Payload X402 Observatory

What we count (definitions)

Count accounting (reproducible)

How 71,259 resources trace back to raw catalog data. Full ledger: api/summary.json → accounting.

Headline metrics

Ecosystem health: INSUFFICIENT_DATA

Only 11 resources validated so far; health needs N≥25 validated (MCP/unsafe-method entries excluded).

Ecosystem health is computed from observable probe metrics only (valid-402 rate). It is not a security score. See METHODOLOGY.md.

Trends

Top failure modes (applicable validated n=11)

Resources (showing 120 of 71,259)

Statuses: ACTIVE = last probe returned a valid 402 · DEGRADED = 402 challenge incomplete/missing or catalog listing inconsistent with live behavior · UNREACHABLE = network error · STALE = no longer in the source catalog · DISCOVERED = not yet probed. To request a correction or removal, contact kyler.simmons.partners@gmail.com. Listing here implies no endorsement or ownership.

Methodology

Discovery: we consume only public, unauthenticated catalog endpoints — CDP x402 Bazaar (api.cdp.coinbase.com/platform/v2/x402/discovery/resources) and PayAI Bazaar (facilitator.payai.network/discovery/resources), paginated at max 1 request per 2 seconds. payTo addresses are truncated to 10 chars; amounts are reported as price buckets only. A catalog listing is not a resource: each listing's accepts[] payment options are expanded into canonical keys (resource URL + network + scheme). See the accounting table above for the full ledger.

Validation (v2): each resource is probed at most once per revalidation window with the HTTP method declared in the catalog (method / extensions.bazaar.info.input.method), else GET. A single non-paying request: 10s timeout, identifiable User-Agent, no payment, no credentials, no stress testing. A GET returning 405 is not an endpoint failure — if the server's Allow header or the catalog declares POST, one non-paying POST probe (empty body) is made; otherwise the verdict is METADATA_MISMATCH (a catalog inconsistency, not an endpoint failure). MCP-type and unsafe-method resources are never HTTP-probed (NOT_APPLICABLE). Failures are only classified when the appropriate documented method was used. Resources absent from a fresh catalog pull are marked STALE, not deleted.

Verdicts: VALID_402 (402 + parseable, complete challenge) → ACTIVE; DEGRADED (incomplete/missing challenge, or METADATA_MISMATCH / ROUTE_NOT_FOUND); UNREACHABLE (DNS/TCP/TLS/timeout); NOT_APPLICABLE (MCP type or unsafe method — stays DISCOVERED, excluded from rates). Health = valid-402 rate over applicable validated resources: ≥90% HEALTHY, 70–90% MIXED, <70% DEGRADED; N<25 → INSUFFICIENT_DATA. This is an operational diagnostic, not a security score.

Validation rotation: daily stratified sample (~150–200/day) across network × discovery source × x402 version × price bucket, max 1 request per host per 5 minutes, resumable queue. Operators can opt out: kyler.simmons.partners@gmail.com.

Full method: METHODOLOGY.md · Machine-readable: summary · resources · networks · failures · history.