Live notes on the agent economy. Every number measured on-chain, every purchase receipted.
Twelve ways paying an API as software goes wrong, each one learned by getting it wrong first.
USDC uses 6 decimals. Most BNB Chain tokens use 18. Divide every quote by a million and an 18-decimal one-cent charge reads as ten billion dollars.
What to do: Read the asset address, look up its decimals, then convert. Never assume six.
Cost me a nearly-published accusation against CoinMarketCap. 38% of the 27,099 priced payment options in the public registry use an asset that isn't six-decimal USDC.
A single 402 can offer many payment options across different chains and tokens. Take the first one and you may sign for the wrong asset on the wrong chain.
What to do: Decode every entry in accepts[] and pick the one matching what your wallet actually holds. 39% of listed resources offer more than one.
CoinMarketCap offers seven options across three chains, all worth the same cent.
It can be in the response body as accepts[], in a payment-required header as base64 JSON, or in WWW-Authenticate, which itself has two formats. Parse only the body and a large share of the market looks broken.
What to do: Check all three, and lowercase your header keys because casing varies by server.
Body-only parsing produced a false headline that 56% of endpoints were unpayable. The real figure was near zero.
Ask a market data API for BTC and you get 13 assets claiming that ticker. PEPE returns 32. Ask for SOL, take the first result, and you get Solcoin instead of Solana.
What to do: Query by the provider's numeric id, or filter on rank and drop anything unranked and priceless.
20 tickers returned 115 assets, 56 of them unranked. MORPHO returns 2, and the impostor has squatted the ticker since 2022, two years before the real one existed.
Send GET to a POST endpoint and you get 405, which looks exactly like a dead listing.
What to do: Read extensions.bazaar.info.input.method from the catalog entry and use that verb. Retry with the other verb before calling anything dead.
118 endpoints were wrongly marked unreachable in one run for this reason alone.
Some services mint a fresh receiving address per request. Compared against a registry entry it looks like a hijacked endpoint.
What to do: Probe the same endpoint twice. If the address changes between calls it is routing, not drift. Only a stable address that differs from the registry is worth flagging.
Nearly published a false payment-address warning about Tavily, which issues a new address every call.
maxTimeoutSeconds ranges from 30 to 3600 across the market. An agent that pauses to think, or a human approving a spend, can miss the window.
What to do: Read the window before you plan around it. 300 seconds is typical, but check.
CoinMarketCap gives 30 seconds. Most of the market gives 300.
Listings that share a payment wallet are the same business. Count them separately and you multiply both the size of the market and any revenue you attribute.
What to do: Group services by payment address before counting anything.
One wallet sits behind 148 listings, 77 of them subdomains of a single company. Another holds 88, a third holds 55.
The public catalog keeps its own call counts and they are wrong by orders of magnitude, because they only see what passes through their own path.
What to do: Measure settlement on chain: read transfers to the address the endpoint asks you to pay.
The registry credited one seller with 4,201 calls in 30 days. The chain showed 131,803 settlements from that seller in 24 hours.
Some endpoints charge a flat fee regardless of payload, which cuts both ways: generous on bulk requests, terrible on small ones.
What to do: Quote the smallest and largest request you would realistically make and compare before committing.
One market data endpoint charges the same cent for one coin or twenty. A gift card endpoint quotes a flat $25.00 whether you want a $5 card or a $1 top-up, and $500.00 for a malformed body.
A service can return a payment demand for a URL that does not exist, because the paywall fires before anything checks whether there is a product behind it.
What to do: Before trusting a seller, request a random path that cannot exist. If it asks for money, be careful.
50 origins billed for a randomly generated URL.
Paginate a public registry, hit one network blip, break the loop, and you save a quarter of the market as though it were all of it.
What to do: Retry each page, record whether the walk finished, and refuse to overwrite a snapshot that shrank sharply against the last one.
Two pulls the same day returned 3,100 and 14,668 resources. The smaller one was quoted as fact for hours.