{"version":"1","api":{"current":"2026-09-23","supported":["2026-09-23"],"deprecation_notice_days":180,"note":"Dated, not numbered. Additive changes — a new result field, a new refusal field — ship without a new version; a removal or a changed meaning gets one, and the version it replaces keeps answering for 180 days after the successor ships."},"idempotency":{"supported":true,"parameter":"params.idempotency_key","max_length":200,"scope":"per agent","retention_hours":6,"not_stored_for":["search","read-item","order-status"],"replay_marker":"replayed","note":"A repeat of the same call with the same key returns the first answer, marked `replayed: true`. The same key with different arguments is refused with `idempotency-conflict` rather than answered — returning the first result for a second, different request would answer a question nobody asked. Refusals are not stored, so correcting your arguments and retrying with the same key works."},"events":{"supported":true,"declared_in":"agent profile: callback_url","delivery":"POST, at least once, retried with backoff","max_attempts":6,"backoff_seconds":[10,30,120,300,900,1800],"signature":{"header":"x-openstore-signature","key_id_header":"x-openstore-key-id","algorithm":"Ed25519 over the canonical body","verify_with":"/.well-known/jwks.json"},"kinds":["order.pending","order.confirmed","order.paid","order.cancelled","order.expired","order.failed","order.refunded","order.completed"],"note":"At least once, so deduplicate on `event_id`. The body carries an order id, a kind and a receipt id — never PII and never a total; call `order-status` with your own token for anything more. Answer 410 to stop delivery: it parks after 6 failed attempts."},"merchant":{"name":"SpoiledDuckie","domain":"spoiledduckie.localhost","description":"Bags and small leather accessories — totes, pouches, straps and card holders.","categories":["accessories","bags"],"note":"Declared by this Merchant and verified by no one. A hint for deciding which shops to ask first, never grounds for concluding a shop does not stock something — only a search can establish that."},"demo":true,"endpoints":{"mcp":"https://delphi.taile9aacb.ts.net/agent/mcp","tools":"https://delphi.taile9aacb.ts.net/agent/tools","register":"https://delphi.taile9aacb.ts.net/agent/register","token":"https://delphi.taile9aacb.ts.net/agent/token","feed":"https://delphi.taile9aacb.ts.net/agent/feed.json","ucp_checkout":"https://delphi.taile9aacb.ts.net/agent/ucp/checkout","acp_checkout_sessions":"https://delphi.taile9aacb.ts.net/agent/acp/checkout_sessions","ap2_checkout":"https://delphi.taile9aacb.ts.net/agent/ap2/checkout","approve":"https://delphi.taile9aacb.ts.net/agentic/approve","jwks":"https://delphi.taile9aacb.ts.net/.well-known/jwks.json"},"protocols":["mcp","ucp","ap2","acp"],"scopes":["search","build-basket","start-checkout","confirm"],"admission":{"self_registration":true,"oauth_client_credentials":true,"signature":"RFC 9421 over @method, @target-uri and content-digest","agent_id":"RFC 7638 JWK thumbprint"},"authority":{"kinds_accepted":["confirmed-intent","passkey","upi-pin"],"completion":"redirect-only","note":"Every spend terminates in a fresh human Authority at the approve URL on this domain. An agent may build a basket; it may not spend."},"payment":{"methods_enabled":["cash-on-delivery","upi"],"delegated_credentials":"refused","note":"This Merchant does not accept agent-held payment credentials. Their absence is deliberate (ADR-0008, ADR-0013), not unimplemented."},"limits":{"currency":"INR","window_open":true,"per_order_cap_minor":2500000,"per_order_line_count":10,"per_group_qty":5,"per_group_qty_overrides":1,"blocked_tag_rules":1,"note":"Enforced by the Gate on every basket. An agent that plans inside these spends no round trips discovering them; exceeding one is refused with a named code and never silently trimmed."},"requires":{"destination":{"fields":[{"name":"line1","required":true},{"name":"line2","required":false},{"name":"city","required":true},{"name":"state","required":true,"pattern":"^[A-Z]{2}$"},{"name":"postal_code","required":true,"pattern":"^[0-9]{6}$"},{"name":"country","required":false,"default":"IN"}]},"contact":{"any_of":["email","phone"],"note":"A Contact Point is an email, a phone, or both — and one is needed."},"order":["lines","destination","details","fulfillment"],"note":"Fill these in this order. Changing the basket un-chooses fulfillment, so an option picked before the last line went in has to be picked again.","details":{"fields":[{"name":"delivery_slot","required":false,"label":"Delivery slot","description":"When should the rider arrive? Morning 8–12, afternoon 12–4, evening 4–8.","values":["morning","afternoon","evening"]},{"name":"delivery_instructions","required":false,"label":"Delivery instructions","description":"Gate code, floor, landmark — anything the rider needs. 500 chars max."}],"note":"Set with set-details, in pieces if needed. Required keys must hold before checkout."}},"conformance":[{"protocol":"mcp","shape":"envelope","version":"as carried on main","rides_on":null,"capability":"supported","completion":"redirect-only","payment_instruments_enabled":["cash-on-delivery","upi"],"deviations":["Completion is redirect-only: every spend terminates in a fresh human Authority at /agentic/approve on the Merchant's own domain.","Agent-held delegated payment credentials are refused by design, not unimplemented (ADR-0008, ADR-0013)."]},{"protocol":"ucp","shape":"envelope","version":"as carried on main","rides_on":null,"capability":"supported","completion":"redirect-only","payment_instruments_enabled":["cash-on-delivery","upi"],"deviations":["Completion is redirect-only: every spend terminates in a fresh human Authority at /agentic/approve on the Merchant's own domain.","Agent-held delegated payment credentials are refused by design, not unimplemented (ADR-0008, ADR-0013).","direct-checkout-inside-AI completion: Completion is a same-domain approve handoff, which is UCP's own buyer escalation path rather than a deviation from it. Every spend terminates in a fresh Authority at /agentic/approve."]},{"protocol":"ap2","shape":"layer","version":"main @ 2026-09-20","rides_on":"ucp","capability":"supported","completion":"redirect-only","payment_instruments_enabled":["cash-on-delivery","upi"],"deviations":["Completion is redirect-only: every spend terminates in a fresh human Authority at /agentic/approve on the Merchant's own domain.","Agent-held delegated payment credentials are refused by design, not unimplemented (ADR-0008, ADR-0013).","Human Not Present (Autonomous): Autonomous mode is the `mandate` Authority kind, which is defined, registered and refused in v1 (ADR-0017). Human Present (Direct) completes through the approve ceremony, which is the Trusted Surface AP2's own specification describes."]},{"protocol":"acp","shape":"envelope","version":"2026-04-17","rides_on":null,"capability":"supported","completion":"redirect-only","payment_instruments_enabled":["cash-on-delivery","upi"],"deviations":["Completion is redirect-only: every spend terminates in a fresh human Authority at /agentic/approve on the Merchant's own domain.","Agent-held delegated payment credentials are refused by design, not unimplemented (ADR-0008, ADR-0013).","completeCheckoutSession: POST /checkout_sessions/{id}/complete hands the merchant a delegated payment credential (a Shared Payment Token or a vault token). That is exactly the authority we removed from agents (ADR-0008, ADR-0013), so the step is refused with a named code and an approve URL. The other four operations work normally."]}]}