SuVerse payment funnel — measured numbers
Generated 2026-09-07 ~05:20 UTC, read-only pull from production databases and journald. M = measured (counted from a DB table or a log). E = estimated / inferred. All money in USDC, atomic units divided by 1e6, not rounded.
0. Windows and data availability
| Window | Bounds (UTC) |
|---|
| 14 days | 2026-08-24 05:00:00 → 2026-09-07 05:00:00 |
| 24 hours | 2026-09-06 05:00:00 → 2026-09-07 05:00:00 |
| Source | Covers | Available from | Window fully covered? |
|---|
suverse_pay.proxy_request_logs | proxy.suverse.io: every request to a paid endpoint (554 active), one row per request with outcome challenge / settled / settle_failed / upstream_error / invalid_config, hashed IP, User-Agent | 2026-05-31 | yes |
suverse_pay.facilitator_payments | every verify+settle our facilitator executed (data endpoints, swap quote, QA bots); payer wallet, amount, tx | 2026-05-31 | yes |
govhub.requests | api.suverse.io GovHub (/v1/gov, /v1/freight, /v1/agent): one row per request, status, wallet, cost, raw IP, UA | 2026-05-22 | yes |
| journald: suverse-pay-proxy, suverse-pay-api, govhub.service | request/response lines (method, path, status, client IP), facilitator verify/settle calls, x402 verify verdicts | 2026-08-12 17:15 UTC | yes |
| nginx access logs | — | not readable by this user (root/adm only) | NOT used |
Two separate surfaces are reported: A = proxy.suverse.io (suverse-pay proxy, 554 active paid endpoints under /v1/data and /v1/proxy, plus the $0.001 swap quote) and B = api.suverse.io GovHub (128 gov + 9 freight x402 endpoints, plus the prepaid /v1/agent logistics API). They have different logs and are not double-counted.
1. Funnel
A. proxy.suverse.io
| Step | 14 days | 24 hours | How measured |
|---|
| 402 challenges issued | M 725,726 | M 39,547 | rows outcome=challenge. Cross-check from proxy journald: 741,942 HTTP 402 responses in 14d (377,158 POST / 362,888 GET / 1,896 HEAD); the 16,216 gap (2.2%) is 402s on paths that are not row-logged (swap quote, unknown slug). Use 725,726. |
| Requests that carried a payment header (= verify attempt) | M 122 | M 8 | settled + settle_failed rows. 2 of the 122 (1 of the 8) were deliberately malformed headers from x402lint and never reached the facilitator; 120 real facilitator /verify calls. |
| Verify OK → settle OK (real on-chain settles) | M 29 | M 2 | rows outcome=settled, each joined to a facilitator_payments row with tx hash |
| Verify rejected by our facilitator (HTTP 502) | M 91 | M 5 | settle_failed / facilitator_error. 83 of 91 are ONE caller (see §2, "broken payer"). 8 = mercator-gateway/0.2 on two endpoints (08-26). |
| Conversion challenge → payment header | 0.0168% | 0.0202% | 122 / 725,726 ; 8 / 39,547 |
| Conversion challenge → settled | 0.0040% | 0.0051% | 29 / 725,726 ; 2 / 39,547 |
| Conversion payment header → settled | 23.8% | 25.0% | 29 / 122 ; 2 / 8. Excluding the single broken caller and the lint probe: 29 / 37 = 78.4% |
Facilitator-side cross-check (suverse-pay-api journald, 14d): /facilitator/verify → 200: 154, → 502: 891 (= 297 failed verify sessions × 3 retries); /facilitator/settle → 200: 153. Every one of these calls came from our own proxy (185.218.126.38); nobody external uses facilitator.suverse.io directly. The failed sessions (296 HTTP 502 responses from the proxy, 297 "verify exhausted" log lines) split exactly: 205 from our own AgentOS QA host 5.189.190.163 (105 /v1/swap/base/quote, 93 /v1/swap/solana/execute, 7 /v1/swap/base/execute), 83 the broken external payer below, 8 mercator-gateway/0.2 (IPv6 2a06:98c0:3600::103). 153 settles = 29 proxy data + 6 external swap quote + 118 internal QA swap quote.
B. api.suverse.io GovHub
| Step | 14 days | 24 hours | How measured |
|---|
| 402 challenges issued | M 20,888 | M 817 | requests.status_code=402 (journald cross-check: 20,895 POST 402) |
| Requests carrying a payment header | M 0 | M 0 | govhub journald has zero "x402 verify ok / verify rejected / malformed payment header" events in 14d; requests table has zero rows with wallet_address or tx_hash |
| Settled | M 0 | M 0 | cost_paid_usdc_micro > 0: none. All-time GovHub has never had a paid x402 call from a non-internal wallet (only 0x0993…, 0x3869…, 8Hy7… = our wallets; last one 2026-07-18). |
GovHub prepaid channel (broker balance, not x402), 14d: debits $4.300 (89 calls, 2026-08-24 19:12–19:40 UTC) by pingpointsdk+sandbox@… and $0.040 by pingpointsdk@…; 0 card/crypto top-ups in window (last card top-up 2026-08-21); 1 promo credit $10.00 on 09-03 (not cash). This is partner sandbox consumption, not new external revenue.
Combined
| 14 days | 24 hours |
|---|
| 402 challenges (A+B) | M 746,614 | M 40,364 |
| Payment-header attempts (A+B) | M 122 | M 8 |
| Settled on data endpoints (A+B) | M 29 | M 2 |
| Settled swap-quote, external (A, not in the challenge count) | M 6 | M 1 |
2. Who is the traffic
A. proxy.suverse.io, 14 days
| Metric | 14 days | 24 hours |
|---|
| Distinct callers (hashed client IP) | M 1,468 | M 169 |
| Distinct User-Agent strings | M 228 | M 92 |
| Callers that sent a payment header | M 22 | M 4 |
| Callers that settled | M 20 | M 2 |
| Distinct external paying wallets (data endpoints + swap quote) | M 15 (14 data + 1 swap-only) | M 2 |
| Our own QA wallets that paid (excluded from revenue) | M 2 (GEyt… Solana 111 settles, 0x0145… Base 7 settles; swap quote only) | M 1 (8 settles) |
Non-paying traffic (challenges from callers that never sent a payment header on any endpoint, ever)
| Class (by User-Agent) | Challenges 14d | % of all 402 | Callers | UA strings | …of which sent a request body |
|---|
| Self-declared monitor / indexer / prober / crawler (UA contains monitor, probe, indexer, crawler, health, census, observer, scout, discovery, liveness, explorer, bot, x402…) | M 597,493 | 82.3% | 1,175 | 120 | 17,566 (36 callers) |
| Generic client UA (node, axios, Java-http-client, python-*, curl, Deno, Go-http-client…) | M 50,342 | 6.9% | 130 | 40 | 213 (11 callers) |
| Browser UA (Mozilla/…) | M 2,021 | 0.3% | 146 | 29 | 34 (1 caller) |
| No UA | M 161 | 0.02% | 4 | 1 | 0 |
| Total never-attempted | M 650,017 | 89.6% | 1,433 | 190 | |
Method split from proxy journald (14d, all 402s): GET 362,888 + HEAD 1,896 = 364,784 body-less discovery probes (49.2%); POST 377,158 (50.8%). In the DB, 530,951 challenges had no request body and 194,761 had one. Classification by UA keyword is M; calling a UA that says "monitor" a monitor is trusting its self-description (E).
Dominant callers (proxy, 14d, challenges)
| # | User-Agent (identity) | Challenges | % of 402 | IPs | Type |
|---|
| 1 | CarbonMonitor/0.1 healthcheck (carbon-cashmere.de) | 156,204 | 21.5% | 1 | uptime monitor, never pays |
| 2 | 402explorer/0.1 (discover.paygent.net) | 120,519 | 16.6% | 2 | indexer, never pays |
| 3 | forum-labs-trust-prober/1.0 (forum-labs.com) | 114,527 | 15.8% | 521 | distributed QoS prober, never pays |
| 4 | MPP32 family (mpp32-indexer ×2 UAs, mri-indexer, MPP32-Health; agentrateindicators.com / mpp32.com) | 51,220 | 7.1% | ≈27 | indexer, never pays |
| 5 | python-httpx/0.28.1 (unlabeled; one IP = 30,895) | 32,035 | 4.4% | 5 | unlabeled full-catalog sweeper |
| 6 | CoinbaseBazaarDiscovery/1.0 (CDP) | 28,599 | 3.9% | 5 | Coinbase Bazaar crawler |
| 7 | node (unlabeled; one IP = 23,118) | 28,138 | 3.9% | 50 | mixed; includes the broken payer below and 3 real payers |
| 8 | Nitrograph-HealthCheck/1.0 | 22,428 | 3.1% | 1 | monitor |
| 9 | entropy-daemon-trust-oracle/2.0 | 20,728 | 2.9% | 1 | monitor |
| 10 | 10x402-monitor / AgentTrustLayer (same IP hash 3d9078…) | 21,975 | 3.0% | 1 | monitor that DID pay twice (wallet 0x2a07…, 08-26) and failed 8 times as mercator-gateway |
| Top 3 combined | 391,250 | 53.9% | | |
Dexter: Dexter-Verifier/1.0 is present but no longer paying: 371 challenges from 1 IP in 14d, 0 settles. Its last settle was 2026-08-05 (all-time 306 settles, $17.904, from Solana wallet TeSt… and 0x7e57…). It is not a dominant caller in this window.
Broken payer (biggest single "wanted to pay, could not" signal): caller hash d923…, UA node, wallet 0x8a1A037b…, Base. It paid 146 × $0.001 for bazaar-test between 2026-07-16 and 2026-08-14 08:21 UTC. Since 2026-08-14 12:46 UTC every attempt (143 all-time, 83 in the 14d window, roughly every 4 h, last 2026-09-07 00:31 UTC) fails because our facilitator answers HTTP 502 on /facilitator/verify (proxy retries 3×, then returns 502 to the caller; no settle_failed row is a real settle). Root cause (found 2026-09-07 05:50 UTC, reproduced): the wallet is out of USDC — on-chain balance 0.000008 USDC on Base, below the $0.001 price (146 × $0.001 spent). Coinbase CDP answers such a verify with HTTP 400 {"isValid":false,"invalidReason":"invalid_payload","invalidMessage":"contract call failed: … execution reverted"}; our provider-sdk treats any non-2xx as a ProviderError, the facilitator returns 502, the proxy treats 5xx as transient, retries 3× and hands the buyer a 502 instead of a 402 with invalidReason. Reproduced with a read-only verify from our own test wallet: $0.001 → 200 isValid:true; $100 (above its $7.85 balance) → 502 with exactly that CDP 400 body. The request path is not a factor. Our own Base QA wallet 0x0145… has the same problem: balance 0.000455 USDC, so its swap-quote verify has failed since ~08-25 (7 settles vs 105 verify-502s in 14d); the Solana QA wallet still pays 111/112. Nothing changed on our side on 08-14 (no commits, no restarts, config untouched since 05-31). Not fixed here (read-only): the fix is to parse a CDP 4xx body that carries isValid:false as a normal invalid verdict (insufficient_funds) so buyers get a 402 with a reason and no retries, plus a USDC top-up for the QA wallet.
B. GovHub api.suverse.io, 14 days (all rows)
| Status | Rows | IPs | UAs | What it is |
|---|
| 404 | 29,437 | 1,930 | 4,033 | scanners hitting non-existent paths (Agent402/1.0 UA with 799 IPs, WordPress, l9explore…) |
| 402 | 20,888 | 1,086 | 37 | challenges; top: node 8,089 (755 IPs, distributed crawler), mako-pulse-prober 7,787 (2 IPs), x402-list-monitor 1,256, CoinbaseBazaarDiscovery 728, x402-observer 708, vale-census-probe 351, ZeroBot 266, forum-labs 224 (211 IPs). Top endpoint: logistics.get_load_position 5,697. |
| 200 | 6,957 | 886 | 43 | free discovery docs (meta.discovery 3,207, meta.openapi 2,586, meta.services 710) + 82 prepaid agent.get_load |
| 405 | 1,642 | 200 | 62 | wrong method probes |
24h GovHub: 402 = 817 (49 IPs, 20 UAs), 200 = 401, 404 = 2,121. Payment attempts 0.
3. Real revenue (external wallets only)
| Bucket (14 days) | Settles | USDC | Distinct payers | Notes |
|---|
| All settles our facilitator executed | M 153 | 1.504000 | 17 | facilitator_payments status=settled |
| − our own QA wallets (swap quote cron) | 118 | 0.118000 | 2 | GEyt… 111, 0x0145… 7; excluded |
| = External settles | M 35 | 1.386000 | 15 | |
| on data endpoints | 29 | 1.380000 | 14 | 13 endpoints; prices $0.001–$0.10 |
| by self-declared probes / observatories / censuses | 20 | 0.966000 | 8 | vet402-observatory-l1 (14 settles, $0.863, wallets 0x6777… and 0xc9c7…), nohumans-scout, delivered-probe, payments-mcp-proxy, probe402-settle-leg, scvd-walkabout, csoai-settlement-census. Real money, but the buyer says it is measuring us, not using the data. |
| by unlabeled clients (no UA / node / python-urllib3 / Chrome) | 9 | 0.414000 | 6 | 0x27Ab… 3 × dex-trending-pools $0.10 (09-05); 0x1DeD… geo $0.05 (08-25); 0x2a07… wiki-random $0.06 + bazaar-test $0.001 (08-26, IP of 10x402-monitor); 0xb92a…, 0x8027…, 0xcF98… bazaar-test $0.001 each |
| on swap quote ($0.001) | 6 | 0.006000 | 4 | 3 of the 4 wallets also bought data endpoints |
| Refunds in window | M 0 | 0 | | refunds_pending empty for window |
| 24 hours | Settles | USDC | Payers |
|---|
| External | M 3 | 0.003000 | 2 |
bazaar-test $0.001 × 2 (csoai-settlement-census 06:39 UTC; node 0xcF98… 20:19 UTC) + swap quote $0.001 × 1 (0xcF98… 20:14 UTC) | | | |
| Internal QA (excluded) | 8 | 0.008000 | 1 |
| "Last genuine external sale" | When (UTC) | Endpoint | Amount | Payer / UA |
|---|
| Most recent external settle of any kind | 2026-09-06 20:19:45 | bazaar-test | 0.001 | 0xcF98E5e2… / node (also bought a swap quote 5 min earlier; looks like a developer test) |
| Most recent external settle by a self-declared probe | 2026-09-06 06:39:13 | bazaar-test | 0.001 | 0x4dB7AAFb… / csoai-settlement-census/0.1 |
| Most recent external settle on a priced endpoint by a probe | 2026-09-06 01:01:04 | weather | 0.050 | 0xc9c7b38C… / vet402-observatory-l1 |
| Most recent external settle on a priced endpoint by an unlabeled buyer (best candidate for a real purchase) | 2026-09-05 02:30:54 | dex-trending-pools | 0.100 | 0x27AbCDdd… / no UA; 3 purchases 00:35–02:30 UTC that night; same wallet paid twice on 08-14 with UA node; 5 settles all-time, $0.50 |
GovHub x402: no external sale ever. All-time external payers across the whole facilitator history: 197 wallets, 1,201 settles, $37.644 (since 2026-05-31) — for scale only.
4. The key ratio
Proxy 402 challenges split by whether the caller ever attempts payment (any endpoint, whole history since 2026-05-31)
| Caller class (by hashed IP) | Challenges 14d | % | Callers | % callers | Challenges 24h | % |
|---|
| Never sent a payment header on any endpoint, ever ("pure lookers") | M 650,017 | 89.57% | 1,433 | 97.6% | M 33,848 | 85.6% |
| Has settled somewhere at some point | M 57,707 | 7.95% | 30 | 2.0% | M 4,161 | 10.5% |
| Has attempted but never settled | M 18,002 | 2.48% | 5 | 0.3% | M 1,538 | 3.9% |
Within-window only (ignoring history): never attempted in window 703,501 challenges (96.94%) from 1,446 callers; settled in window 22,140 (3.05%) from 20 callers; attempted-only 85 from 2 callers. The 22,140 "payer" challenges are almost entirely the 10x402-monitor IP (21,975 challenges, 2 settles) — a monitor that pays occasionally still behaves like a looker. Caveats: IP-hash = caller is an approximation (forum-labs alone spans 521 IPs; a buyer behind several IPs is split); GovHub has 0 attempters so its 20,888 challenges are 100% lookers.
Would-buy-if-they-could vs never-would-buy
| Group | Callers | Challenges 14d | Measured or inferred |
|---|
| Proven buyers: settled in window (external) | 20 IPs / 15 wallets | 22,140 | M |
| Wanted to pay, blocked by us: the 0x8a1A… bot (83 failed verifies, was paying until 08-14) | 1 | 83 | M attempts; E that it would still pay if verify worked |
| Other attempted-but-failed in window (mercator-gateway 8, x402lint 2 deliberately invalid) | 2 | ≈21,977 (shares IP with 10x402-monitor) | M; lint is not a buyer |
| Self-declared monitors / indexers / crawlers, never attempted (many UAs literally say "no payment sent") | 1,175 | 597,493 | M UA text; E never-would-buy |
| Unlabeled callers (generic client / browser / no UA), never attempted | 280 | 52,524 | the only pool where a hidden buyer could sit |
| …of which high-volume sweepers (≥1,000 challenges from one IP, e.g. python-httpx 30,895, node 23,118, Google-Cloud IP pool rotating phone UAs 1,233 each) | ≈15 | ≈46,000 | E scanner behaviour, never-would-buy |
| …of which low-volume (≤20 challenges) unlabeled callers | 226 | ≈1,100 | M count |
| …that actually sent a request body with parameters (behaved like someone trying to use the API) | 7 (4 of them on ≤3 endpoints, 6 challenges total) | ≈20 | M count; E these are the best "would-buy-if-they-could" candidates |
Honest estimate (14 days, proxy):
• Measured floor of "would buy": 22 callers sent a payment header (1.5% of 1,468 callers); 15 external wallets actually paid.
• E "Would-buy-if-they-could" beyond that: at most ≈8 more callers (7 low-volume unlabeled callers that sent real parameters and never paid, plus the 1 blocked payer). Upper bound ≈30 callers ≈ 2% of callers, responsible for well under 0.1% of challenge volume (≈100 of 725,726 challenges once the paying monitors' sweeps are excluded).
• E "Never-would-buy": ≥98% of callers and ≥99.9% of 402 volume. By hard count, 89.6% of challenges come from IPs that have never sent a payment header in the entire history of the service; the remaining 10.4% comes from 35 IPs, of which 3 monitors alone generate 21,975 + 18,000 + 9,930-class sweeps.
• What is NOT measurable here: intent of a caller who reads the 402 body and leaves. Nothing in the logs distinguishes "no wallet" from "not interested"; the extensions.no_wallet hint has no click-through tracking.
5. Reproduction (read-only)
-- proxy funnel
select outcome, count(*) from proxy_request_logs where created_at >= '2026-08-24 05:00+00' and created_at < '2026-09-07 05:00+00' group by 1;
-- key ratio
with w as (select * from proxy_request_logs where created_at >= '2026-08-24 05:00+00' and created_at < '2026-09-07 05:00+00' and outcome='challenge'),
h as (select ip_hash, bool_or(outcome='settled') s, bool_or(outcome='settle_failed') a from proxy_request_logs group by 1)
select case when s then 'settled_ever' when a then 'attempted_only' else 'never' end, count(*), count(distinct w.ip_hash) from w join h using(ip_hash) group by 1;
-- external revenue
select count(*), sum(gross_amount), count(distinct payer) from facilitator_payments where status='settled' and created_at >= '2026-08-24 05:00+00' and created_at < '2026-09-07 05:00+00' and payer not in (select address from internal_wallets);
-- govhub
select status_code, count(*), count(distinct ip_address) from requests where timestamp >= '2026-08-24 05:00+00' and timestamp < '2026-09-07 05:00+00' group by 1;
journalctl -u suverse-pay-api.service --since "2026-08-24 07:00" -o cat | grep -c '"url": "/facilitator/verify"'