Original data · 2026-08-19

We health-checked every seller in the x402 Bazaar. One in four can’t take an agent’s money.

The x402 Bazaar catalog lists 15,092 resources from 1,225 sellers as of this morning. A catalog tells you what’s listed. It doesn’t tell you what works — whether an agent that shows up wallet-in-hand can actually complete a purchase. So we checked. On August 19 we probed one live endpoint from every single seller in the catalog: all 1,225 of them.

The numbers

How we measured — and how we almost got it wrong

Each seller got one GET request to one of their listed resources, 8-second timeout, honest User-Agent. A healthy x402 endpoint answers HTTP 402 with a machine-parseable payment envelope — most sellers put it in the base64 payment-required header, some in the response body; we accepted either. Our first pass only checked bodies and flagged nearly half the catalog as broken — including our own fleet. The envelope was in the header the whole time. We’re publishing that mistake because it’s the point: even people who run x402 services for a living misread a 402 at first glance. An agent’s client library gets no second glance.

We were also careful with the 143 sellers who answered 405 to a GET: those are mostly POST-only services, so each got a second probe as POST before judgment. 128 of them turned out perfectly healthy — they’re counted in the 74%, not shamed in the failure column. The remaining failures are the quiet ones: endpoints demanding API keys with a 401 (an agent with money but no key walks away), redirect loops, 5xxs, and two sellers whose 402 carries no envelope at all in header or body — a paywall that names no price a machine can read.

The 40 sellers giving it away

The strangest cohort isn’t the dead listings — dead projects are normal in any young ecosystem. It’s the 40 sellers whose endpoints return the product with a clean HTTP 200 and no challenge. They did the hard part: built a service, listed it, kept the server up. Then the paywall silently never fired — a middleware ordering bug, an env var that didn’t load, a route added after the payment layer was configured. Every one of those sellers believes they’re in business. They’re running a free API with extra steps, and nothing in their logs looks wrong.

The catalog is a river, not a lake

Our crawler has watched the Bazaar three times a day since early summer, and the churn is bigger than the catalog: 23,847 listings from 1,092 distinct sellers have appeared and vanished from the index over that window — more listings have left than the 15,092 that remain. Some of that is the silent purges we’ve written about; most is sellers shipping, breaking, and drifting away without ever knowing what broke. Against that backdrop, the 15% who’ve already gone dual-stack — answering x402 and MPP challenges on the same 402, as three different rulebooks get written around them — are the cohort betting on the ecosystem hardest. We run our own fleet dual-stack, so we notice the company.

The honest caveats

One endpoint per seller is a health check, not a full audit — a seller with one dead route among fifty healthy ones can be misjudged in either direction, and a single afternoon is a snapshot, not a trend. We’ll re-run the census on a schedule and publish the movement. But even as a snapshot, the shape is clear: a quarter of the storefronts in the agent economy’s biggest catalog can’t complete a sale to the customers the catalog exists to bring them.

If you sell on x402: check your own door

Three checks that would have caught almost every failure in this census: hit your own listed URL from outside your network and confirm you get a 402 (not a 200, not a 404); base64-decode your payment-required header and confirm it parses with x402Version and a non-empty accepts array; and if your routes are POST-only, make sure a GET still answers with the challenge rather than a bare 405 — you don’t know which method a discovering agent tries first. We’re turning the census probe into a public scan tool — free in the browser for humans, and as a paid x402 endpoint agents can call on their own (yes, an x402 API for checking x402 APIs). It ships this week; Brief subscribers hear first.