---
title: "Listed, but serves no payment challenge — x402 defect class no-402"
description: "Listed, but serves no payment challenge (no-402), an x402 defect class: The URL a directory lists answers 402 Payment Required to an unpaid request using a method the resource accepts — the method its catalog, challenge or specification declares, or, where none is declared, a method the endpoint does not refuse as a method. Detectable by an unpaid probe. Every buyer routed here finds no challenge at all. The listing is an advertisement for a door that does not open."
canonical: "https://scvd.store/defects/no-402"
url: "https://scvd.store/defects/no-402"
term_code: "no-402"
defined_in: "https://scvd.store/defects"
data: "https://scvd.store/defects.json"
vocabulary_version: "22"
license: "https://creativecommons.org/licenses/by/4.0/"
---

# Listed, but serves no payment challenge

`no-402` — an x402 defect class.

**Asserts:** The URL a directory lists answers 402 Payment Required to an unpaid request using a method the resource accepts — the method its catalog, challenge or specification declares, or, where none is declared, a method the endpoint does not refuse as a method.

**Costs:** Every buyer routed here finds no challenge at all. The listing is an advertisement for a door that does not open.

**Detectable:** unpaid — a free probe can see it

**Falsified by:** The same URL answering 402 with a parseable challenge to an unauthenticated request, by ANY HTTP method, at the stated moment. A 405 or 501 to the probing instrument's method falsifies a finding of this class outright: a method refusal is an observation about the request, not about the challenge, and an instrument that reports this class without having tried a method the door accepts has published a claim it has no evidence for. A 402 that appears only for some callers is a different finding, not this one.

**How an operator clears it:** Serve 402 with a PAYMENT-REQUIRED challenge at the exact URL your listing names. The commonest causes are a listing that points at a marketing page instead of the paid resource, and a proxy or CDN answering before your x402 middleware does. If the door moved, update the listing. If your door takes POST rather than GET, both halves of RFC 9110 §15.5.6 are worth serving on the refusal — the 405 AND an Allow header naming the method — because an indexer or preflight that reads Allow finds your door on the first try, and one that does not will keep asking the wrong question.

**What a buyer does:** Do not pay, and do not retry with money: there is no challenge to sign against. Treat the listing as pointing somewhere other than the paid resource; if you hold a different URL for the same service, preflight that one instead.

**Our signal:** `status-402`

---

Vocabulary v22, CC BY 4.0. Every class: https://scvd.store/defects. Machine-readable, with falsifiers and cross-instrument mappings: https://scvd.store/defects.json.

A class describes a property of one endpoint at one moment and never accumulates into a judgment on an operator.