Neuronto PaymentsAccept payments

x402 Endpoint Census: 94% of listed paid endpoints answer with a payable challenge

On 2 November 2026 we sent one unpaid request to each of 16,179 endpoints listed in the public x402 discovery index, across 3,291 hosts. 15,183 of them (93.8%) answered with a valid x402 payment challenge, one an agent's client can read and pay. 3,084 hosts (93.7%) had at least one working paid endpoint. Nothing was paid or signed. The census repeats every week, and the full data, one row per endpoint, is open under CC BY 4.0 at pay.neuronto.com/x402-census.

The headline is good news for anyone building agents that pay: if a resource is listed, it almost always quotes a price. The interesting part is the 6% that do not, because the failures cluster into a few shapes, and every one of them is something the seller can fix.

How the census measures

The population is the whole public x402 discovery index, every page, read at the start of the run: 81,573 resources, 81,118 unique URLs. Endpoints are grouped by host. A host listing 20 or fewer is probed in full; a larger host has 20 endpoints probed, chosen by a fixed hash of the URL so the same ones are probed every week.

Each probe is one request with the listed method, no payment header, no redirects followed, a 12 second limit. A challenge counts as valid when a 402 response carries an accepts list, in the PAYMENT-REQUIRED header for x402 version 2 or the JSON body for version 1, with at least one option naming a scheme, a network, a recipient and an amount. Two canaries guard every run: our own refunding test endpoint must count as valid, and a host under the reserved .invalid domain must count as unreachable. If either fails, the run is not published.

The four ways a listed endpoint fails an agent

1. It validates the request before it quotes a price (467 endpoints)

The largest group answered 400 Bad Request. These endpoints check the request body first and only issue the 402 once the body is valid. The listing does not say what a valid body is, so an agent that reads the listing and asks for a quote is turned away before it learns the price.

The fix: answer an unpaid request with the 402 before validating its input, so the price is always discoverable, and validate the input once a payment arrives. If validation must come first, describe the input in the listing, through the bazaar extension's input schema, so a client can build a request that reaches the challenge.

2. It serves the response without asking for payment (66 endpoints)

66 endpoints answered 200 and returned content to an unpaid request. Sometimes that is a free tier working as intended. Often it is a paywall that was never switched on in production, or a route the middleware does not cover, such as a trailing slash or a different method.

The fix: test the deployed URL, not the local one, with a client that sends no payment, and assert the 402. Middleware that matches routes by pattern is where coverage silently ends.

3. It answers 402 with nothing a client can read (52 endpoints)

52 endpoints returned the right status code with no usable challenge: an empty body, an HTML page, or a JSON body without accepts. A 402 alone tells a client that payment is needed, not what to pay, to whom, or on which network.

The fix: for x402 version 2, carry the challenge in the PAYMENT-REQUIRED header as base64 JSON; for version 1, in the JSON body. Official version 2 clients read the header, so a body-only challenge fails them even when it is otherwise correct.

4. The challenge names a different resource than the one requested (214 endpoints, 49 hosts)

214 valid challenges declared a resource URL different from the URL that was requested, usually an internal host name, a missing path, or a URL left over from a staging deployment. A strict client that checks the resource it is paying for against the one it asked for will refuse these.

The fix: build the resource field from the incoming request, not from configuration.

The rest are ordinary web failures: 119 endpoints answered 404 or 410 (listings that outlived their service), 57 refused the method the listing declares, 40 wanted other credentials, 31 returned a server error, 29 could not be reached at all (timeouts, refused connections, names that do not resolve, one bad certificate), and 20 listed URLs were not usable URLs in the first place.

What the working endpoints look like

Of the 15,183 endpoints with a valid challenge:

  • Version: 15,065 use x402 version 2 and 118 version 1. The migration is essentially complete.
  • Where the challenge lives: 15,072 in the header, 111 in the body.
  • Schemes: exact dominates (15,152), with upto (185) and batch settlement (51) the only others above a handful.
  • Networks: Base is offered by 15,052, Solana by 5,110, Polygon by 3,376 and Arbitrum by 3,042. Endpoints usually offer several networks, and 41 distinct network identifiers appear in all.
  • Price of one call, in USDC: median $0.01, 90th percentile $0.10. Six endpoints ask $100 or more and the largest asks $1,000,000, which is almost certainly an amount written in whole units where the protocol expects the token's smallest unit.

One host lists most of the index

The index is far more concentrated than its size suggests. One host lists 48,653 of the 81,118 unique resources, 60% of the whole index, and the next largest lists 1,622. That is why the census reports host figures alongside endpoint figures: a single large catalogue can move any endpoint-weighted number, so the host view is the better guide to how many independent sellers exist. Weighted by how many resources each host lists, 98.4% of the index answers with a valid challenge.

The index also reports usage: 553 of the probed endpoints (3.4%) show no paid call in the last 30 days.

What this means if you sell over x402

Before listing an endpoint, send it one request with no payment from outside your own network and check four things: the status is 402, the challenge is in the header, the resource in the challenge matches the URL you requested, and the amount is in the token's smallest unit. If the endpoint needs a request body, check that the unpaid request still gets a price. Those four checks cover almost every failure in this census.

To check a whole x402 client end to end against a live challenge, GET pay.neuronto.com/echo charges a tenth of a cent and refunds it in the same request.

FAQ

Is this a ranking of x402 services?

No. It reports what an agent following the index would find with one unpaid request. An endpoint can fail that probe for reasons its operator chose, and a listing can outlive its service.

Why only 20 endpoints per large host?

So that one large catalogue does not dominate the run time and the request volume each host receives stays small. Host figures are complete; endpoint figures describe the probed sample.

Does the census pay for anything?

Never. It sends no payment header and signs nothing.

How often does it run, and where is the data?

Weekly. Every run is published at pay.neuronto.com/x402-census, with JSON and CSV under CC BY 4.0. Cite as "x402 Endpoint Census, Neuronto Payments".

I run one of the endpoints and the census is wrong about it.

Corrections to the method are welcome; the per endpoint CSV shows exactly what was requested and what came back.

Sources