- CollectionAgent Runtime & Infrastructure
- Classificationagent-native
- LicenseOpen-core — SDK MIT OR Apache-2.0; engine AL-1.0; spec CC-BY-NC-ND 4.0; license matrix
- MCPUnavailable
- Agent SkillUnavailable
- InterfacesURL onboarding · REST · SDK · openapi · http · API
What it does
UTA Trust API answers one question an agent consumer asks over HTTP: is this automated requester trustworthy? The caller presents an Agent Trust Card (ATC) — a self-contained, CA-signed JSON credential binding an agent’s identity and capabilities to an Ed25519 public key — and the verifier returns a machine-readable verdict.
Verification is fail-closed and offline-oriented: the Ed25519 signature (RFC 8032) is checked over the JCS-canonicalized (RFC 8785) subtree (ATC-006), the CA public key is resolved from the card’s own attestation.ca_url so no network call to the CA is required, and revocation is checked against revocation_check_url when revocation_check_required: true — an unreachable check denies rather than degrades. Verdicts are anchored as public evidence (Sigstore Rekor) so an operator can later bind “verified agent X, verdict Y at time Z” into grant records and audit trails.
The service is x402-native: settlement is $0.01 USDC per single verification (or $0.08 for a 1–10 card batch) on Base (Mainnet eip155:8453 and Sepolia testnet eip155:84532), with no signup, no API key, and no human consent step — an agent that has never heard of the service can pay and call it in one round trip.
Agent-facing interfaces
- Catalog protocols: URL onboarding, REST, SDK, openapi, http, API
- MCP: ⚠️ Not yet published
- Agent Skill: ⚠️ Not yet published
- Onboarding type:
url
How agents onboard
# URL Onboarding:
Read https://uta-trust-api.eddyflores100.workers.dev/openapi.json and follow the instructions to settle and call.
# SDK / REST:
npm install agent-trust-card # issue / verify / inspect Agent Trust Cards
# or call the verifier directly — an agent with no pre-paid access receives
# HTTP 402 + payment metadata, settles $0.01 USDC via x402, and retries:
POST https://uta-trust-api.eddyflores100.workers.dev/v1/trust/verify
# Conformance (self-test a credential before submitting it):
npx @marketnow/uta-conformance # signed vectors + card generator
See the full onboarding section in the dossier.
Protocol surface
| Interface | Detail |
|---|---|
| REST API | POST /v1/trust/verify (single), POST /v1/trust/batch (1–10 cards) — OpenAPI |
| Payments | x402 (v2) over USDC on Base mainnet (eip155:8453) and Base Sepolia testnet; discovery document at the root URL |
| SDK | npm agent-trust-card — issue / verify / inspect |
| Conformance | npx @marketnow/uta-conformance — signed vectors + card generator |
| Evidence ledger | Sigstore Rekor anchors — https://www.marketnow.site/uta/conformance/anchors/ |
| CA public keys | JWK (pinned trust anchors) · CRL: /api/atc?action=revocation-list · OCSP-style: /api/ocsp?card_id= |