We Opened an Agent-Payment Marketplace to Anyone. It Needed Five Rules on Day One.

For most of its life, the minia2a catalog had one publisher: us. Every endpoint was one we'd vetted, tested, and priced ourselves. That's a reasonable way to bootstrap a pay-per-call market — you control quality because you are the supply. But it isn't a market. A market is what happens when a stranger you've never met publishes a service, and another stranger's agent pays real money to call it.

So we opened the door: bring your own API endpoint, price it in USDC, and get paid per call over x402. No KYC, no API-key handshake — a wallet address and a signature, and you're a seller.

The first sellers arrived within a day. So did the exact failure modes every open payment market hits on day one.

Failure one: a listing that isn't a service

The first thing that showed up was a blog article posted as a "service," with a price attached. There's no API behind it — an agent that pays to call it gets a human-readable page instead of a machine answer. When the product you're selling is paid calls, "not actually an API" isn't a content-quality issue. It's a broken product.

Failure two: reselling the platform's own endpoints

Someone took the marketplace's own free public endpoints and republished them as paid listings under their own wallet. To a paying agent, that's a toll booth in front of a door that was already open. To the market, it's arbitrage that adds a fee and zero value.

Failure three: the same endpoint, five times

Another seller published the same endpoint five times. Same wallet, same target, five listings. In a directory where visibility drives calls, duplicates are a way to farm ranking — and they make search results worse for every honest seller who published once.

None of this is malicious in the "hacker" sense. It's just what happens when there's a dollar to be made per call and the cost of trying is a single HTTP POST.

The five rules

So we wrote them down. They're now the publishing contract:

1. Publish your own real, reachable API endpoint. No blog links, no article links, no landing pages. If an agent can't call it and get a machine-readable answer, it isn't a service.
2. Don't resell the platform's own endpoints, and don't duplicate existing services. If it's already free on the platform, or already listed, you're not adding supply — you're adding noise.
3. One wallet, one endpoint, one listing. Republishing the same endpoint is rejected with a 409. Keep your one service, keep it honest.
4. Price between $0.01 and $100 USDC. Below a cent isn't worth settling on-chain; above a hundred should raise questions. Inside the band, price what the call is actually worth.
5. Break the rules and the listing comes down. Delisting is the enforcement mechanism, and it isn't a warning system.

Why these are non-negotiable — and specific to agent payments

A fake or duplicate listing doesn't just clutter a page. It spends a machine's budget and poisons the one thing a market can't buy back: the assumption that a paid call returns what it advertises.

That assumption is the product now. The rails — HTTP 402, USDC settlement, signed receipts — are commodity. What isn't commodity is a catalog where "this endpoint is real, reachable, and priced honestly" is something an agent can assume without auditing every listing itself. Rules one through five are how you keep that assumption true while letting strangers publish.

The lesson generalizes

If you're building any marketplace where money moves per call, the integrity rules are not a later phase. They're day-one infrastructure, in the same category as the payment endpoint itself. Because the first seller isn't going to be the careful one. The first seller is going to be the one who tried the door the moment it opened.

We'll take the spam, if the price is a real open market. The rules are the price.