other · Listed · Found · 5 endpoints · Gateway-eligible
badhttp
badhttp
Everything is free and stateless. Call any endpoint directly; no key, no signup. Only /402/pay settles a payment (x402 v2 in the PAYMENT-REQUIRED header and x402 v1 in the 402 JSON body, USDC; pay with PAYMENT-SIGNATURE or X-PAYMENT): test USDC on Base Sepolia by default; real USDC on Base mainnet only at /402/pay/base (or ?network=base). Every other /402 scenario is a paywall that misbehaves on purpose and never charges. Limits: /delay ≤ 10 s, /drip ≤ 20 s, /echo body ≤ 16 KB, /redirect ≤ 10 hops, /range documents ≤ 1 MiB, /cookies/many ≤ 20 Set-Cookie headers (the /cookies/delete cleanup sends 45 expirations), /compress documents ≤ 1 MiB and /compress/bomb ≤ 32 MiB inflated (send Accept-Encoding: gzip to receive /compress flavors as sent; the edge transcodes codings you did not list). /cookies tests your client's jar (Set-Cookie edge cases; /cookies/echo reads back what you sent). Accounts are public at /books.json. Rate limit: 100 requests per 10 s per IP at the zone (Cloudflare 429, error 1015) before the Worker runs. /sse streams last at most 20 s. A path template from this document requested literally, braces intact (e.g. /sse/{flavor}), answers 200 with the valid substitutions for its placeholder — any method except OPTIONS, which answers 204 with Allow as everywhere.
Indexed from this operator's public /.well-known/x402.json. Found is not operator-owned and is not attested. Claim or opt out.
Agent Read · Cleared Index
CAUTION
Caution — usable signal, incomplete attestation or mesh.
confidence
67%
source
signal
Index before you pay. Same payload for agents:
GET /api/cleared/agent-read?slug=badhttp-pg4w
When to call
- Everything is free and stateless. Call any endpoint directly; no key, no signup. Only /402/pay settles a payment (x402 v2 in the PAYMENT-REQUIRED header and x402 v1 in the 402 JSON body, USDC; pay with PAYMENT-SIGNATURE or X-PAYMENT): test USDC on Base Sepolia by default; real USDC on Base mainnet only at /402/pay/base (or ?network=base). Every other /402 scenario is a paywall that misbehaves on purpose and never charges. Limits: /delay ≤ 10 s, /drip ≤ 20 s, /echo body ≤ 16 KB, /redirect ≤ 10 hops, /range documents ≤ 1 MiB, /cookies/many ≤ 20 Set-Cookie headers (the /cookies/delete cleanup sends 45 expirations), /compress documents ≤ 1 MiB and /compress/bomb ≤ 32 MiB inflated (send Accept-Encoding: gzip to receive /compress flavors as sent; the edge transcodes codings you did not list). /cookies tests your client's jar (Set-Cookie edge cases; /cookies/echo reads back what you sent). Accounts are public at /books.json. Rate limit: 100 requests per 10 s per IP at the zone (Cloudflare 429, error 1015) before the Worker runs. /sse streams last at most 20 s. A path template from this document requested literally, braces intact (e.g. /sse/{flavor}), answers 200 with the valid substitutions for its placeholder — any method except OPTIONS, which answers 204 with Allow as everywhere.
Risks
- Found — not operator-owned; claim status unknown.
- No Cleared settlement receipt on file yet.
- Uptime not yet marked stable.
- No Gateway traffic yet — market share unproven.
Price posture
5 endpoints — confirm price on manifest before pay.
Category · Gateway
other · no Gateway routes yet — early / unproven on Cleared market share.
Endpoint hints
GET /402/payThe only endpoint on this host that settles a payment. Without a payment header: 402 carrying the requirements twice — x402 v2, base64-encoded in a PAYMENT-REQU
GET /402/pay/baseIdentical to /402/pay?network=base. Pay 0.001–1.00 USDC on Base mainnet (eip155:8453) and get a 200 with a receipt (PAYMENT-RESPONSE for a v2 payment, X-PAYMENT
GET /402/pay/base-sepoliaIdentical to /402/pay?network=base-sepolia and to the bare /402/pay. Free to exercise with test USDC; nothing real moves.
GET /402/{scenario}Without a payment header: 402 with the requirements base64-encoded in a PAYMENT-REQUIRED header (x402 v2) and translated into the JSON body (x402 v1, plain netw
GET /402/broken/{flavor}GET /402/broken/{flavor} at $Metered.
Evidence (Cleared)
- → Intake verified · Gateway-eligible
- → Trust 55/100 · fail · tier listed
- → Protocol x402
- → Manifest reachable · schema valid
- → Found listing — indexed from public x402.json, not operator-attested.
Endpoints
A real x402 paywall for testing clients, v2 and v1 in one response: pay 0.001–1.00 USDC (test USDC on Base Sepolia by default, ?network=base for real USDC) and get a 200 with a receipt and the transaction hash
$MeteredGET https://badhttp.dev/402/payThe only endpoint on this host that settles a payment. Without a payment header: 402 carrying the requirements twice — x402 v2, base64-encoded in a PAYMENT-REQUIRED header, and x402 v1, as the JSON body (x402Version 1, plain network names, maxAmountRequired in atomic units) for older clients that only read bodies. The requirements name one network: Base Sepolia (test USDC, free) unless you ask for Base mainnet (real USDC) with /402/pay/base or ?network=base; a client whose wallet is funded on mainnet must ask for it. With a valid PAYMENT-SIGNATURE (v2) or X-PAYMENT (v1): verified and settled through a third-party facilitator (GET /402 lists them in order, per generation, and its "verified" object says what has been exercised live so far); 200 plus a receipt in PAYMENT-RESPONSE (v2) or X-PAYMENT-RESPONSE (v1) on success. Nothing is sold except the receipt. Sibling endpoints under /402 misbehave on purpose and never settle.
The same paywall, real USDC on Base mainnet only: the stable resource URL for a client or catalogue that wants mainnet
$MeteredGET https://badhttp.dev/402/pay/baseIdentical to /402/pay?network=base. Pay 0.001–1.00 USDC on Base mainnet (eip155:8453) and get a 200 with a receipt (PAYMENT-RESPONSE for a v2 payment, X-PAYMENT-RESPONSE for a v1 payment) and the transaction hash; that payment is this site's revenue and is booked at /books. Nothing else is sold.
The same paywall, test USDC on Base Sepolia only (what the bare /402/pay offers)
$MeteredGET https://badhttp.dev/402/pay/base-sepoliaIdentical to /402/pay?network=base-sepolia and to the bare /402/pay. Free to exercise with test USDC; nothing real moves.
x402 paywalls that misbehave on purpose (v2 header + v1 body, like /402/pay). Every scenario here returns a valid-looking 402 and then never settles anything; the one that works is /402/pay.
$MeteredGET https://badhttp.dev/402/{scenario}Without a payment header: 402 with the requirements base64-encoded in a PAYMENT-REQUIRED header (x402 v2) and translated into the JSON body (x402 v1, plain network names, maxAmountRequired) — except wrong-network, whose body stays v2-shaped because its nonexistent chain has no v1 name. With a PAYMENT-SIGNATURE or X-PAYMENT: each scenario answers as its name suggests (never: 402 again; reject: 402 with an error; slow: 504 after ?seconds=; crash: 500; bad-receipt: 200 with garbage in both receipt headers; overpriced and wrong-network: 402 explaining what your client should have refused). Nothing is ever charged. GET /402 lists them.
A malformed 402 of the chosen flavor; GET /402/broken lists them. Never settles.
$MeteredGET https://badhttp.dev/402/broken/{flavor}Checks
reachable
valid
2026-09-08T07:32:51.658Z
Intake verified · Verified — Gateway-eligible · probed 3/3 · No settlement evidence found in chain signals.
Gateway routing
Score 55/100 — manifest verified (≥55) but not full attestation (70). Gateway may route with caution; missing receipt settled, uptime, or identity caps the score.
Claim this listing to upgrade to Cleared attestation.
Claim listing