openapi: 3.2.0
info:
  title: Agent Verification Utility Registration API
  version: 0.4.3
  description: A deterministic, x402-paid JSON evidence verification service for external agents. The service attests that declared checks were executed; it does not attest real-world truth.
  license:
    name: UNLICENSED
servers:
- url: /
  description: Relative to the current deployment origin
security: []
tags:
- name: Registration
  description: Optional anonymous, short-lived agent registration
paths:
  /auth.md:
    get:
      operationId: getAuthenticationGuide
      summary: Get agent registration, anonymous-access, and x402 guidance
      description: Explains optional anonymous registration, credential inspection, anonymous service access, per-request x402 authorization, and why OAuth metadata is not published.
      tags:
      - Registration
      responses:
        '200':
          description: Markdown access and payment-authorization guide
          content:
            text/markdown:
              schema:
                type: string
  /agent/register:
    post:
      operationId: registerAnonymousAgent
      summary: Provision an optional anonymous agent registration
      description: Issues a signed service-local bearer receipt valid for 15 minutes. Registration is optional, grants no application access, and does not authorize or replace x402 payment.
      tags:
      - Registration
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties: {}
              additionalProperties: false
            example: {}
      responses:
        '201':
          description: Short-lived anonymous registration receipt
          content:
            application/json:
              schema:
                type: object
                additionalProperties: false
                required:
                - schema_version
                - registration_id
                - agent_id
                - identity_type
                - credential_type
                - token_type
                - credential
                - scope
                - issued_at
                - expires_at
                - claim_uri
                - access
                properties:
                  schema_version:
                    type: string
                    const: agent-economy/anonymous-registration/1.0
                  registration_id:
                    type: string
                  agent_id:
                    type: string
                  identity_type:
                    type: string
                    const: anonymous
                  credential_type:
                    type: string
                    const: urn:kgninja:params:agent-credential:anonymous-registration-receipt
                  token_type:
                    type: string
                    const: Bearer
                  credential:
                    type: string
                    readOnly: true
                  scope:
                    type: string
                    const: registration:read
                  issued_at:
                    type: string
                    format: date-time
                  expires_at:
                    type: string
                    format: date-time
                  claim_uri:
                    type: string
                    format: uri
                  access:
                    type: object
                    additionalProperties: false
                    required:
                    - registration_required_for_free_operations
                    - registration_required_for_paid_execution
                    - paid_execution_authorization
                    properties:
                      registration_required_for_free_operations:
                        type: boolean
                        const: false
                      registration_required_for_paid_execution:
                        type: boolean
                        const: false
                      paid_execution_authorization:
                        type: string
                        const: x402
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '415':
          description: Content-Type must be application/json
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '422':
          $ref: '#/components/responses/Unprocessable'
        '429':
          $ref: '#/components/responses/RateLimited'
        '503':
          $ref: '#/components/responses/Unavailable'
  /agent/registration:
    get:
      operationId: getAnonymousAgentRegistration
      summary: Inspect the caller's anonymous registration claim
      description: 'Validates the short-lived receipt supplied as Authorization: Bearer. The claim confirms only service-local registration and grants neither application access nor payment authorization.'
      tags:
      - Registration
      security:
      - agentRegistration: []
      responses:
        '200':
          description: Active anonymous registration claim
          content:
            application/json:
              schema:
                type: object
                additionalProperties: false
                required:
                - schema_version
                - active
                - registration_id
                - agent_id
                - identity_type
                - credential_type
                - scope
                - issued_at
                - expires_at
                - grants
                properties:
                  schema_version:
                    type: string
                    const: agent-economy/anonymous-registration-claim/1.0
                  active:
                    type: boolean
                    const: true
                  registration_id:
                    type: string
                  agent_id:
                    type: string
                  identity_type:
                    type: string
                    const: anonymous
                  credential_type:
                    type: string
                    const: urn:kgninja:params:agent-credential:anonymous-registration-receipt
                  scope:
                    type: string
                    const: registration:read
                  issued_at:
                    type: string
                    format: date-time
                  expires_at:
                    type: string
                    format: date-time
                  grants:
                    type: object
                    additionalProperties: false
                    required:
                    - application_access
                    - payment_authorization
                    properties:
                      application_access:
                        type: boolean
                        const: false
                      payment_authorization:
                        type: boolean
                        const: false
        '401':
          description: Missing, invalid, or expired registration receipt
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    PaidVerificationBinding:
      type: object
      description: The immutable spend binding. quoted/payment_required have no paid receipt or refusal; refused has a refusal reason and no paid receipt; delivered has a paid receipt and no refusal reason, including when deterministic verification outcome is fail.
      additionalProperties: false
      required:
      - schema_version
      - binding_digest
      - precheck_receipt_digest
      - request_hash
      - evidence_digest
      - policy_version
      - price_cap_atomic
      - quoted_amount_atomic
      - network
      - asset
      - pay_to
      - quote_id
      - expires_at
      - discovery_survived
      - state
      - paid_receipt_id
      - refusal_reason
      properties:
        schema_version:
          type: string
          const: agent-economy/paid-verification-binding/1.0
        binding_digest:
          $ref: '#/components/schemas/Sha256Digest'
        precheck_receipt_digest:
          $ref: '#/components/schemas/Sha256Digest'
        request_hash:
          $ref: '#/components/schemas/Sha256Digest'
        evidence_digest:
          $ref: '#/components/schemas/Sha256Digest'
        policy_version:
          type: string
          const: agent-economy/precheck-policy/2.0
        price_cap_atomic:
          type: string
          maxLength: 16
          pattern: ^[1-9][0-9]*$
        quoted_amount_atomic:
          type: string
          maxLength: 16
          pattern: ^[1-9][0-9]*$
        network:
          type: string
          enum:
          - eip155:84532
          - eip155:8453
        asset:
          type: string
          pattern: ^0x[a-fA-F0-9]{40}$
        pay_to:
          type: string
          pattern: ^0x[a-fA-F0-9]{40}$
        quote_id:
          type: string
          pattern: ^qte_[A-Za-z0-9_-]+$
        expires_at:
          type: string
          format: date-time
        discovery_survived:
          type: boolean
          const: true
        state:
          type: string
          enum:
          - quoted
          - payment_required
          - delivered
          - refused
        paid_receipt_id:
          oneOf:
          - type: string
            pattern: ^rcpt_[A-Za-z0-9_-]+$
          - type: 'null'
        refusal_reason:
          oneOf:
          - type: string
            pattern: ^[A-Z0-9_]+$
          - type: 'null'
      oneOf:
      - properties:
          state:
            enum:
            - quoted
            - payment_required
          paid_receipt_id:
            type: 'null'
          refusal_reason:
            type: 'null'
      - properties:
          state:
            const: delivered
          paid_receipt_id:
            type: string
            pattern: ^rcpt_[A-Za-z0-9_-]+$
          refusal_reason:
            type: 'null'
      - properties:
          state:
            const: refused
          paid_receipt_id:
            type: 'null'
          refusal_reason:
            type: string
            pattern: ^[A-Z0-9_]+$
    Sha256Digest:
      type: string
      pattern: ^sha256:[a-f0-9]{64}$
    ErrorResponse:
      type: object
      additionalProperties: false
      required:
      - error
      properties:
        error:
          type: object
          additionalProperties: false
          required:
          - code
          - message
          - request_id
          - retryable
          properties:
            code:
              type: string
              pattern: ^[A-Z0-9_]+$
            message:
              type: string
            request_id:
              type: string
            retryable:
              type: boolean
            details:
              type: object
              properties:
                paid_verification_binding:
                  $ref: '#/components/schemas/RefusedPaidVerificationBinding'
              additionalProperties: true
    RefusedPaidVerificationBinding:
      allOf:
      - $ref: '#/components/schemas/PaidVerificationBinding'
      - properties:
          state:
            const: refused
  responses:
    Unprocessable:
      description: Syntactically valid but unsupported or non-executable verification request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    RateLimited:
      description: Rate limit exceeded
      headers:
        Retry-After:
          schema:
            type: integer
            minimum: 1
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unavailable:
      description: Kill switch, maintenance, budget exhaustion, facilitator outage, or unavailable cost basis
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    PayloadTooLarge:
      description: Evidence or request body exceeds v1 limits
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    agentRegistration:
      type: http
      scheme: bearer
      bearerFormat: signed anonymous registration receipt
      description: Optional 15-minute service-local receipt used only to inspect its own registration claim. It grants no API access and does not authorize payment.