Real USDC test of x402 endpoints: 653 of 1,596 paid attempts settled

A project operating under the name vet402 has been spending real USDC on x402 endpoints listed in Coinbase's Bazaar catalog, and its published results show a wide gap between money leaving and value arriving. According to the project's post on dev.to, 1,596 paid attempts against 1,005 distinct endpoints produced only 653 provable settlements, roughly 41%, as of 26 August 2026.

What the test measured

x402 repurposes HTTP's long-ignored 402 Payment Required status code. A server answers a request with a price and a payment address, the client sends payment, and the request proceeds. Coinbase's Bazaar directory now lists tens of thousands of such endpoints, and vet402 has been buying from them to find out what actually happens once the payment clears. As the post frames the core problem, the protocol can demonstrate that funds moved, but not that anything was delivered in return.

All figures come from a public state endpoint that anyone can query, and the project states plainly that the live endpoint, not the article, is the authority on current numbers.

Settled is not the same as useful

The project is careful about what its headline number means. A "settled" attempt indicates the payment reached final settlement and a receipt is held; it says nothing about whether the response was useful, a question the project says it does not claim to answer. The remaining 943 attempts are not uniformly failures either — that group combines settlement failures, deliveries that returned no receipt, and attempts the project itself cut off at a deadline. Per-endpoint breakdowns are published rather than collapsed into one figure, because the failure modes are not interchangeable.

A catalog that is mostly unverified

The second set of numbers concerns the catalog itself. Of 19,023 listed endpoints, 15,251 currently active, only 1,246 carry a published pass, leaving 17,777 — about 93% — that nobody has verified by actually paying them. Per the post, nothing in the listing process tests an entry's claims that an endpoint exists, accepts payment, and returns something. There is also churn that is invisible from the outside: 3,772 endpoints are currently delisted, following 4,135 delisting events and 363 relistings. Endpoints show up, collect payments, and then disappear from the directory.

Why the test had to cost money

A cheaper approach would send HEAD requests to every endpoint and count the 200s as healthy. The project tried that first and found it reveals almost nothing, because an endpoint can present a clean 402 challenge, accept the payment, and then never deliver — the failure happens after the money moves, which means the only honest test costs money.

The design therefore splits into two layers. L0 observes the entire catalog without paying: cheap, complete, and weak. L1 buys on a budget and records what comes back: expensive, partial, and the only layer that can catch the failure that matters. Every L1 result is published on the endpoint's public page alongside its transaction hash, so outcomes can be checked on-chain rather than taken on trust.

The project also addresses its own credibility. The code is MIT-licensed, nothing is sold to the endpoints being measured, and there is no arrangement under which an endpoint could pay for a better result. The raw data is downloadable under CC BY 4.0 with the methodology written down, so disagreements can be settled by re-running the check. The post closes with a disclosure that it was authored by an AI agent operating the project, and notes that a "payOrRefuse" step — one that reads the evidence before a signature rather than filing a complaint afterwards — is what the team is building next.

Why it matters

If the machine-payable web scales up, with autonomous agents paying per request for APIs, data and compute, the number that matters is the transaction's success rate, not the protocol's. A world where fewer than half of real paid attempts end in a settlement anyone can prove is a world where any paying agent must treat payment and delivery as separate events: keep the receipt, check what came back, and decide before signing rather than after paying. It is also a caution for directories like Bazaar. With 93% of listings unverified by purchase and thousands of endpoints cycling in and out of the catalog, a listing is a starting point for due diligence, not evidence of a working service.