For eight days we probed every service in the public x402 catalog, once an hour, from our own infrastructure. We never paid a service and no service paid us. Here is what the data says, as opposed to what the ecosystem says about itself.
As of 2026-07-21 22:47 UTC · 1,522 services rated · methodology and raw data are public.
The public catalog advertises 24,949 payable items across 1,631 hostnames, an average of about 15 listings per hostname. Much of that item count is many near-identical auto-generated routes from a few operators, so listings are a badly inflated way to size the ecosystem. (We measure the listing sprawl, not intent, and most probed services do return a valid 402.)
The receiver wallets show that fewer operators sit behind those hostnames than the counts suggest. The 1,522 rated services list 761 distinct primary receiver wallets (about 1,191 if you count every address they have rotated through). The gap is not facilitators pooling money for strangers: it is single operators running many endpoints. The most-used address collects for 148 hostnames that all belong to one project, and the pattern repeats down the list, with operators fanning a single settlement wallet across dozens of their own subdomains and platform deployments (Vercel, Railway, Fly). You can usually read the owner straight off the names.
We cannot cleanly convert wallets to operators (some services rotate receivers, some list several), so treat the wallet count as an approximation, not a census. But the direction is unambiguous: a distinct domain is not a distinct business, and much of the apparent breadth is one operator's suite of micro-APIs behind many names.
Three shrinking numbers: roughly 24,949 catalog listings, 1,631 hostnames, and on the order of 761 receiver wallets. Size x402 by wallets, not by rows.
Of the 1,522 services with enough evidence to rate, here is the grade distribution:
A 1183 · B 234 · C 52 · D 51 · F 2
A probed x402 endpoint is usually up and spec-compliant: 77% earn an A. But that is the surviving population. Separately, 100 domains in the catalog never returned a single valid payment challenge across the entire eight days, and 6 serve their content with a 200 and no payment challenge at all. Reliability is not uniform either: 1,286 services answered every single probe, while 236 flapped in and out. Absence from a leaderboard, or a green badge on a good hour, is not the same as a dependable endpoint.
89% of services speak x402 v2, the current spec; the rest are still on v1. On price, 1,455 services demand what they advertise, but 61 persistently charge a live price that does not match their catalog price. And discovery is still thin: only 46% expose the /.well-known/x402 descriptor that is supposed to make them self-describing to agents.
The catalog reports a 30-day call-volume figure for each service. Its rank correlation with our independent quality score is about 0.22: weak. The busiest endpoints are not the best ones, which is exactly why volume is not an input to our score. For latency, the field's median handshake is 226 ms and the 90th percentile is 702 ms.
We indexed USDC settlement on Base and Solana for every receiver wallet a service lists. Over 30 days about $923,569 reached those wallets from all sources (counting each receiver wallet once), of which about $36,532 arrived in amounts that match the prices services advertise. Those are not competing numbers; they are two honest bounds. Receiver wallets are general-purpose and take in USDC from far more than x402, so the amount actually settled through x402 sits somewhere between a floor of roughly $36,532 and a ceiling of $923,569.
The lesson is not that volume is fake. It is that no single wallet total, ours or anyone else's, is a reliable measure of what a service transacts through x402. Treat every volume claim as a bound to verify, not a fact.
Everything above is the supply side: what exists and how it behaves. The demand side, who is actually paying, is its own study, but one number is worth stating here. Our on-chain index is dominated by a single relationship: one payer wallet sent one receiver wallet 12,587,909 USDC payments in 30 days, which is about 95% of every transfer we index. That is one client calling one endpoint roughly five times a second, not 12,587,909 independent decisions. And it dominates only the count: by value that pair is about 17% of the USDC we index, because each of its payments is a fraction of a cent. A payment count says nothing about what a service earns, and any ecosystem-wide payment total is meaningless until that pair is set aside.
With it removed, real demand looks broad but shallow: most paying wallets appear once, pay a single service, and do not come back, the shape of first-touch trials rather than agents doing sustained paid work. We size it properly in the demand study; for now, read any x402 volume figure, ours included, as an upper bound.
Honesty about our own limits. Today the grade measures the paid-request handshake: protocol validity (a spec-valid 402), latency (how fast it answers), and price integrity (whether what a service charges matches what it advertises), plus availability, our hourly probe-success rate. What it does not yet do is pay. We do not verify that a paid response returns correct or complete content. Availability, too, is a success rate from our own infrastructure, not a guarantee of uptime between probes. Where we can, we also cross-check from a second network path; even in eight days 21 services answered differently from that second vantage than from our prober, a reminder that any single viewpoint, including ours, is partial.
Scores and grades are opinions derived from a published method, and every number here traces to probes we ran. The full register is free to read and free for agents to query as typed JSON. Rated parties never pay us, and there is no way to buy a listing, a grade, or a removal. If you operate a service and think we got something wrong, every report card has a dispute link.
See the live register at x402register.com.