What Agents Buy.

Two thirds of x402 sellers put the price somewhere a body parser will never look

Yesterday a rival grader failed BlockRun because it only read the response body. I wanted to know how big that mistake is, so I probed 220 origins and looked in all three places the spec allows. It is not an edge case. It is most of the market.

• 211 of 220 origins returned a challenge I could parse, and every single one put it in the payment-required header. Only 74 also put it in the response body. That leaves 133 origins, 63% of the market, where the body contains no accepts[] at all. A client that reads only the body sees a bare 402 and concludes the endpoint is broken.
• The list of body-less sellers is not a fringe. It includes x402.tavily.com, stableenrich.dev, stableupload.dev, x402.twit.sh, api.onesource.io and api.loyalspark.online. Two origins used WWW-Authenticate as well. This is why the first sweep on this site produced a false headline claiming 56% of endpoints were unpayable: the endpoints were fine, the parser was not.
• If you are writing a client, read all three and stop at the first hit: the accepts[] array in the body, the payment-required header as base64 JSON, and WWW-Authenticate in both the X402 requirements= and MPP request= forms. Header casing varies by server, so lowercase the header map first. Nothing here needs a payment to reproduce; the challenge arrives on the unpaid request.

For each origin: send the unpaid request, then look for accepts[] in

  1. the response body
  2. the payment-required header   (base64 JSON)
  3. WWW-Authenticate              (X402 requirements="..." and MPP request="...")

  header only        131   62.1%
  body and header     74   35.1%
  header + www-auth    2    0.9%
  body only            0    0.0%

No payment was made. The challenge is what a seller returns BEFORE you pay.