Published August 25, 2026 · Data: Watch402 continuous probe of both discovery catalogs · methodology
The two public x402 discovery catalogs — the PayAI Network Bazaar and Coinbase CDP x402 Discovery — promise buyers a menu of paid APIs they can send USDC to without a contract. We monitor every listing in both catalogs (41,000+ unique endpoints after de-duplication), fetch each one the way a paying client would, and compare the live PAYMENT-REQUIRED challenge against what the catalog advertises. Here is what the ecosystem actually looks like as of August 25, 2026.
Of 40,937 monitored endpoints, 12,348 (30%) return a valid HTTP 402 whose terms match their listing. If an agent picked services from these catalogs at random, seven in ten would fail at the very first handshake — before any money moved.
| Verdict | Listings | Share |
|---|---|---|
| Live & serving correct terms | 12,348 | 30.2% |
| Gone — HTTP 404/410 | 17,458 | 42.6% |
| Unreachable (connection failed / timeout) | 4,109 | 10.0% |
| Broken payment setup | 1,049 | 2.6% |
| Drifted from advertised terms | 1,578 | 3.9% |
| Rejecting monitors (bot walls, 4xx) | 1,734 | 4.2% |
| Server errors (5xx) | 1,657 | 4.0% |
| Unverifiable (templated URLs) | 1,004 | 2.5% |
Among listings whose live challenge differs from the catalog (1,578), the most common change isn't price — it's the payout address:
A buyer who cached last week's listing data would sign a payment straight into whatever address the endpoint names today. Sometimes that's a legitimate redeploy. Sometimes it's exactly what it looks like. No protocol signal tells them apart — which is why continuous diffing matters.
17,458 listings (43%) return HTTP 404 or 410. Another 4,109 don't answer at all. These stay discoverable in both catalogs' APIs indefinitely — neither catalog evicts dead resources promptly — so agents querying discovery today browse a marketplace where nearly half the shelves are empty boxes.
At least 1,734 endpoints reject automated clients outright (HTTP 4xx from WAFs and bot managers) while advertising themselves in agent-facing catalogs. An agent-discoverable API that blocks agents is a listing, not a business. Watch402 probes with browser-like headers and publishes an X-Watch402-Monitor contact header so operators can allowlist us instead.
Methodology: each listing is fetched with its declared HTTP method and example inputs, sending browser-shaped headers plus an X-Watch402-Monitor contact header. Verdicts come only from parsing the live 402 challenge against catalog-advertised terms. Full method: How Watch402 works. Live totals: /v1/stats.
This audit is a snapshot. The same dataset updates continuously — see the counters on the homepage or query /v1/stats directly. Next scheduled full-catalog refresh: Sunday 00:00 UTC.