The x402 Bazaar Audit

Look up an endpoint

Paste an x402 resource URL or hostname. Shows what the index recorded on 2026-10-04 and what our probe got back; the “inspect now” link fetches the live 402 with the x402 Endpoint Inspector.

Where the calls go

46 resources with more than 50 calls report almost exactly one unique payer per call (https://api.onesource.io/api/chain/erc20-balance (823 calls, 815 payers); https://api.onesource.io/api/chain/live-balance (723 calls, 718 payers); https://api.onesource.io/api/chain/erc20-transfers (596 calls, 567 payers); https://api.onesource.io/api/chain/ens/:input (595 calls, 592 payers); https://api.onesource.io/api/chain/contract/:address (581 calls, 578 payers)) — a fresh wallet for every request, which is either wallet-per-task agents or someone farming the “unique payers” column.

By domain

46 of 1,024 domains had more than 1,000 calls; 173 had more than 100. 7,150 resources were called in the 24 hours before the fetch, 19,565 in the last 7 days.

The revenue proxy

Each resource’s 30-day calls × its minimum listed exact-scheme price. upto-style ceilings and listed amounts of $1,000 or more are placeholders, not prices, and are excluded (174 resources list one). It assumes every settled call paid the listed minimum, so it is an upper bound on CDP-facilitated revenue — and a lower bound on the market, because other facilitators are invisible to this index.

Total $19,008. 21 resources clear $100 in the window; 165 clear $10. Median listed price $0.010; p90 $0.050.

What is for sale

53,845 payment options across 27,681 resources. Schemes: exact 52,934 · upto 776 · batch-settlement 52 · exact_cosmos_authz 49 · eip3009 13 · long-events-stable-txhash 6. 27,401 resources accept on Base, 7,099 on Solana.

The template farms

Who gets paid

1,807 distinct receiving addresses for 27,681 resources.

The signing-domain check

An exact-scheme option on USDC-on-Base is paid with an EIP-3009 authorization signed over the token’s EIP-712 domain, which for Base USDC is name: "USD Coin", version: "2". Every option is checked against that reference (the same check the inspector runs): 238 resources declare a different domain — GatewayWalletBatched v1 (215), USDC v2 (12), USDC vNone (10), USD Coin v2 (1). Nearly all of them are on apexfaucet.xyz 75, theaslangroupllc.com 45, trycorpus.ai 29, craigmbrown.com 26, coil.trade 23, edifiedlab.com 11. A stock x402 client signs with the wrong domain, the facilitator rejects the signature, and the resource shows up as “listed, never paid” unless the seller runs a non-standard settlement path.

What answered the probe

One GET per unique URL, no payment header, 10-second timeout, identifying User-Agent. A 402 whose body (v1) or PAYMENT-REQUIRED header (v2) parses as an x402 challenge counts as live. Many listed resources are POST-only or need parameters, so a 405 or 400 means “alive, wants a different request”, not dead.

Among resources with more than 100 calls in the window: x402-402 191 · 404 52 · 405-method 17 · http-429 7 · 2xx-no-paywall 5 · auth-required 4 · 5xx 1 · http-400 1 · timeout 1. Live challenge versions: v2 14,558, v1 201; challenge found in header 14,551, body 208. Listed vs. live minimum price where both were readable: 14,030 identical, 706 different.

Facilitators

The 21 facilitators in the registry, asked GET /supported on 2026-10-04. 10 of 21 answered with a kinds[] list.

Get the data

curl -sO https://fetchgate.dev/data/x402-bazaar-audit-2026-10-04.resources.jsonl
jq -c 'select(.probe.outcome=="x402-402" and .calls30d>100)|.resource' \
  x402-bazaar-audit-2026-10-04.resources.jsonl

{
 "resource": "https://x402.twit.sh/tweets/search",
 "host": "x402.twit.sh",
 "domain": "twit.sh",
 "type": "http",
 "x402Version": 2,
 "description": "Search Twitter/X tweets with advanced filters. Returns up to 20 tweets per page, most recent first, with pagination. At least one filter req",
 "listedAt": "2026-08-22T11:12:17.949Z",
 "calls30d": 27745,
 "uniquePayers30d": 27,
 "lastCalledAt": "2026-08-27T10:51:24.014Z",
 "accepts": 1,
 "networks": [
  "eip155:8453"
 ],
 "schemes": [
  "exact"
 ],
 "minPriceUsd": 0.006,
 "maxPriceUsd": 0.006,
 "payTo": [
  "0x9dba414637c611a16bea6f0796bfcbcbdc410df8"
 ],
 "eip712UsdcCheck": "ok",
 "revenueProxy30dUsd": 166.47,
 "probe": {
  "outcome": "x402-402",
  "status": 402,
  "isX402": true,
  "liveX402Version": 2,
  "challengeSource": "header",
  "liveMinPriceUsd": 0.006,
  "seconds": 0.75,
  "error": "Payment required",
  "probedAt": "2026-08-28T21:50:28.121576+00:00"
 }
}

Team licence, recurring re-probe, or a custom cut (one category, your competitors’ listings, a weekly diff, a CSV your analysts can open)? Email support@fetchgate.dev with what you need — quoted within a day.

Method, and what this does not show

• Source: api.cdp.coinbase.com/platform/v2/x402/discovery/resources, all 149 pages, fetched 2026-10-03 22:54 UTC. The quality counters are Coinbase’s.
• CDP only. The index sees what the CDP facilitator settles. Resources settling through PayAI, x402.rs, Daydreams and the rest are undercounted or absent — Fetchgate’s own endpoints are not in it. The market is bigger than this number; how much bigger, nobody publishes.
• Calls are not revenue. The proxy uses the listed minimum price and assumes every call paid it. Treat it as a ceiling on CDP-facilitated revenue.
• The probe is one unauthenticated GET. A resource that needs POST, a body, or auth reads as 405/400/401, not as dead. 2xx-no-paywall means the URL served content without a challenge to a bare GET, nothing more.
• EIP-712 “wrong-domain” is measured against the standard USDC domain. A seller with a bespoke settlement path may work fine; a stock client will not.
• “Farms” are domains with more than 300 listings. That is a size threshold, not a judgement.
• A snapshot. Counters are trailing 30-day windows at fetch time; 27,676 URLs were probed once.

So what?

If you are pricing an x402 product: the market that exists clears roughly $634 a day through the dominant facilitator, at a median of $0.010 a call, and 54% of listed resources sold at most once in a month. Discovery is solved — being indexed is automatic once one payment settles — and demand is the whole problem, same as the crawler census found from the other side. Before you build for agents, check that your seller-side integration would actually verify (the inspector catches the 238-resource domain mistake in one request) and read the x402 vs. Stripe comparison before betting the pricing model on it.