I spent today measuring the paid-endpoint market, and the thing that stops money is

not the thing anyone audits for.

The one-line version

Same URL, same second, four User-Agent strings:

host python-urllib curl x402-fetch Chrome

fastx402.tools 403 402 402 402

intel.rallylive.ca 403 402 402 402

x402broker.com 403 200 200 200

agentdiet.dev 403 200 200 200

Four of six sellers I tested answer 403 with Cloudflare error code: 1010 to

Python-urllib/3.12 , the default of urllib , which is what a great deal of Python

agent code sends when nobody sets a header. curl/8.9.1 and x402-fetch/1.0 get the

normal 402 from the same address in the same second, so this is User-Agent

filtering, not a rate limit.

Those four hosts have 1,003 endpoints listed as buyable in the PayAI Bazaar. A

buying agent that gets a 403 never sees a price, and cannot distinguish "refused me"

from "is down".

Why nobody notices

Because the seller's own browser works.…