Codex vs CoinMarketCap x402 API

Codex 59

Closed service under terms that name Codex Data Inc., last updated 29 October 2026; the SDK is MIT (15 of 30). The privacy policy (effective 29 September 2026) is general, keeps data 'only for as long as is necessary' with no periods, transfers data to the United States, and links no DPA or subprocessor list (10 of 30). The changelog dates deprecations, such as NFT endpoints removed on 31 March 2026 and the transactions fields deprecated on 2 November, with no written deprecation policy or notice period (12 of 20). The terms name Mixpanel, Rollbar and Sentry and the privacy policy says data is processed in the United States; no fuller subprocessor list found (8 of 20). 15+10+12+8 = 45.

CoinMarketCap x402 API 33

Closed service with published API terms from CoinMarketCap OpCo, LLC (15). The terms allow storing data and forbid redistributing it, but say nothing about logging or retaining API requests, and we didn't read the privacy policy (10). The changelog marks v1/simple/price deprecated on 29 July 2026 with no removal date or notice period (8). We found no subprocessor list or data-location statement (0). Not re-read on 1 November apart from the changelog, which still marks /v1/simple/price deprecated with no date. 15 + 10 + 8 + 0 = 33.

Codex 91

The full GraphQL schema, 18,159 lines, is in the MIT SDK repository at src/resources/schema.graphql, updated on 5 November 2026, and introspection is free (25). llms.txt, llms-full.txt and a Markdown twin of every page (10). Reference pages give a one-line purpose per operation, and the API reference intro, the queries-versus-subscriptions page and llms.txt say which operation to use for which job and to batch rather than loop (13 of 20). GraphQL types with enums, input objects and non-null markers, and documented maxima per argument (14 of 15). Examples on every recipe and reference page, and an error table with code, HTTP status, meaning and retry advice (14 of 15). Weekly dated changelog from 26 August 2024 to 2 November 2026 with RSS and dated deprecations (15). 25+10+13+14+14+15 = 91.

CoinMarketCap x402 API 72

An OpenAPI 3.1.1 file is now published at coinmarketcap.com/api/documentation/openapi.json (info version 3.0.3, 110 paths, read on 1 November). It covers the keyed paths the four x402 endpoints mirror, but no /x402/ path, and quotes latest lists only a 200 response, so the contract describes the keyed surface, not the x402 one, as coingecko-x402-api's contract line was read (15 of 25). llms.txt at coinmarketcap.com and Markdown copies of the agent pages, such as ai-agent-hub/x402.md (10). The x402 page names four endpoints and an x402 MCP endpoint and their price, and the reference describes each endpoint. We didn't read every parameter description (12). We didn't check the parameter types for the four x402 paths one by one (9). An error table with 11 codes and messages, from 1001 API_KEY_INVALID to 1011 IP_RATE_LIMIT_REACHED, and the 402 flow is explained (11). Versioned, dated changelog up to v3.0.6 on 9 September 2026 (15). 15 + 10 + 12 + 9 + 11 + 15 = 72.

Codex 85

Hosted lines. Status page at status.codex.io (incident.io) with API, Dashboard and 25 network components and a history page (20). The history from 8 August to 6 November lists an elevated-latency incident on 11 August (balances queries, 42 minutes, labelled degraded performance), a 5xx spike the same day, degraded filterTokens on 12 August, and network delays on Robinhood, BNB, Cronos, Fogo and Solana pricing in late August and September, with none in October or November. All read as partial or degraded, so minor only (20). Per-plan rate limits (5 a second free, 300 on Growth with a 500 burst) and per-request maxima are published (15). 429 TOO_MANY_REQUESTS carries retryAfterSeconds and Retry-After, OVER_CAPACITY says to wait 30 seconds, and the errors page says which codes to retry; writes are limited to webhook and token mutations (15). The pricing page shows '99.9% Uptime SLA' as a headline figure and custom SLAs on Enterprise, with no SLA document found (5 of 10). The API is generally available (10). 20+20+15+15+5+10 = 85.

CoinMarketCap x402 API 77

Atlassian Statuspage at status.coinmarketcap.com with components for the API and pro-api.coinmarketcap.com and for API Payments, all operational on 1 November (20). The front page read on 1 October showed 14 to 28 September with no incidents, and the one read on 1 November shows 18 October to 1 November with no incidents. The history page renders by script, the Atom feed now redirects to an "inactive or private" feed, and robots.txt disallows /api/, so 3 August to 13 September and 29 September to 17 October are unread (10). Published limits, 30 calls a minute per wallet on the x402 endpoints, and on the keyed plans 50 a minute on Basic up to 1,200 on Professional and 1,600 or more on Enterprise, plus monthly credits (15). 429 comes with one of four error codes (minute, daily, monthly, IP), the docs say to wait 60 seconds and to back off exponentially on server errors. No Retry-After. Every call is a read (12). Enterprise carries a 99.95 per cent monthly uptime SLA on the pricing page read on 1 November (10). No beta or preview label on the x402 endpoints. The x402 page says pricing, functions and availability may change without prior notice and recommends the keyed Pro API for production workloads (10). 20 + 10 + 15 + 12 + 10 + 10 = 77.

Codex 80

Closed service. Newest changelog entry 2 November 2026 (30). Weekly entries from 3 August to 2 November, and SDK releases 2.5.10 to 2.5.20 between 28 October and 5 November (20). Public changelog, a Discord, a support address and a status page with a report link; GitHub issue replies were not sampled (10 of 15). Current official TypeScript SDK, no other languages (12 of 15). The SDK repository runs lint and test on pull requests and a release workflow (8 of 10). 30+20+10+12+8 = 80.

CoinMarketCap x402 API 72

The newest changelog entry is still v3.0.6 on 9 September 2026, 53 days before 1 November (20, 30 before, cause time). Two dated changelog entries in the 90 days from 3 August (7 August, 9 September) and SDK releases counted half on 6, 10 and 11 August, 18 September, 23 and 30 October, at least three in all (20). The SDK releases don't set the recency line, because they cover the keyed Pro API, not the x402 paths, and the listing names no packages. A public changelog and support through the developer portal. We didn't test a support reply (10). Official SDKs for TypeScript, Python and Go share one version, 5.0.1 of 30 October 2026, and don't cover the /x402/ paths, read as coingecko-x402-api's (12 of 15, 8 before when they weren't inspected). The three SDK repositories run CI workflows with test suites; their results couldn't be read because GitHub's pages refuse us (10 of 10, 5 before). 20 + 20 + 10 + 12 + 10 = 72.

Codex 49

Secret API keys in a header, never in the URL. Short-lived tokens from createApiTokens with an expiry and a request limit, per-key compute-unit limits and key deactivation. No scopes (22 of 30). The surface is mostly reads; mutations create webhooks and short-lived tokens. No read-only key (12 of 20). Token names, symbols, social links and community notes come from token deployers and other sources, and the docs warn tokens may be scams, with no prompt-injection guidance (5 of 15). The dashboard usage page breaks compute units down by operation, apiUsage reports the period's use and usageData the cost of each request (10 of 15). security.txt returns 404, and no disclosure policy, bug bounty or certification was found on the site or docs (0 of 20). 22+12+5+10+0 = 49.

CoinMarketCap x402 API 55

The x402 paths need no credential, so there's nothing to leak beyond the paying wallet. The keyed API uses one account key in X-CMC_PRO_API_KEY with no scopes. We didn't check rotation or whether a query-string key is still documented (15). Read-only market data with no write actions, and a fixed $0.01 price caps what one call can spend (15). DEX search returns token names and symbols that anyone can set when launching a token, and we found no injection guidance (7). Each x402 payment is an on-chain transfer the payer can audit. We didn't check per-key usage logs (8). The API pricing page, read on 1 November, says the API platform is ISO 27001 and ISO 27701 certified and SOC 1 and SOC 2 attested, on every tier. coinmarketcap.com serves no security.txt, and we found no disclosure policy or bug bounty. Against coingecko-x402-api's 15 for SOC 2 with a bug bounty, certifications alone take 10 (5 before, when none were found). 15 + 15 + 7 + 8 + 10 = 55.

Codex 80

MPP (Machine Payments Protocol) on every query endpoint, paid in USDC on Tempo; subscriptions and webhooks are not covered, and it is not x402 (35 of 40). $0.001 a query through MPP, compute-unit costs per operation, and Growth at $120 per million compute units, all public (20). The Almost free plan's 10,000 compute units need a one-time $1 activation fee by card or 1 USDC, which the terms say confirms a payment method (5 of 20). An agent can pay per query with no account or key (20). 35+20+5+20 = 80.

CoinMarketCap x402 API 85

x402 on CoinMarketCap's own domain for four endpoints (cryptocurrency quotes latest, listings latest, DEX search, DEX pair quotes) and an x402 MCP endpoint at mcp.coinmarketcap.com/x402/mcp, out of the Pro API's 110 documented paths. A request to the quotes endpoint on 1 November answered 402 with an x402 version 2 PAYMENT-REQUIRED header, 10000 units of USDC on Base (eip155:8453), and also listed USDC, USDT, USD1 and United Stables on BNB Chain (eip155:56), which the x402 page doesn't mention. We didn't pay (25). $0.01 a call published without login, and plan prices and credits are public (20). Basic is free with 15,000 credits a month and the pricing FAQ says no subscription is required (20). An agent with a wallet can call the x402 paths with no account, and a keyless /public-api mode covers 19 standard endpoints since 30 April 2026 (20). 25 + 20 + 20 + 20 = 85.