OpenPermit Docs
Roadmap

HTTP Gateway and Challenge Relay

Planned HTTP-only enforcement paths for agents that cannot use the SDK directly.

This page describes planned behavior. These gateway and challenge relay APIs are not implemented yet. Use seller-hosted setup and continuation links for browser-only storefront agents, or the shipped agent-commerce continuation APIs, SDK wrapFetch, and seller middleware when the runtime can call OpenPermit directly.

Planned adoption bridges include:

  • POST /api/v1/agent/fetch: OpenPermit performs the paid fetch on behalf of an HTTP-only agent.
  • POST /api/v1/agent/challenges/authorize: a direct seller caller relays a 402 challenge to OpenPermit and receives retry credential headers.
  • Scoped agent credentials bound to one organization, mandate, expiry, revocation state, and narrowed seller/resource permissions.
  • Shared orchestration for seller fetch, challenge normalization, policy authorization, payment execution, retry, and receipt metadata.

Planned gateway safety controls include HTTPS-only production fetches, private network blocking, DNS rebinding protection, body size limits, safe header forwarding, idempotency, and metadata redaction.

The current shipped HTTP-only bridge for storefront checkout is:

  • POST /api/v1/agent/commerce/readiness
  • POST /api/v1/agent/commerce/continuations
  • POST /api/v1/agent/commerce/continue

Until the gateway paths ship, browser-only agents should follow seller-hosted continuation links, SDK-capable agents can use those continuation APIs or @openpermit/sdk/buyer, and sellers should use @openpermit/sdk/seller to emit compatible challenges and setup actions.