HTTP Gateway and Challenge Relay
Planned HTTP-only enforcement paths for agents that cannot use the SDK directly.
This page describes planned behavior. These gateway and challenge relay APIs are not implemented yet. Use seller-hosted setup and continuation links for browser-only storefront agents, or the shipped agent-commerce continuation APIs, SDK wrapFetch, and seller middleware when the runtime can call OpenPermit directly.
Planned adoption bridges include:
POST /api/v1/agent/fetch: OpenPermit performs the paid fetch on behalf of an HTTP-only agent.POST /api/v1/agent/challenges/authorize: a direct seller caller relays a402challenge to OpenPermit and receives retry credential headers.- Scoped agent credentials bound to one organization, mandate, expiry, revocation state, and narrowed seller/resource permissions.
- Shared orchestration for seller fetch, challenge normalization, policy authorization, payment execution, retry, and receipt metadata.
Planned gateway safety controls include HTTPS-only production fetches, private network blocking, DNS rebinding protection, body size limits, safe header forwarding, idempotency, and metadata redaction.
The current shipped HTTP-only bridge for storefront checkout is:
POST /api/v1/agent/commerce/readinessPOST /api/v1/agent/commerce/continuationsPOST /api/v1/agent/commerce/continue
Until the gateway paths ship, browser-only agents should follow seller-hosted continuation links, SDK-capable agents can use those continuation APIs or @openpermit/sdk/buyer, and sellers should use @openpermit/sdk/seller to emit compatible challenges and setup actions.