agentic-payments 0.1.0

Autonomous multi-agent Ed25519 signature verification with Byzantine fault tolerance
Documentation
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
openapi: 3.1.0
info:
  title: Agentic Commerce — Delegate Payment API
  version: "2025-09-29"
  description: |
    Delegate a payment using a provided payment method and allowance.
servers:
  - url: https://merchant.example.com
security:
  - bearerAuth: []
tags:
  - name: DelegatePayment
    description: Create delegated payment tokens
paths:
  /agentic_commerce/delegate_payment:
    post:
      tags: [DelegatePayment]
      summary: Create a delegated payment token
      operationId: delegatePayment
      description: |
        Tokenizes a credential for controlled usage by the merchant's PSP per the **Allowance** constraints.
        Exactly one credential type is currently supported: **card**.
      parameters:
        - $ref: "#/components/parameters/Authorization"
        - $ref: "#/components/parameters/ContentType"
        - $ref: "#/components/parameters/AcceptLanguage"
        - $ref: "#/components/parameters/UserAgent"
        - $ref: "#/components/parameters/IdempotencyKey"
        - $ref: "#/components/parameters/RequestId"
        - $ref: "#/components/parameters/Signature"
        - $ref: "#/components/parameters/Timestamp"
        - $ref: "#/components/parameters/APIVersion"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DelegatePaymentRequest"
            examples:
              card_success:
                summary: Card (FPAN) — success
                value:
                  payment_method:
                    type: card
                    card_number_type: fpan
                    number: "4242424242424242"
                    exp_month: "11"
                    exp_year: "2026"
                    name: "Jane Doe"
                    cvc: "223"
                    checks_performed: ["avs", "cvv"]
                    iin: "424242"
                    display_card_funding_type: credit
                    display_brand: "visa"
                    display_last4: "4242"
                    metadata: { "issuing_bank": "temp" }
                  allowance:
                    reason: one_time
                    max_amount: 2000
                    currency: usd
                    checkout_session_id: "csn_01HV3P3..."
                    merchant_id: "acme"
                    expires_at: "2025-10-09T07:20:50.52Z"
                  billing_address:
                    name: "John Doe"
                    line_one: "123 Fake St."
                    line_two: "Unit 1"
                    city: "San Francisco"
                    state: "CA"
                    country: "US"
                    postal_code: "12345"
                  risk_signals:
                    - type: card_testing
                      score: 10
                      action: manual_review
                  metadata: { "campaign": "q4" }
      responses:
        "201":
          description: Created
          headers:
            Request-Id:
              description: Echo of the request correlation ID
              schema: { type: string }
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/DelegatePaymentResponse"
              examples:
                created:
                  value:
                    id: "vt_01J8Z3WXYZ9ABC"
                    created: "2025-09-29T11:00:00Z"
                    metadata:
                      source: "agent_checkout"
                      merchant_id: "acme"
                      idempotency_key: "idem_abc123"
        "400":
          description: Bad Request
          content:
            application/json:
              schema: { $ref: "#/components/schemas/Error" }
              examples:
                invalid_request_missing_field:
                  value:
                    error:
                      type: invalid_request
                      code: invalid_card
                      message: "card field is required when payment_method.type=card"
                      param: "payment_method.number"
        "401":
          description: Unauthorized
          content:
            application/json:
              schema: { $ref: "#/components/schemas/Error" }
              examples:
                unauthorized:
                  value:
                    error:
                      type: unauthorized
                      code: unauthorized
                      message: "Unauthorized"
        "409":
          description: Idempotency conflict
          content:
            application/json:
              schema: { $ref: "#/components/schemas/Error" }
              examples:
                idem_conflict:
                  value:
                    error:
                      type: invalid_request
                      code: idempotency_conflict
                      message: "Same Idempotency-Key used with different parameters"
        "422":
          description: Semantic validation error
          content:
            application/json:
              schema: { $ref: "#/components/schemas/Error" }
              examples:
                invalid_request:
                  value:
                    error:
                      type: invalid_request
                      code: invalid_card
                      message: "Invalid card expiration month"
                      param: "payment_method.exp_month"
        "429":
          description: Rate limit exceeded
          content:
            application/json:
              schema: { $ref: "#/components/schemas/Error" }
              examples:
                rate_limit_exceeded:
                  value:
                    error:
                      type: rate_limit_exceeded
                      code: rate_limit_exceeded
                      message: "Rate limit exceeded"
        "500":
          description: Processing error
          content:
            application/json:
              schema: { $ref: "#/components/schemas/Error" }
              examples:
                internal_server_error:
                  value:
                    error:
                      type: internal_server_error
                      code: internal_server_error
                      message: "Internal server error"
        "503":
          description: Service unavailable
          content:
            application/json:
              schema: { $ref: "#/components/schemas/Error" }
              examples:
                service_unavailable:
                  value:
                    error:
                      type: service_unavailable
                      code: service_unavailable
                      message: "Service unavailable"

components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: API Key

  parameters:
    Authorization:
      name: Authorization
      in: header
      required: true
      schema:
        type: string
        example: "Bearer api_key_123"
    ContentType:
      name: Content-Type
      in: header
      required: true
      schema:
        type: string
        example: "application/json"
    AcceptLanguage:
      name: Accept-Language
      in: header
      required: false
      schema:
        type: string
        example: "en-us"
    UserAgent:
      name: User-Agent
      in: header
      required: false
      schema:
        type: string
        example: "ChatGPT/2.0"
    IdempotencyKey:
      name: Idempotency-Key
      in: header
      required: false
      schema:
        type: string
        example: "idem_abc123"
    RequestId:
      name: Request-Id
      in: header
      required: false
      schema:
        type: string
        example: "req_123"
    Signature:
      name: Signature
      in: header
      required: false
      schema:
        type: string
        example: "ZXltZX..." # detached signature over canonical JSON
    Timestamp:
      name: Timestamp
      in: header
      required: false
      schema:
        type: string
        format: date-time
        example: "2025-09-29T10:30:00Z"
    APIVersion:
      name: API-Version
      in: header
      required: true
      schema:
        type: string
        example: "2025-09-29"

  schemas:
    DelegatePaymentRequest:
      type: object
      additionalProperties: false
      properties:
        payment_method:
          $ref: "#/components/schemas/PaymentMethodCard"
        allowance:
          $ref: "#/components/schemas/Allowance"
        billing_address:
          $ref: "#/components/schemas/Address"
        risk_signals:
          type: array
          minItems: 1
          items: { $ref: "#/components/schemas/RiskSignal" }
        metadata:
          type: object
          additionalProperties: { type: string }
      required: [payment_method, allowance, risk_signals, metadata]

    PaymentMethodCard:
      type: object
      additionalProperties: false
      properties:
        type:
          type: string
          enum: [card]
        card_number_type:
          type: string
          enum: [fpan, network_token]
        number:
          type: string
          description: "network token or fallback fpan value"
        exp_month:
          type: string
          maxLength: 2
        exp_year:
          type: string
          maxLength: 4
        name:
          type: string
        cvc:
          type: string
          maxLength: 4
        cryptogram:
          type: string
        eci_value:
          type: string
          maxLength: 2
        checks_performed:
          type: array
          items:
            type: string
            enum: [avs, cvv, ani, auth0]
        iin:
          type: string
          maxLength: 6
        display_card_funding_type:
          type: string
          enum: [credit, debit, prepaid]
        display_wallet_type:
          type: string
        display_brand:
          type: string
        display_last4:
          type: string
          maxLength: 4
        metadata:
          type: object
          additionalProperties: { type: string }
      required: [type, card_number_type, number, display_card_funding_type, metadata]

    Address:
      type: object
      additionalProperties: false
      properties:
        name: { type: string, maxLength: 256 }
        line_one: { type: string, maxLength: 60 }
        line_two: { type: string, maxLength: 60 }
        city: { type: string, maxLength: 60 }
        state: { type: string }
        country:
          {
            type: string,
            minLength: 2,
            maxLength: 2,
            description: "ISO-3166-1 alpha-2",
          }
        postal_code: { type: string, maxLength: 20 }
      required: [name, line_one, city, state, country, postal_code]

    Allowance:
      type: object
      additionalProperties: false
      properties:
        reason:
          type: string
          enum: [one_time]
        max_amount:
          type: integer
          description: "Minor units (e.g., $20 → 2000)"
        currency:
          type: string
          pattern: "^[a-z]{3}$"
          description: "ISO-4217 lowercase (e.g., usd)"
        checkout_session_id:
          type: string
        merchant_id:
          type: string
          maxLength: 256
        expires_at:
          type: string
          format: date-time
      required:
        [
          reason,
          max_amount,
          currency,
          checkout_session_id,
          merchant_id,
          expires_at,
        ]

    RiskSignal:
      type: object
      additionalProperties: false
      properties:
        type:
          type: string
          enum: [card_testing]
        score:
          type: integer
        action:
          type: string
          enum: [blocked, manual_review, authorized]
      required: [type, score, action]

    DelegatePaymentResponse:
      type: object
      additionalProperties: false
      properties:
        id:
          type: string
          description: "Unique vault token identifier (vt_...)"
        created:
          type: string
          format: date-time
        metadata:
          type: object
          additionalProperties: { type: string }
      required: [id, created, metadata]

    Error:
      type: object
      additionalProperties: false
      properties:
        type:
          type: string
          enum:
            [
              invalid_request,
              rate_limit_exceeded,
              processing_error,
              service_unavailable,
            ]
        code:
          type: string
          enum: [invalid_card, duplicate_request, idempotency_conflict]
        message:
          type: string
        param:
          type: string
          description: "JSONPath of offending field"
      required: [type, code, message]