# Gateway protocol connections Connect to public product discovery without creating an order or authorizing spending. Start with https://gatewayinformationgroup.com/api/agents/connections for the current interface map. For A2A and UCP catalog operations, allow at least 50 seconds for a discovery response. The server response deadline is 45 seconds; upstream reads retain their own limits. Respect `Retry-After` on temporary availability errors rather than immediately repeating the request. ## A2A product search Read https://gatewayinformationgroup.com/.well-known/agent-card.json. Send an A2A 1.0 JSON-RPC `SendMessage` to https://gatewayinformationgroup.com/api/agents/a2a with one `ROLE_USER` message, a fresh `messageId` and one text part containing a general product query such as `webhook`. Use `Content-Type: application/json` and `A2A-Version: 1.0`. Queries are limited to 200 characters. Responses are direct `ROLE_AGENT` messages, not persisted tasks. No streaming, push notifications, model processing or payment actions are exposed. ## MCP connection card Read https://gatewayinformationgroup.com/agent/mcp-server-card.json, also listed in https://gatewayinformationgroup.com/.well-known/ai-catalog.json. The card describes the existing OAuth-protected remote MCP server. Connect using its advertised endpoint and a supported protocol version; authorization and runtime discovery remain authoritative. Reading the public card does not grant access. ## UCP catalog Read https://gatewayinformationgroup.com/.well-known/ucp for the catalog service. The initial catalog access policy admits the published, prevalidated anonymous client profile at https://gatewayinformationgroup.com/agent/ucp-client-profile.json. Use `UCP-Agent: profile="https://gatewayinformationgroup.com/agent/ucp-client-profile.json"`, a non-sensitive `Request-Id`, and `Content-Type: application/json`. POST JSON to `/api/ucp/catalog/search` with a `query`; follow returned pagination cursors. POST `{"ids":["webhook-event-check"]}` to `/api/ucp/catalog/lookup`, or `{"id":"webhook-event-check"}` to `/api/ucp/catalog/product`. Prices use minor currency units. Each product ID is also its sole variant ID; these digital offers have no selectable variant axes. Unapproved profile URLs fail closed and are not fetched. Use ordinary HTTP discovery or connected MCP if your client needs a different profile; partner profiles require review. Selecting a public profile does not authenticate a caller or grant purchase permission. The restricted registry also admits the exact public profile URI `https://ucpplayground.com/.well-known/ucp-agent`, using a captured copy validated against the official 2026-08-25 platform schema. Only its compatible catalog search and lookup declarations are selected; checkout, identity, keys and payment declarations are not activated. This is not provider certification or proof the caller represents that platform. Its review expires on **November 5, 2026 at 21:58:18 UTC**; expiry returns `503 profile_review_expired` with `Retry-After: 300`, without an automatic fetch or renewal. The Gateway template remains available without that external-review expiry. Read `/api/agents/connections` for exact review metadata. Arbitrary remote-profile resolution remains unavailable. The catalog also accepts bounded, optional coarse context strings: `address_country`, `address_region`, `language`, `currency` and `intent`. These are compatibility hints, not authenticated identity, localized pricing, currency conversion or eligibility checks. Only USD is supported; price filters require an explicit USD context. Country codes use two uppercase letters, regions are short non-identifying labels, language tags use the supported BCP-47-shaped subset, and intent is a non-sensitive description up to 200 characters. Do not send fine-grained addresses, email or payment details; common sensitive patterns are rejected, but this is not a universal personal-data detector. Signals and attribution fields are unsupported. Hints are not forwarded upstream or reflected in results. ## Offline merchant-signature helper The dependency-free module at https://gatewayinformationgroup.com/agent/ap2-merchant-signature.mjs exports `verifyMerchantAuthorization(checkout, trustedPublicKeys, {checkoutId, currency})`. It checks ES256/P-256 detached merchant authorization signatures over the canonical checkout under the caller's explicitly trusted public keys and expected session context. It performs no network calls, signing, storage or payment execution. Its result always includes `spendingAuthorized:false` and `userConsentVerified:false`. This is an AP2-related cryptographic foundation, not an AP2 mandate verifier or checkout service. It does not establish merchant identity, issuer trust, buyer consent, SD-JWT disclosures, holder binding, expiry/audience/nonce policy or replay protection. Callers must reject duplicate properties when parsing wire JSON before passing native JSON values; duplicate properties cannot be detected after ordinary JSON.parse. Actual payment integration remains gated. ## Offline selective-disclosure verification The separate module at https://gatewayinformationgroup.com/agent/sd-jwt-verifier.mjs exports `verifySdJwtPresentation(presentation, trustedIssuerJwksJson, expected)`. This limited RFC 9901 profile verifies compact SD-JWT+KB presentations with ES256/P-256 signatures, SHA-256 disclosure digests, issuer-endorsed direct holder keys, mandatory credential expiry and holder key binding. `trustedIssuerJwksJson` is a caller-trusted public JWK Set JSON string. `expected` requires `issuer`, `credentialType`, `audience`, `nonce`, `nowSeconds` and `maxBindingAgeSeconds` (1–600). A trusted issuer/key binding and fresh transaction context must come from the caller, never from an untrusted token. The shared parser at https://gatewayinformationgroup.com/agent/protocol-json.mjs rejects duplicate decoded JSON member names, malformed Unicode, nonfinite numbers and excessive bytes, depth or nodes. Disclosure hashes cover the original encoded disclosures; the holder binding covers the exact presentation prefix including its trailing tilde. Results do not return claims, tokens or keys. `spendingAuthorized`, `userConsentVerified`, `replayProtected` and `ap2MandateVerified` always remain false. No network, key discovery, signing, persistence or payment action occurs. Delegation, other algorithms/formats, full AP2 checkout/payment mandates and atomic replay consumption are unsupported. This module does not change the existing merchant-signature API or enable UCP checkout. ## Existing wallet services and Bazaar Read https://gatewayinformationgroup.com/agent/wallet-compatibility.md before choosing a purchasing client. Existing stable backend services publish x402 Bazaar metadata; this does not mean every catalog product is Bazaar-enabled or indexed. Current offer discovery and its exact payment quote remain authoritative. Bazaar listing requires facilitator acceptance and settled payment; no payment is authorized by this guide. UCP checkout, payment handlers and AP2 mandate verification are not active. No Google commerce enrollment, universal client certification or registry listing is implied. Guest checkout and the existing 5% benefit on eligible member-portal purchases remain separate; private receipts and downloads retain their normal access checks. Never submit credentials, personal information, wallet keys or private purchase capabilities to public search. Copyright © 2026 Gateway Information Group LLC. All rights reserved.