MPP discovery in OpenAPI (x-payment-info)

Sources

• MPP, mpp.dev
• MPP: multi-method discovery, mpp.dev
• draft-ryan-httpauth-payment, IETF (individual draft)
• isitagentready.com: MPP skill, isitagentready.com

What is measured

Unscored, agent-api module: asked only when the scan finds an API or agent surface. It makes no request of its own. It reads the OpenAPI description the scan already holds, the one the openapi check reads, and every operation under paths (get, put, post, delete, options, head, patch, and trace). An operation declares MPP payment information in x-payment-info. An offer states an intent (charge or session), a method (tempo, stripe, lightning, card, or custom), and an amount. An amount is a number or a numeric string, and null reads as a price set per request. A single offer, an array of offers, an offers array or object, and an object keyed by method all count. A description with at least one operation that has a valid offer is present, and the detail names up to 5 such operations with the intent and method of each offer. When no operation has a valid offer and some carry x-payment-info, it is defective, and the detail names each operation and what is wrong. A description whose operations declare no x-payment-info is not used. A YAML description is not parsed: one that does not mention x-payment-info is not used, and one that does is not measured. With no OpenAPI description the check is out of scope, and when a candidate path refused the scan's Accept header, an HTTP 406, it is not measured. MPP is a draft, so the check is unscored.

Reproduce it yourself

You do not have to take our word for any of this. Run the same measurement against your own domain:

              ORIGIN=https://example.com
# The scan reads the OpenAPI description it already holds. /openapi.json is the usual path; use the path your description is served at.
curl -sSL -A 'AgenticWebScore/0.3 (+https://agenticwebscore.com/bot)' -H 'Accept-Language: en' -H 'Accept: application/json, application/linkset+json;q=0.9, */*;q=0.5' "$ORIGIN/openapi.json" | jq -c '[.paths | to_entries[] | .key as $p | .value | to_entries[] | select(.value | type == "object" and has("x-payment-info")) | {operation: ((.key | ascii_upcase) + " " + $p), "x-payment-info": .value["x-payment-info"]}]'
            

The fix

This is an example written for example.com. Where the scan can build the fix from your own site, the report shows that version instead.

              {
  "paths": {
    "<choose: path of the paid operation>": {
      "<choose: HTTP method in lower case>": {
        "x-payment-info": {
          "intent": "charge",
          "method": "<choose: tempo, stripe, lightning, card, or custom>",
          "amount": "<choose: the price in the base unit of that method>"
        }
      }
    }
  }
}
            

Standards referenced

• MPP
• OpenAPI 3.x

Related checks