Independent x402 observatory · conformance + settlement

The State of x402 Conformance

Every dashboard counts x402 volume. This one asks a different question: of the endpoints actually live today, how many still speak the current version of the spec?

~77%

of mainnet-capable x402 hosts still declare their network with a legacy short name (base) instead of the v2 CAIP-2 form (eip155:8453). It still settles today — the spec just moved on without most of the base layer.

Latest host-weighted scan: 18 June 2026 · 140 mainnet-capable hosts · directional 76.8–78.6% across four scans

Latest scan — 18 June 2026

110

hosts on legacy short network name (mostly base) — works today, pre-standard · 78.6%

hosts on v2 CAIP-2 (eip155:8453) — current spec · 20.7%

payment-breaking: a price field in decimals, not atomic units

Measured by host, not URL — 198 distinct hosts sit behind ~12,000 raw "valid 402" URLs (one dead server farm alone is 89% of them). The scan probes 1–2 fresh URLs per host; the headline is built on the 140 that can take a mainnet payment.

It holds up — four scans, two days

Scan	Mainnet hosts	Legacy short-name	CAIP-2 (v2)	Broken
1 · 17 Jun	142	76.8%	31	2
2 · 17 Jun	142	77.5%	31	1
3 · 17 Jun	146	77.4%	32	1
4 · 18 Jun	140	78.6%	29	1

The denominator moves a little by design: scans 1–3 are same-day methodology fixes (a POST-fallback revived four live hosts → 146); scan 4 is the next day, when six mainnet hosts went dark in 24 hours. The legacy share holds at ~3 in 4 throughout. The broken count dropped from 2 to 1 after one candidate was reclassified from FAIL to a softer interop warning — it uses a known USDC contract, so a payer can still sign. Raw response snapshots (body hash, accepts[], x402Version) are kept per host, so the count is reproducible after drift, not just asserted.

Why this matters now

"base" isn't broken. It's just not grown up.

Facilitators still accept the old base string, so a payment on a legacy endpoint settles today — our own endpoint runs on it and has settled real payments. The risk isn't today. It's the v2-only client, the stricter facilitator, the cross-facilitator route that won't guess what base means.

The players arriving now aren't hobbyists. With Mastercard wiring x402 into its machine-payments stack alongside thirty-odd partners, the cost of a malformed 402 stops being a missed micropayment and starts being a failed integration someone has to explain. Conformance is the part that makes the no-human-in-the-loop promise true or false.

How the number is made

Live, not cached. Every host is probed fresh — a real request, reading what a paying agent would read. No saved snapshots.
By host, not URL. One server farm or preview cluster counts once, flagged separately, so it can't swing the percentage.
Mainnet only in the headline. Testnet-only endpoints are reported apart from production players.
Stress-tested. Two independent model reviews tried to break the number before it shipped. Both found real bugs in the scanner; both got fixed.
Reproducible. Raw body hash, accepts[] and x402Version are saved per host. The number can be re-derived, not just trusted.
What it does not claim. A legacy base name is a WARN, not a failure — payments still settle. "Broken" is reserved for a payer-breaking error like a malformed amount.

Get the read

A weekly look at what the x402 rails are actually doing — not just how much.

Conformance is the public read of a deeper feed: continuous endpoint and settlement telemetry — who's paying whom, what's wash, what's real. The number above updates here; the story behind each move goes out in the weekly read.

Subscribe to the weekly read Submit your endpoint for the next scan →