
Every payout address is screened against the OFAC SDN list (1,050 crypto addresses, published 15 October). None of the sellers' payout addresses is on it.
How we measure
- Sources: the CDP Bazaar, Circle's Agent Marketplace, the MPP directory, GoPlausible and other public x402 indexes, read every day.
- The check: each endpoint is called once without paying. Its 402 is parsed and checked the way a paying agent would: a valid challenge, the price against the listing, the network and token, whether the payout address can receive (USDC trustline on Stellar, opt-in on Algorand), the OFAC list, and testnet-only offers. Nothing is paid.
- The purchases: only the weekly spot-buy pays, 30 endpoints at most $0.05 each.
- Open data: every endpoint's 30-day record is free at
GET https://x402-doctor.fizzl.eu/api/trust?url=<endpoint>.
Check an endpoint yourself
- Sellers: the free web check diagnoses your 402 and gives the fix as code.
- Agents: before paying an unknown endpoint,
GET https://x402-doctor.fizzl.eu/api/v1/preflight?url=…answers go, caution or no_go for $0.001, also as an MCP tool. Instructions for agents: skill.md.