{"id":"x402-readiness-2026-08-28","title":"x402 Readiness Snapshot — 28 August 2026","description":"A single-vantage, unpaid HTTP 402 handshake audit of six public x402 endpoints.","scannedAt":"2026-08-28T01:31:18.416Z","publishedAt":"2026-08-28T02:05:00.000Z","source":{"name":"x402 List","url":"https://x402-list.com/api/v1/services","license":"CC BY 4.0","attribution":"Data: x402-list.com (CC BY 4.0)"},"methodology":{"sample":"Six public GET endpoints selected from the online x402 List directory. This is a diagnostic sample, not a market ranking.","paymentSent":false,"redirectsFollowed":false,"timeoutMs":8000,"responseBodyLimitBytes":65536,"vantageCount":1,"scoring":["HTTP 402 status: 25 points","PAYMENT-REQUIRED header: 15 points","Structured challenge decode: 20 points","Payment offers declared: 10 points","Offer structure: 10 points","Resource metadata present and coherent: 5 points","Bazaar discovery metadata: 10 points","Browser-readable PAYMENT-REQUIRED header: 5 points"]},"entries":[{"name":"api402x — Onchain Verified Data","targetUrl":"https://api402x.com/dao-proposals","method":"GET","httpStatus":402,"latencyMs":1008,"score":97,"engineScore":97,"verdict":"ready","x402Version":2,"offerCount":3,"headline":"Strong v2 challenge; the declared resource URL downgrades HTTPS to HTTP.","observations":["PAYMENT-REQUIRED decoded successfully and all three offers were structurally valid.","Bazaar metadata and browser header exposure were present.","The protected HTTPS route declared http://api402x.com/dao-proposals as its resource URL."]},{"name":"KHOTEM — Cryptographic Witness","targetUrl":"https://khotem.com/api/attest","method":"GET","httpStatus":402,"latencyMs":1530,"score":95,"engineScore":95,"verdict":"ready","x402Version":2,"offerCount":5,"headline":"Valid multi-network offers; browser header exposure is the only measured warning.","observations":["All five EVM and Solana offers passed network-aware structural validation.","Relative resource metadata resolved to the protected HTTPS endpoint.","Access-Control-Expose-Headers did not advertise PAYMENT-REQUIRED."]},{"name":"NetIntel","targetUrl":"https://netintel.dev/asn-lookup/analyze?asn=AS13335","method":"GET","httpStatus":402,"latencyMs":1163,"score":95,"engineScore":95,"verdict":"ready","x402Version":2,"offerCount":2,"headline":"Coherent Base and Solana offers; browser header exposure is the measured gap.","observations":["Both payment offers passed network-aware structural validation.","Resource and Bazaar discovery metadata were present and coherent.","Access-Control-Expose-Headers did not advertise PAYMENT-REQUIRED."]},{"name":"fetchx402","targetUrl":"https://api.fetchx402.com/v1/tools/dns?domain=example.com","method":"GET","httpStatus":402,"latencyMs":4946,"score":95,"engineScore":95,"verdict":"ready","x402Version":2,"offerCount":1,"headline":"Complete v2 payment and discovery metadata; browser header exposure is the measured gap.","observations":["The PAYMENT-REQUIRED header decoded and the Base USDC offer was structurally valid.","The declared resource URL matched the target origin and path.","Access-Control-Expose-Headers did not advertise PAYMENT-REQUIRED."]},{"name":"Penny","targetUrl":"https://204-168-208-32.sslip.io/x/agent-manifest","method":"GET","httpStatus":402,"latencyMs":810,"score":55,"engineScore":55,"verdict":"caution","x402Version":1,"offerCount":1,"headline":"The body challenge is usable as a legacy flow, but it omits several v2 readiness signals.","observations":["The endpoint returned HTTP 402 with a structured x402Version 1 body challenge.","No PAYMENT-REQUIRED header, Bazaar metadata, or protected resource URL was observed.","The offer used a legacy amount/network shape and did not pass the v2 structural check."]},{"name":"PopaDex Personal Finance Reference API","targetUrl":"https://app.popadex.com/api/v1/reference_data/social_security_rates","method":"GET","httpStatus":403,"latencyMs":810,"score":null,"engineScore":0,"verdict":"inconclusive","x402Version":null,"offerCount":0,"headline":"Inconclusive from this probe vantage: an HTML 403 arrived before an x402 challenge.","observations":["No HTTP 402 or PAYMENT-REQUIRED challenge reached this probe.","This may reflect WAF, bot filtering, or an intermediary policy rather than endpoint readiness.","A second network vantage is required before drawing a service-level conclusion."]}]}