On 20 October we paid ourselves 21 cents. Four hours later, somebody we don't know paid one cent.

Both payments went through the same thing: an HTTP status code that sat unused for about thirty years. 402 Payment Required was reserved in the original HTTP spec "for future use". The x402 protocol finally uses it: a server answers 402 with a price, the client pays in a stablecoin and retries, and the data comes back. No account, no API key, no invoice.

We put five JSON endpoints behind it, across two of our sites:

Route What one call returns Price
coinbucha.com/api/paid/signal-history every Bitcoin signal's full dated strength series $0.05
coinbucha.com/api/paid/sovereign-snapshots every frozen State of Sovereign Bitcoin snapshot $0.05
vincap.co/api/paid/register-snapshots every dated edition of the listed wine company register $0.05
vincap.co/api/paid/estates every monthly record of the vineyards listed wine companies own $0.05
vincap.co/api/paid/calendar every results date, AGM and dividend, with what actually happened $0.01

The cheapest one is the one that sold.

What a 402 looks like

Ask for a paid route without paying and you get no body worth reading, just a header:

HTTP/2 402 payment-required: eyJ4NDAyVmVyc2lvbiI6Mi...

The header is base64 JSON. Decode it and it tells a machine everything it needs: what the resource is, which network, which token, how much, and where to send it.

import base64, json, urllib.request, urllib.error url = "https://vincap.co/api/paid/calendar" try: urllib.request.urlopen(url) except urllib.error.HTTPError as e: req = json.loads(base64.b64decode(e.headers["payment-required"])) pay = req["accepts"][0] print(e.code, req["resource"]["description"][:60]) print("network", pay["network"], "| price", int(pay["amount"]) / 1e6, "USDC")

Run it and you get 402, the description, eip155:8453 (Base) and 0.01 USDC. The amount is in USDC's six-decimal units, so 10000 is one cent. The same header carries a small example of the output and a JSON schema, which is what a catalog reads.

The catalog

Coinbase's facilitator keeps a public discovery list of x402 routes (the "Bazaar"): api.cdp.coinbase.com/platform/v2/x402/discovery/resources. When we read it on 21 October it held about 24,000 distinct routes on roughly 2,500 hosts. A route shows up there once a payment through the facilitator has settled, so a door nobody has paid through is invisible.

So on 20 October at 11:28 UTC we paid each of our five routes once, from our own wallet: 0.21 USDC in total. All five are listed now. We log those five payments in a file in the repo so they are subtracted from every count we report. They are a test, not sales.

The catalog also shows each route's last-30-day calls and unique payers. On four routes it reads 1 call, 1 payer: us. On the calendar it reads 2 calls, 2 unique payers, last called 15:18 UTC. Three hours and fifty minutes after our test, someone else paid one cent for it.

What we think it means (not much yet)

One payer is not a pattern, and one cent is not a business. Two small things are worth writing down:

  1. The thing that sold was the calendar, the most boring route: dated events, each with its source and a recorded outcome (held, moved, did not occur). Not the index history, not the snapshots.
  2. Wine is nearly empty there. Search the catalog's descriptions for "wine" and you get six routes: our three, a party drinks calculator, a home-brew alcohol calculator, and a copy-trading list that matched by accident. If you want listed wine company data as a paid call, today it is us or nothing.

Everything behind the doors stays free in its smaller form. The CSVs, the datapackage files and the bounded lookups are not paywalled, and the paid route returns the same numbers, just all of them in one call.

Information, not investment advice.