ACP discovery (/.well-known/acp.json)

Sources

• ACP discovery RFC (status: Proposal), Agentic Commerce Protocol
• isitagentready.com: ACP skill, isitagentready.com

What the scanner requests

• /.well-known/acp.json

What is measured

Unscored, commerce module: asked only when the homepage shows a commercial signal. It reads /.well-known/acp.json, once, as a JSON document. An ACP discovery document is a JSON object with a protocol member that names "acp" and states a version, an api_base_url that is an absolute http or https URL, a transports array that is not empty, and a capabilities.services array that is not empty. A document with all of these is present. A 2xx answer that is not JSON and is no page is defective. So is JSON that lacks any of these members or states one wrongly, and the detail names each member it lacks and each it states wrongly. The document is not served when the path answers 404, 410, or another 4xx status that is not a refusal, when a 2xx answer has an empty body, or when only a page answers there: an HTML page, a markdown page, a redirect to the homepage, or a copy of it. It is not measured when the path was refused (HTTP 401, 402, 403, 406, 429, or 451, where 406 refuses the scan's Accept header), failed with a server error, timed out, or was not requested. The discovery RFC has the status Proposal, so the check is unscored.

Reproduce it yourself

You do not have to take our word for any of this. Run the same measurement against your own domain:

              ORIGIN=https://example.com
curl -sSL -A 'AgenticWebScore/0.3 (+https://agenticwebscore.com/bot)' -H 'Accept-Language: en' -H 'Accept: application/json, application/linkset+json;q=0.9, */*;q=0.5' "$ORIGIN/.well-known/acp.json" | jq '{protocol, api_base_url, transports, services: .capabilities.services}'
            

The fix

This is an example written for example.com. Where the scan can build the fix from your own site, the report shows that version instead.

              {
  "protocol": {
    "name": "acp",
    "version": "<choose: the ACP version you implement, YYYY-MM-DD>"
  },
  "api_base_url": "https://example.com<choose: path of your ACP API>",
  "transports": [
    "<choose: a transport your ACP API offers>"
  ],
  "capabilities": {
    "services": [
      "<choose: a service your ACP API offers, such as checkout>"
    ]
  }
}
            

Standards referenced

• ACP

Related checks