I probed 1,082 endpoints across 174 x402 sellers. The code is fine; the market isn't.

I run a paid x402 endpoint. Like everyone else selling machine data right now, my real problem was not code — it was whether anyone with a wallet ever arrives. So I stopped guessing and measured the market: 85 sellers, 442 endpoints, one request each.

The raw data is public and free at akari-x402.puzzling-marten.workers.dev/scoreboard.json. Here is what it says.

The method, and one thing I deliberately did not do

I took every paid URL published in the 402index directory — the exact URLs sellers advertise — and requested each one once. Then I graded the payment handshake the way a machine buyer experiences it:

• does the endpoint answer 402 at all?
• does the payment-required header base64-decode into a real requirements object?
• does that object carry a positive amount, a CAIP-2 network, an asset, and a payTo?
• does the body show a price a human reading a log can see?
• is there an MCP surface (initialize + tools/list)?
• how fast does it answer?

The one thing I refused to do: call a 200 a broken paywall. Some listed URLs are free routes, some are docs pages, some are landing pages. If a listed URL answers 200, the honest label is free-or-mislisted, not "this seller's paywall is broken." Grading 200s as failures would have produced a much more dramatic article and a false one.

What the numbers actually show

Of 442 endpoints:

• 258 (58%) answered 402 — a real paywall facing the buyer
• 78 (18%) answered 200 — free, or the directory entry is not the paid route
• 106 (24%) were dead: 4xx, 5xx, or timeout

And here is the result that surprised me. Of those 258 live paywalls, only 8 (3%) failed to produce a parseable challenge. 246 carried a price. 250 named a network.

The plumbing is fine. Nearly everyone who sells x402 data has implemented the handshake correctly.

Where it does break, ranked by how many sellers it hits:

1. Dead listings — 24% of endpoints. The directory entry 404s or times out. A buyer that finds you there and gets a 404 does not try again, and you never learn it happened.
2. 45% of sellers expose no MCP surface. Agents increasingly look for /mcp before they read an endpoint list. No initialize, no tools/list, no sale from that audience.
3. ~25% of 402 bodies contain no human-readable price. The header is machine-perfect; the body says {"error":"payment_required"} and nothing else. When a buyer's log shows a wall of identical 402s, yours is indistinguishable from a broken one.
4. 13% have no /llms.txt. That is the shortest path an LLM agent has to learn how to pay you.

Grade distribution across the 85 sellers: A 16 · B 8 · C 6 · D 12 · F 43.

The uncomfortable part: code quality is not the bottleneck

I also looked at my own traffic. On a live paid endpoint, over 15,000 recorded requests:

• Agent402 crawler: ~7,900
• a monitoring service: ~2,100
• x402 liveness probes: ~360
• a ranking probe: ~220
• a registration bot: ~90

Real referrers across the entire period: 6 hits from one directory, 3 from Google.

Almost everything that arrives at an x402 endpoint is a crawler indexing you, not an agent buying from you. That is why the sellers I graded mostly have working paywalls and mostly have no revenue: the supply side is polished, the demand side is not there yet. Fixing your payment-required header is table stakes; it will not create a buyer.

If you sell an x402 endpoint, the cheap fixes

In the order they pay back:

1. Make the 402 body state the price. One line: {"error":"payment_required","price_usd":"0.02","pay_to":"0x…","network":"eip155:8453"}. Cost: ten minutes. It is the single most common gap.
2. Ask to be re-crawled, and check your own directory entries. A quarter of listed endpoints were dead when I probed them. Being unreachable where buyers look is worse than ranking low.
3. Publish /llms.txt. Write down the price, the network, the payTo, and one worked curl example.
4. Add /mcp. initialize and tools/list are cheap; publishing each tool's price in _meta.x402.price_usd makes you visible to the agent frameworks that read the MCP registry.
5. Sell a pass, not just calls. $0.02/call cannot pay anyone's bills, and an agent polling hourly already spends $14.40/month at that rate. Bundle 30 days of everything for $5 and your ticket size moves 250×.

The scoreboard is free and machine-readable at /scoreboard.json, with the per-seller grades and the exact finding codes. If you want the full per-route report for your own origin — every listed URL, every challenge decoded, latency, and a fix list — that is what my endpoint audit does.

I would rather publish the real numbers, including the ones that show the market is supply-heavy and buyer-light, than tell a nicer story. If you are selling into this market, you are not fighting bad code. You are fighting for attention with everyone else who already got the code right.

---

Correction, later the same day — the 4.8% was our bug, not theirs. The 23 "undecodable challenges" in the snapshot below were an artifact of our own decoder. It only understood a plain-JSON payment-required header and ignored three things that are all perfectly legal: base64-encoded challenges (x402 v2), challenges carried in the 402 body (the norm in x402 v1), and L402 / MPP paywalls, which are a different protocol entirely — working, just not x402. We also treated every path in a seller's openapi.json as a paid route, so a free endpoint answering 200 was graded as a broken paywall. That is an accusation produced by our reading error, and publishing it behind a price would have been indefensible.

Re-run with the corrected classifier, same 174 sellers, same day:

• 0 undecodable challenges. Every 402 in the sample now yields a parseable challenge, or is explicitly tagged as L402/MPP (26 of the 27).
• 174 sellers / 1,082 endpoints — 53% answer 402, 19% answer 200, 29% are dead. 139 sellers serve at least one real x402 paywall.
• 0 sellers with a structurally broken challenge. No missing amounts, no unpayable networks, no absent payTo among the ones we can call.
• The chain-name whitelist was another own goal: an algorand:wGHE2… CAIP-2 identifier looked "unrecognised" simply because we had never listed Algorand.

So the market's problem is discovery and consistency, not brokenness: missing /.well-known/x402 (25 sellers), a catalog that lists a free route as paid, a paid route that now 404s (40 endpoints), no machine-readable catalog at all (13). Real, fixable, boring. The corrected grades are live on the scoreboard and on every /seller page; the finding codes changed with them. A measurement instrument that flatters the person selling it is worse than no measurement.