DEV Community

Agoreum
Agoreum

Posted on

We checked 4,198 x402 endpoints. First, our checker got 420 of them wrong

We sell a small x402 endpoint check: give it a URL, and it tells you whether the endpoint answers with a payment request an agent can actually pay. On 2026-11-06 we ran it over every service listed on agentic.market, one endpoint per service, to publish a picture of the market. The first thing it measured was itself, and it came out badly.

The first run said 73% of endpoints were valid

That number looked plausible, which is the dangerous kind. Reading why individual endpoints failed showed most of the failures were ours:

  • We asked the wrong way. Our check sent GET, and tried POST only if GET answered 405 Method Not Allowed. Of 962 endpoints that quote only on POST, 418 answer a GET with something else: 306 with 404 and 86 with 200. Our check called them "not x402". They were fine.
  • We judged a version we did not read correctly. A field that is correct in x402 version 1 was reported as a fault.
  • Names that do not resolve raised instead of being reported, and one hostile payment scheme in a reply crashed the check outright.

All of it had passed our review and our tests, because every test case was shaped like our own endpoint. Comparing the two runs over the same 3,421 endpoints, the first run had wrongly failed 420 of them. If you run a tool that judges other people's systems, run it on their systems before anyone trusts its answer.

What the corrected run found

Over 4,198 endpoints on 4,178 hosts:

Verdict Endpoints Share
Quotes valid x402 payment terms 3,655 87.1%
Quotes terms with a problem in them 84 2.0%
Answers, but does not quote a price 414 9.9%
Could not be reached 45 1.1%

We say "does not quote" rather than "broken" on purpose. Of those 414, 151 answered 404 and 108 answered 400, 415 or 422, which can mean the endpoint wants a request body we did not guess. A buyer's agent with the right input might get a price. We count it as what we saw.

A few more things that are useful if you build an agent that pays:

  • Prices are small. The median quoted price was 0.01 USDC and the 90th percentile 0.19.
  • The listed price is usually the charged price, not always. Of 3,726 endpoints we could compare, 3,525 quote what their listing says, 106 ask for more and 95 for less. An agent should read the 402, not the catalogue.
  • Base dominates. 3,596 endpoints accept Base, 890 Solana, 501 Polygon, 457 Arbitrum, and 1,106 offer more than one way to pay.
  • Version 2 won. 3,606 spoke x402 version 2 and 133 version 1.
  • It is fast. Median latency to the payment request was 487 ms, the 90th percentile 929 ms, and 17 endpoints took over three seconds.
  • The faults in quoted terms were mostly about money: 29 amounts that could not be read as a valid amount, 24 networks, 22 schemes and 4 addresses.

Other people probe this market more often and more widely than we do, and their headline numbers differ from ours: one monitor reports about 17% of endpoints as dead, decoys or zombies across a larger set over time. A single run is a snapshot, and every method draws its line somewhere. Ours is published with the method beside it.

What we did not publish

We publish the aggregates only. The result for any one endpoint stays private, because a single check from our side is not a fair verdict on someone's service. The aggregate report and its method are on our site, and you can run the check on your own endpoint for free at agoreum.xyz/tools/x402-check.

Why a marketplace cares

x402 pays per call: an agent pays, and either the answer comes back or the money is gone. That is right for a 0.01 lookup. It is wrong for work that takes hours, where a buyer needs the money held until the work arrives and a way to get it back if it never does. That is what Agoreum is for: USDC held in an escrow contract on Base, released on delivery, refundable by the buyer alone if no delivery is recorded by the deadline. If you sell x402 endpoints, you can list one there by pasting its URL.

It is in beta: each order is capped at 100 USDC, and the contracts have had an internal security audit only.

Top comments (0)