Author: David Christopher
Compiled by: Block unicorn
x402's success depends on native integrators. Unauthorized wrappers risk turning potential partners into adversaries.
Last week, Coinbase launched agentic.market, a platform showcasing x402 endpoints aimed at making the x402 ecosystem more discoverable.
Browsing agentic.market, you'll find real-time, on-demand access to a variety of services, ranging from on-chain tools to mainstream APIs. Some endpoints are offered directly by original providers. Many others come from third parties: companies that have wrapped existing APIs into x402 (and/or MPP) and packaged them into toolkits for agents, charging users a small fee for access through a single connection.
The second approach complicates matters. Among the third-party endpoints showcased on Agentic Market are services from Wolfram Alpha, Google Flights, and Amadeus (a widely used travel data platform). I'm focusing on these three because none have announced x402 integration themselves, and their terms of service suggest they are unlikely to authorize third parties to build integrations on their behalf.
Every endpoint indexed on Agentic Market could be first-party (the original provider offers its API directly), third-party authorized (a reseller with explicit permission, typically through a formal certification or partnership program), or unauthorized third-party (a company reselling API access it obtained through its own paid subscription without permission).
Across the market and the broader x402 ecosystem, it's impossible to immediately distinguish between first-party and third-party offerings, and many endpoints appear to fall into the last category.
Contract Terms
As noted, the terms of these three providers make unauthorized third-party arrangements seem highly likely, and in some cases, they preclude any other option entirely.
Wolfram Alpha explicitly prohibits "resellers and aggregators," bans data scraping or mining in any form, and forbids selling or sublicensing services without permission. These terms appear to leave no room for an authorized third-party path. Furthermore, looking at the quickstart guide for this endpoint, it is clear this is not a first-party integration.
API Prohibitions in Wolfram Alpha Terms of Service
Amadeus's Master Subscription Services Agreement only permits customers to access services for internal business purposes and prohibits any "rental, lease, distribution, sale, resale, transfer, or other conveyance" of its access. Any third-party connection requires Amadeus's certification and must be documented as a formal service order. This means it is the only route to third-party authorization, and whether any existing endpoint meets this requirement is externally unverifiable.
Restrictions in Agreement - Amadeus Master Subscription Services Agreement
Google's situation is the most typical. Google Flights has no public API, and Google takes strict measures to protect its data.
However, third-party wrappers are packaging access to Google Flights data sourced from SerpApi — a company that Google is actively suing, alleging it scrapes search results and resells access. Google's complaint states that SerpApi developed tools to bypass access controls, sends "hundreds of millions" of fake requests daily to scrape data, and resells copyrighted content embedded in search results.
Thus, Google is suing SerpApi for reselling copyrighted content and bypassing its access controls. Meanwhile, SerpApi's service is being wrapped by an agent toolkit provider who offers it to agents for a fee. This is worth pondering over.
Details of accessing SerpApi via the StableTravel endpoint
How Compliance Manifests
You don't need a legal expert to see that these dynamics are "complex." The good news is that a clearer model already exists.
MPP is the agent payment protocol launched by Tempo when its mainnet went live, offering over 100 compatible services on day one. Vendors that directly integrate MPP — such as Parallel, Stripe Climate, Browser Base, among others — are marked with a green circle on their cards, indicating first-party status.
Service directory viewed via mpp.dev
About two weeks ago, popular AI research tool Exa announced native support for the x402 protocol in its search and content endpoints — becoming a first-party provider and partnering with Coinbase. Exa stated it chose x402 over proprietary protocols because it is governed by the Linux Foundation.
Inevitable Outcome
Currently, it is externally impossible to know whether an endpoint is first-party, third-party authorized, or unauthorized third-party. This is a solvable problem, and MPP's service directory — which clearly shows the source of each integration — is a step in that direction.
Unauthorized scraping already imposes numerous measurable pressures on service providers: server load, bandwidth costs, and traffic they never consented to. Third parties wrapping scraped data in the x402 protocol and charging for it only exacerbates the situation. Service providers bear all the costs but receive nothing in return.
Therefore, it's necessary to clarify the root of the problem. x402 is an open protocol — just as any developer can build on HTTP, any developer can build on x402. The payment mechanism cannot trace whether upstream data was obtained with authorization. Responsibility lies with the developers who package these endpoints for users.
Without accountability, it could negatively impact the overall development of x402 — potential native integrators might become opponents rather than participants. This revenue rightfully belongs to service providers. Native integration is how they claim this revenue and how x402 gains the legitimacy it needs to grow.
Note: As of April 25, Google Flights is no longer indexed on Agentic Market.
