What 74,447 Requests to an x402 Marketplace Actually Were

2026-10-24 · measurements

Every x402 seller eventually looks at a request counter and feels good about it. This post is what happens when you take one access log apart and classify every line: in 18.5 hours the site answered 74,447 requests, 69% of them with a 402, and five callers other than us received a successful response.

All numbers below come from one nginx access log on the origin, window 2026-10-23T15:39:29Z to 2026-10-24T10:09:30Z. 74,447 lines parsed out of the last 120,000. Caller identity is the User-Agent string as declared, which is the weakest possible attribution and the only one available without fingerprints — read the classification as "what the caller announced", not "what the caller is".

1. Two thirds of the traffic is the door answering correctly

The 502 row is a useful honesty check on the rest of the table: the outage is visible in the log as a discrete block, and it accounts for 2,176 of 74,447 requests. If the rest of the classification were noise, it would not line up with an incident we independently know the shape of.

That 402 is not an error. It is the product: a request that carries no payment proof gets the challenge, including the price, the network, the payee and the schema. A x402 endpoint that answers a stranger with 200 is either free or leaking.

2. Who is actually knocking

Grouping by declared caller:

57% of all requests come from parties whose business is to enumerate other people's endpoints. Another 13% are our own checks. That leaves roughly 30% — and most of that 30% is also unpaying: the /x402/* paths alone saw 51,587 unpaid challenges, and the entire site produced five successful external calls.

The five, for the record: nonsynthetic-drip/1.0 (twice), Market402PaidProbe/0.3, LumiTrustBuyer/1.0, one unlabelled client, and one mobile browser. Four of those names say what they are — probes that test whether a seller's endpoint works, not agents buying a result repeatedly.

3. Why the indexers matter more than the buyers (for metadata)

A third-party index is not a passive directory. Coinbase's CDP discovery index — the one that backs Agentic.market — writes an entry when a settlement runs through its facilitator. The entry is a snapshot of the PAYMENT-REQUIRED document we served at that moment, including resource.description.

That has an ugly consequence. Our gateway used to pass the real catalog description at only a few of the call sites that build the challenge; the anonymous 402 of most trial-eligible endpoints shipped minia2a service: <id> instead. The index dutifully stored the placeholder. An agent browsing the index saw "minia2a service: x402-math" and learned nothing about the endpoint.

Measured on 2026-10-05: 112 of 140 indexed resources (80%) carried the placeholder. After the challenge fix (10-08/09) the same measurement read 22% (10-11) and, today:

STATUS: measured -- 7/96 (7%) of our indexed resources carry CDP's placeholder;
        0 settled on/after 2026-10-09 (regression), 7 pre-fix backlog

Every remaining placeholder row has a lastUpdated of 2026-09-28 or earlier — all pre-fix. The number falls only when one of those rows settles again. Nothing heals on our side; the index heals on the next settle.

So the same log that says "indexers are 57% of traffic" also says why they are not interchangeable with buyers: a buyer pays once and gets a result; an indexer reads your 402 and publishes what it found. If what it finds is a placeholder, the index has recorded a true fact about a bad challenge — and you will never see an error for it.

4. Three things this changes if you sell x402 endpoints

1. Count settlements, not requests. Our request counter moved by 74,447 in a day; the number of external parties that actually paid or trialed in the same window is single-digit. A dashboard that shows requests is showing you how many crawlers found you.
2. Treat your anonymous 402 as your public documentation. It is what indexers read, what agents quote back to themselves, and what most of your "traffic" consumes. Omit the description there and the placeholder propagates into every directory that snapshots you.
3. Classify your own log before you write a growth post. Ours was 13% self-inflicted and 57% enumeration. The honest growth number was in the delivery ledger, not in the access log — and we would not have noticed if we had not counted the callers instead of counting the lines.

minia2a sells pay-per-call x402 endpoints in USDC on Base, with 5 free trial calls per signed wallet and no registration. The measurements above come from the origin access log and from the published CDP discovery index; where a number is a sample, the sample size is printed next to it.