Docs · Sellers
Conformance and badge
LiveUpdated
Sellers. Written for merchants that receive agent orders.
Nobody issued an “agent-ready” badge for merchants before. Enruta’s suite runs the checkout lifecycle, protocol behavior, idempotency, mandate enforcement, the merchant signature and the receipt against your endpoint, and a fully green run earns a badge signed by Enruta that anyone can verify.
The suite
| Group | Test | Passes when |
|---|---|---|
| Discovery | Profile | /.well-known/ucp is served with keys and capabilities |
| Lifecycle | Create → get → update → complete → order | A checkout is created, read, updated (address and fulfillment), completed with the mock handler’s success_token, and the order is fetched |
| Protocol | Version and errors | The version header is honored; a bad id returns the specified error shape |
| Idempotency | Replay | The same Idempotency-Key replays the same response |
| Mandate | Required when negotiated | complete without ap2.checkout_mandate answers mandate_required once AP2 was negotiated |
| Signature | Merchant authorization | ap2.merchant_authorization verifies with the profile’s keys |
| Receipt | Payment reference and signature | The order carries payment_reference and, when the store signs, a signature that verifies |
Results are { name, ok, detail }[]; tests that do not apply to your endpoint are skipped, not failed. The runner is the pure runConformance(endpoint, { domain }) in @enruta/sdk, with CONFORMANCE_TESTS exported, so the local command and the hosted run are the same code.
Run it
npx @enruta/cli validate https://shop.example --domain shop.example
discovery profile ok
lifecycle create → complete ok ord_…
protocol version header ok
protocol error shape ok
idempotency replay ok
mandate required ok mandate_required
signature merchant_authorization ok key_merchant_shop_2026-09
receipt payment_reference ok
8 of 8 applicable tests passed exit 0--json prints the results array; the exit code is 1 on any failure. The local run does not issue a badge.
POST /v0/sellers/conformance Authorization: Bearer enruta_slr_…
{ "domain": "shop.example", "endpoint": "https://shop.example" }
201 { "id": "cfr_01M2J3Q8W4T7K2N9B5D1H6XRS", "passed": 8, "total": 8, "results": [ … ], "badge_jws": "eyJ…" }
GET /v0/sellers/conformance → your runsA run with every applicable test green issues the badge; the seller console’s Conformance page runs the same call and shows the embed snippet.
The badge
A compact JWS signed with the Enruta seal key: { iss: "https://enruta.ai", sub: <domain>, endpoint, passed, total, run_id, iat, exp: +90 days, typ: "enruta-conformance+jwt" }. It is public, cached for an hour, and expires after ninety days so a badge always reflects a recent run.
GET https://app.enruta.ai/badges/reamandrule.com.json
{ "domain": "reamandrule.com", "passed": 8, "total": 8, "badge": "eyJ…", "verified_at": "2026-09-13T12:00:00Z", "verify_url": "https://app.enruta.ai/.well-known/enruta-keys.json" }
<img src="https://app.enruta.ai/badges/reamandrule.com.svg" alt="Enruta · agent-ready">The SVG reads “Enruta · agent-ready · 8/8” in the brand colors. The reference merchant shows it in its storefront footer, linked to the JSON.
Why it is free
The badge and the suite are part of the Accept tier, free permanently, like the verifier: the value of a record that both sides can verify grows with the number of merchants that can accept a mandate reference, and a conformance check is the cheapest way to make a merchant agent-ready. The vectors will be published with the schema and the verifier so that other tools can run the same suite.