generated: '2026-09-02' method: probed source: https://upway.co/.well-known/ucp name: Upway Standards Conformance description: >- Cross-cutting and domain standards asserted by Upway's own contracts. Every row cites a document served from an Upway host or a live response from an Upway endpoint; where the evidence is a discovery document that Upway serves but a platform generates, that is said explicitly rather than glossed. Absence is recorded as conforms false with the reason, not omitted. conformance: - id: mcp name: Model Context Protocol conforms: true version: '2024-11-05' evidence: url: https://upway.co/api/ucp/mcp status: 200 detail: >- JSON-RPC initialize returned protocolVersion 2024-11-05 with serverInfo universal-commerce 0.1.0 and capabilities for tools, prompts, resources and logging. tools/list returned 13 tools, each with a JSON Schema 2020-12 inputSchema. Saved verbatim to mcp/upway-mcp-tools.json. - id: json-rpc-2.0 name: JSON-RPC 2.0 conforms: true evidence: url: https://upway.co/api/ucp/mcp status: 200 detail: All responses carry jsonrpc "2.0" with a matching id and a result member. - id: json-schema-2020-12 name: JSON Schema draft 2020-12 conforms: true evidence: artifact: mcp/upway-mcp-tools.json detail: >- Every tool inputSchema declares $schema https://json-schema.org/draft/2020-12/schema, and the checkout schemas use allOf/if/then/else conditional composition for payment-handler-specific credential requirements. - id: oidc name: OpenID Connect Discovery 1.0 conforms: true evidence: url: https://upway.co/.well-known/openid-configuration status: 200 detail: >- Complete discovery document: issuer, authorization_endpoint, token_endpoint, jwks_uri, end_session_endpoint, scopes_supported, response_types_supported, subject_types_supported, id_token_signing_alg_values_supported, claims_supported. - id: oauth2 name: OAuth 2.0 conforms: true evidence: url: https://upway.co/.well-known/oauth-authorization-server status: 200 detail: >- Authorization code grant with refresh_token and jwt-bearer, PKCE S256 required (code_challenge_methods_supported). - id: rfc8414 name: RFC 8414 OAuth 2.0 Authorization Server Metadata conforms: true evidence: url: https://upway.co/.well-known/oauth-authorization-server status: 200 - id: rfc9728 name: RFC 9728 OAuth 2.0 Protected Resource Metadata conforms: true evidence: url: https://upway.co/.well-known/oauth-protected-resource status: 200 detail: >- resource https://upway.co, authorization_servers [https://shopify.com/authentication/65864040675], bearer_methods_supported [header]. This is the document that makes the split between Upway as the protected resource and Shopify as its authorization server machine-readable. - id: rfc8615 name: RFC 8615 Well-Known URIs conforms: true evidence: artifact: well-known/upway-well-known.yml detail: Four /.well-known/ documents served with 200 on upway.co. - id: llms-txt name: llms.txt agent instructions conforms: true evidence: url: https://upway.co/llms.txt status: 200 content_type: text/markdown; charset=utf-8 detail: >- Served on all six live storefront hosts (upway.co, .fr, .de, .be, .nl, .es, .it) and mirrored at /agents.md, which is itself listed in a dedicated sitemap_agentic_discovery.xml. - id: idempotency name: Idempotent write semantics conforms: true evidence: artifact: mcp/upway-mcp-tools.json detail: >- complete_checkout requires meta.idempotency-key in its inputSchema. See conventions/upway-conventions.yml. - id: rfc9457 name: RFC 9457 Problem Details for HTTP APIs conforms: false evidence: detail: >- Not applicable in practice - the surface is JSON-RPC over POST, so application errors are returned in the JSON-RPC error member rather than as application/problem+json. - id: pagination name: Documented pagination contract conforms: true evidence: artifact: mcp/upway-mcp-tools.json detail: >- search_catalog declares cursor pagination in its inputSchema (catalog.pagination.cursor, catalog.pagination.limit). Partial: the response field carrying the next cursor is not published, so the return half of the contract is undocumented. - id: a2a name: A2A Agent Card conforms: false evidence: url: https://upway.co/.well-known/agent-card.json status: 404 detail: Also 404 at the legacy /.well-known/agent.json path. No agent card is served. - id: openapi name: OpenAPI conforms: false evidence: url: https://upway.co/openapi.json status: 404 detail: >- No OpenAPI is published on any Upway host. The machine-readable contract for this provider is the MCP tools/list schema set, not a REST description. domain_standards: - id: ucp name: Universal Commerce Protocol (UCP) market: agent-driven retail commerce version: '2026-08-25' spec: https://ucp.dev/2026-08-25/specification/overview/ conforms: true declared_in_contract: true evidence: url: https://upway.co/.well-known/ucp status: 200 artifact: well-known/upway-ucp.json location: >- The merchant profile itself. ucp.version 2026-08-25 with supported_versions for 2026-04-08 and 2026-01-23; services["dev.ucp.shopping"] declaring transport "mcp" and its OpenRPC schema; and a capabilities map keyed on the protocol's own URNs. capabilities_declared: - dev.ucp.shopping.cart - dev.ucp.shopping.checkout - dev.ucp.shopping.fulfillment - dev.ucp.shopping.discount - dev.ucp.shopping.order - dev.ucp.shopping.catalog.search - dev.ucp.shopping.catalog.lookup - dev.shopify.catalog payment_handlers_declared: - com.google.pay - dev.shopify.card - dev.shopify.shop_pay tool_names_match_spec: >- The 13 live tool names (search_catalog, lookup_catalog, get_product, create_cart, get_cart, update_cart, cancel_cart, create_checkout, get_checkout, update_checkout, complete_checkout, cancel_checkout, get_order) are the UCP shopping service's own operation names, not vendor-specific ones - which is the point of the standard: an agent that speaks UCP integrates with no bespoke connector. note: >- This is a contract-level declaration, not a marketing claim. The conformance is machine-checkable from the merchant profile and confirmed against the live tool list. - id: ucp-payment-handler name: UCP Payment Handler profiles conforms: true evidence: artifact: well-known/upway-ucp.json location: payment_handlers detail: >- Three handlers declared with version, spec URI, schema URI and config, including Google Pay API v2 tokenization parameters and the Shop Pay shop_id. Each names its own versioned spec. not_applicable: - id: fhir reason: Not a healthcare provider. - id: fapi reason: Not a financial-grade API; Upway is a retailer, not a regulated financial institution. - id: psd2 reason: Upway is a merchant, not a payment service provider. Card and wallet handling is delegated to declared payment handlers. - id: scim reason: No identity-provisioning surface. - id: odata reason: No OData surface. - id: 'json:api' reason: The transport is JSON-RPC, not a REST hypermedia profile. compliance_certifications: published: false note: >- No trust center, SOC 2 / ISO 27001 / PCI attestation page or certification list was found on any Upway host. See security/ for what was probed. No Compliance pointer is emitted, because Upway publishes no compliance program to point at. x-evidence: fetched: '2026-09-02' urls: - url: https://upway.co/.well-known/ucp status: 200 - url: https://upway.co/api/ucp/mcp status: 200 - url: https://upway.co/.well-known/openid-configuration status: 200 - url: https://upway.co/.well-known/oauth-protected-resource status: 200 - url: https://upway.co/openapi.json status: 404 - url: https://upway.co/.well-known/agent-card.json status: 404