UCP manifest (/.well-known/ucp)

What the scanner requests

• /.well-known/ucp
• /.well-known/ucp.json

It also reads documents it has already fetched: $home.

What is measured

Conditional: reported n/a unless the scanner has already detected a commercial signal (Product/Offer JSON-LD, add-to-cart or buy-now copy, a cart/checkout link). It requests /.well-known/ucp and then /.well-known/ucp.json, takes the first HTTP 200 and passes when that body parses as JSON with at least two of the top-level keys protocol_version, merchant, capabilities and checkout; valid JSON with fewer than two of those keys is a partial (0.5), and a missing or non-JSON response fails.

Reproduce it yourself

You do not have to take our word for any of this. Run the same measurement against your own domain:

              DOMAIN=shop.example.com
curl -sL "https://$DOMAIN/.well-known/ucp" | jq '{protocol_version, merchant, capabilities, checkout}'
            

The fix

This is the artifact to ship. It is the complete change, not a description of one.

              {
  "protocol_version": "1.0",
  "merchant": {
    "id": "shop.example.com",
    "name": "Example Shop",
    "url": "https://shop.example.com",
    "country": "US",
    "currency": "USD"
  },
  "capabilities": {
    "catalog_search": true,
    "product_detail": true,
    "cart": true,
    "checkout": true
  },
  "checkout": {
    "endpoint": "https://shop.example.com/api/ucp/checkout",
    "states": ["Incomplete", "RequiresEscalation", "ReadyForComplete"],
    "payment_handlers": ["ap2", "acp", "x402"]
  },
  "updated_at": "2026-10-08T00:00:00Z"
}
            

Related checks