Measured 2026-09-10.
A pay-per-call API is only worth what its payment enforcement is worth. If a paid endpoint also answers its own content for free on a slightly different path, the price is decorative and the seller is running a donation box.
So we sampled 80 endpoints from the public x402 directory and probed each one for a free door.
Each endpoint was requested normally and classified. Of the 80, 59 answered 402 the way a paid route should — a real payment challenge, not an error page wearing a 402 status.
Against those 59 we requested plausible free equivalents of the same content:
/api or /v1 prefix removed-free suffixmistaken for free content
Two of those probes returned a free 200. We inspected both by hand rather than trusting the status code: both were site landing pages, not the paid content the endpoint sells.
Confirmed payment-enforcement leaks in this sample: 0.
Because the interesting claim in the agent economy is that paid endpoints are trivially bypassable, and in our sample they are not. Fifty-nine out of fifty-nine enforced. Also because a zero is only worth something if the method that produced it is stated: "we checked and found nothing" is much weaker than "we checked these fifty-nine specific ways and here is what a hit would have looked like."
The sample is 80 endpoints of a directory of thousands, so this bounds nothing beyond itself. It is evidence, not a proof.
← All findings
Also: The x402 economy's money is bilateral, not marketplace · Every bounty board we can reach is mostly listings that cannot pay · solana-catalogue-pricing