The x402 Bazaar Audit

Look up an endpoint

Paste an x402 resource URL or hostname. Shows what the index recorded on 2026-08-28 and what our probe got back; the “inspect now” link fetches the live 402 with the x402 Endpoint Inspector.

Where the calls go

25 resources with more than 50 calls report almost exactly one unique payer per call (https://api.onesource.io/api/chain/erc20-balance (1,045 calls, 1,042 payers); https://api.onesource.io/api/chain/ens/:input (1,017 calls, 1,009 payers); https://api.onesource.io/api/chain/live-balance (930 calls, 925 payers); https://api.onesource.io/api/chain/tx/:hash (923 calls, 869 payers); https://api.onesource.io/api/chain/nonce/:address (709 calls, 706 payers)) — a fresh wallet for every request, which is either wallet-per-task agents or someone farming the “unique payers” column.

By domain

36 of 789 domains had more than 1,000 calls; 152 had more than 100. 1,516 resources were called in the 24 hours before the fetch, 5,356 in the last 7 days.

The revenue proxy

Each resource’s 30-day calls × its minimum listed exact-scheme price. upto-style ceilings and listed amounts of $1,000 or more are placeholders, not prices, and are excluded (1,051 resources list one). It assumes every settled call paid the listed minimum, so it is an upper bound on CDP-facilitated revenue — and a lower bound on the market, because other facilitators are invisible to this index.

Total $9,416. 14 resources clear $100 in the window; 109 clear $10. Median listed price $0.010; p90 $0.150.

What is for sale

35,263 payment options across 14,820 resources. Schemes: exact 34,842 · upto 283 · exact_cosmos_authz 45 · batch-settlement 43 · onchain 28 · exact-amount-onchain 12. 14,586 resources accept on Base, 5,374 on Solana.

The template farms

Who gets paid

1,323 distinct receiving addresses for 14,820 resources.

The signing-domain check

An exact-scheme option on USDC-on-Base is paid with an EIP-3009 authorization signed over the token’s EIP-712 domain, which for Base USDC is name: "USD Coin", version: "2". Every option is checked against that reference (the same check the inspector runs): 898 resources declare a different domain — GatewayWalletBatched v1 (891), USDC v2 (7). Nearly all of them are on theaslangroupllc.com 845, coil.trade 22, aitrailblazer.net 14, zenvault.eu 6, watchevelive.com 4, locus.report 3. A stock x402 client signs with the wrong domain, the facilitator rejects the signature, and the resource shows up as “listed, never paid” unless the seller runs a non-standard settlement path.

What answered the probe

One GET per unique URL, no payment header, 10-second timeout, identifying User-Agent. A 402 whose body (v1) or PAYMENT-REQUIRED header (v2) parses as an x402 challenge counts as live. Many listed resources are POST-only or need parameters, so a 405 or 400 means “alive, wants a different request”, not dead.

Among resources with more than 100 calls in the window: x402-402 193 · 404 30 · 405-method 17 · http-429 5 · 2xx-no-paywall 5 · auth-required 1 · http-400 1. Live challenge versions: v2 11,317, v1 171; challenge found in header 11,266, body 222. Listed vs. live minimum price where both were readable: 11,187 identical, 280 different.

Facilitators

The 21 facilitators in the registry, asked GET /supported on 2026-08-28. 10 of 21 answered with a kinds[] list.

Get the data

curl -sO https://fetchgate.dev/data/x402-bazaar-audit-2026-08-28.resources.jsonl
jq -c 'select(.probe.outcome=="x402-402" and .calls30d>100)|.resource' \
  x402-bazaar-audit-2026-08-28.resources.jsonl

Method, and what this does not show

• Source: api.cdp.coinbase.com/platform/v2/x402/discovery/resources, all 149 pages, fetched 2026-08-28 21:35 UTC. The quality counters are Coinbase’s.
• CDP only. The index sees what the CDP facilitator settles. Resources settling through PayAI, x402.rs, Daydreams and the rest are undercounted or absent — Fetchgate’s own endpoints are not in it. The market is bigger than this number; how much bigger, nobody publishes.
• Calls are not revenue. The proxy uses the listed minimum price and assumes every call paid it. Treat it as a ceiling on CDP-facilitated revenue.
• The probe is one unauthenticated GET. A resource that needs POST, a body, or auth reads as 405/400/401, not as dead. 2xx-no-paywall means the URL served content without a challenge to a bare GET, nothing more.
• EIP-712 “wrong-domain” is measured against the standard USDC domain. A seller with a bespoke settlement path may work fine; a stock client will not.
• “Farms” are domains with more than 300 listings. That is a size threshold, not a judgement.
• A snapshot. Counters are trailing 30-day windows at fetch time; 14,819 URLs were probed once.

So what?

If you are pricing an x402 product: the market that exists clears roughly $314 a day through the dominant facilitator, at a median of $0.010 a call, and 51% of listed resources sold at most once in a month. Discovery is solved — being indexed is automatic once one payment settles — and demand is the whole problem, same as the crawler census found from the other side. Before you build for agents, check that your seller-side integration would actually verify (the inspector catches the 898-resource domain mistake in one request) and read the x402 vs. Stripe comparison before betting the pricing model on it.