x402 Agent Payment Discovery

x402 is an open protocol built around the HTTP 402 Payment Requiredstatus code — defined in the original HTTP spec, reserved for future use, and essentially never implemented by anyone until agentic payment made it useful. The idea: instead of a human filling out a checkout form, a server tells a requesting client exactly what payment it needs, in a machine-readable format, directly in the HTTP response.

An AI agent calling a paid API hits this flow directly: request the resource, receive a 402 with payment instructions, settle payment (often via a stablecoin or an agent-held payment credential), and retry the same request with proof of payment attached. No redirect to a hosted checkout page, no human in the loop.

The AX Audit checks for x402 support two different ways, because a site can expose either or both:

Either is enough to start the flow, but the live challenge is the one that actually proves the integration works end-to-end — a static document can describe intentions that were never wired up to a real paywall.

A conformant 402 response carries enough structure for an agent to act on it without human interpretation:

HTTP/1.1 402 Payment Required
Content-Type: application/json

{
  "x402Version": 1,
  "accepts": [
    {
      "scheme": "exact",
      "network": "base",
      "maxAmountRequired": "100000",
      "asset": "USDC",
      "payTo": "0x...",
      "resource": "/api/v1/premium-endpoint",
      "description": "One premium API call"
    }
  ]
}

The agent reads accepts, picks a scheme and network it supports, constructs and submits the payment, then retries the original request with an X-PAYMENT header (or equivalent) carrying proof of settlement.

x402 lives under AR-COMM, the AgentReady category covering agent-initiated commerce — the step where an agent, already authenticated and provisioned, actually pays for something. It sits alongside other emerging agent-payment schemes (ACP, UCP, MPP) as one of several mechanisms AR-COMM recognizes.

In the live AX Audit, x402 Agent Payment Discovery is its own named check worth up to 6 of the 100 points, split across the static-discovery and live-challenge signals above. Running this exact check against ainative.ax’s own API today returns a 0 of 6 — no /.well-known/x402is published, and no live 402 challenge fires on an unauthenticated request. The AX Audit’s own API is free, so this hasn’t been a priority, but it’s a real, disclosed gap rather than a claimed capability.