Skip to main content

OACP Artifact Authority

Canonical end-to-end flow: OACP authority overview. Grantex authority is exposed through POST /v1/commerce/oacp/c6z/authority-requests. The route accepts an AgenticOrg seller authority request and public-safe connector evidence, validates scope, and returns issued artifacts or a refusal.

Artifact Families

FamilyPurpose
merchant_profileMerchant identity and public profile evidence.
seller_agent_cardSeller Commerce Agent identity and runtime boundary.
connector_evidencePublic-safe source evidence from AgenticOrg connector custody.
catalog_snapshotProduct catalog facts from Shopify or merchant source.
offer_price_snapshotPrice and offer facts with freshness metadata.
inventory_snapshotInventory/availability facts with source time.
policy_scopeMerchant and Grantex policy boundaries.
public_discovery_stateWhether buyer-safe discovery may be shown.
mandate_capabilityProvider-owned capability evidence requirement and state.
protocol_adapterCompatibility mapping metadata.
authority_request_statusRequest result and blocker state.

Verification Rules

Artifacts must carry issuer, issuer key, artifact type, issued/expires timestamps, payload hash, signature algorithm, source refs, freshness metadata, revocation posture, risk tier, and no_checkout_payment_enablement behavior. Payloads must not contain raw connector payloads, tokens, provider secrets, card or bank data, checkout URLs, payment URLs, executable targets, or private merchant data.

Pending Runtime Gap

Detached signature verification and key governance are implemented internally, but external public key distribution, rotation policy publication, and partner acceptance remain approval work before external program launch.