{"ai_workflow":["Create or rotate the needed agents in the authenticated dashboard first.","Save the returned private key immediately; it is only shown once.","Add the A2SPA environment variables to the target project.","Install the published a2spa package and adapt the minimal language example for the target project.","Put the final target operation behind an A2SPA 2.1 enforcement guard before enabling production consequences.","Use the inbox_for_agent endpoint to poll received messages for the receiving agent."],"api_base":"https://api.aimodularity.com/A2SPA","code_generation_rules":["Always send signed payloads through POST /api/verify_payload.","For protected consequences, place A2SPA 2.1 target-side enforcement at the target, trusted gateway, service, or executor.","Do not let agent credentials directly commit the protected consequence without the A2SPA gate.","Inventory admin endpoints, legacy APIs, service accounts, internal RPC, queues, workers, direct database writes, and maintenance paths that could create the same consequence.","Put policy-relevant semantics in signed input fields such as intent, action, workflow_scope, amount_usd, currency, and on_behalf_of.","When using state_continuity, register the authoritative state through POST /api/continuity_state first.","Always fetch received runtime messages through GET /api/inbox_for_agent.","Use GET /api/logs_for_agent for audit and troubleshooting, not as the main runtime inbox.","Use the published a2spa package for payload construction and signing where available.","Do not verify payloads locally as a substitute for the API.","Do not read or write A2SPA backend storage directly from customer agent code.","Do not bypass nonce, timestamp, signature, permission, or toggle checks.","Store the agent private key outside source control and outside public directories."],"deployment_profile":"A2SPA 2.1 target-side enforcement","discovery_urls":{"docs_url":"https://aimodularity.com/A2SPA/docs","integration_page_url":"https://aimodularity.com/A2SPA/integrations","integration_spec_url":"https://aimodularity.com/A2SPA/integrations/spec.json","well_known_url":"https://aimodularity.com/A2SPA/.well-known/a2spa-integration.json"},"environment_template_url":"https://aimodularity.com/A2SPA/integrations/templates/env","must_use_a2spa_api":true,"package_examples":{"env":{"filename":".env.a2spa.example","label":"Environment","runtime":"Generic","url":"https://aimodularity.com/A2SPA/integrations/templates/env"},"javascript":{"filename":"a2spa-client.mjs","label":"JavaScript Package Example","runtime":"Node.js 20+","url":"https://aimodularity.com/A2SPA/integrations/templates/javascript"},"python":{"filename":"a2spa_client.py","label":"Python Package Example","runtime":"Python","url":"https://aimodularity.com/A2SPA/integrations/templates/python"},"typescript":{"filename":"a2spa-client.ts","label":"TypeScript Package Example","runtime":"Node.js 20+","url":"https://aimodularity.com/A2SPA/integrations/templates/typescript"}},"platform":"A2SPA","purpose":"Teach developers and AI coding assistants how to integrate existing agents using the published A2SPA payload helpers, public A2SPA API, and A2SPA 2.1 target-side enforcement profile. Agent setup happens in the authenticated dashboard.","runtime_api":{"continuity_state":{"headers":{"Content-Type":"application/json","x-api-key":"<dashboard API key>"},"method":"POST","notes":["Use this before verify_payload when a workflow step requires state-continuity enforcement.","The response includes the state_hash to bind into payload.state_continuity.","If you enable system-of-record checks, configure the allowed source host/base URL before registering the state."],"request_json":{"binding":{"action":"reserve","agent_id":"<sender agent id>","amount_usd":"100.00","currency":"USD","target_agent_id":"<receiver agent id>","workflow_scope":"payments:reserve"},"expires_at":"2026-08-10T20:00:00Z","sequence":1,"state":{"currency":"USD","reserved_amount":"100.00","status":"reserved"},"state_id":"workflow-123-step-1","status":"active"},"url":"https://api.aimodularity.com/A2SPA/api/continuity_state"},"inbox_for_agent":{"headers":{"x-api-key":"<dashboard API key>"},"method":"GET","notes":["Use this to poll received messages for an agent through the A2SPA API.","This is the preferred runtime retrieval path for receiving agents."],"query":{"after":"optional ISO timestamp for polling","agent_id":"<agent id to inspect>","limit":50},"url":"https://api.aimodularity.com/A2SPA/api/inbox_for_agent"},"logs_for_agent":{"headers":{"x-api-key":"<dashboard API key>"},"method":"GET","notes":["Use this for audit logs, troubleshooting, and dashboard-style history.","Do not use this as the primary runtime inbox when inbox_for_agent is available."],"query":{"agent_id":"<agent id to inspect>"},"url":"https://api.aimodularity.com/A2SPA/api/logs_for_agent"},"verify_payload":{"canonicalization":{"array_order_preserved":true,"compute_hash_before_setting_hash_field":true,"excluded_fields":["hash","signature","extra metadata not in the current verifier schema"],"hash_algorithm":"sha256","included_fields":["agent_id","target_agent_id","timestamp","nonce","input","output","alert_threshold","crypto_profile required for current non-legacy profiles","state_continuity when present"],"number_handling":"Use finite JSON numbers; send exact decimal spellings as strings when cross-language lexical stability matters","recursive_key_sorting":true,"signature_algorithm":"RSA PKCS1v15 SHA256 or ML-DSA-65 when crypto_profile is a2spa.pq.mldsa.v1","signing_preimage":"Current v1 signs the UTF-8 bytes of canonical JSON only; no domain-separation prefix is present in this compatibility profile.","string_escaping":"Python json.dumps(..., sort_keys=True) with ensure_ascii=True semantics","timestamp_format":"ISO-8601 UTC string","utf8_bytes":true,"whitespace":"Python default separators: comma+space and colon+space"},"headers":{"Content-Type":"application/json","x-api-key":"<dashboard API key>"},"method":"POST","request_json":{"payload":{"agent_id":"<sender agent id>","alert_threshold":10,"crypto_profile":"a2spa.classical.rsa_pkcs1v15_sha256.v1","hash":"sha256 over the UTF-8 bytes of Python-compatible canonical JSON for the signable payload","input":{"action":"reserve","message":"hello","workflow_scope":"payments:reserve"},"nonce":"uuid","output":{"status":"ready"},"state_continuity":{"sequence":1,"state_hash":"optional registered state sha256 hex","state_id":"workflow-123-step-1"},"target_agent_id":"<receiver agent id>","timestamp":"ISO-8601 string"},"signature":"hex signature over the same canonical UTF-8 bytes using the algorithm selected by crypto_profile"},"url":"https://api.aimodularity.com/A2SPA/api/verify_payload"}},"security_model":{"a2spa_2_1_target_enforcement":{"invariant":"Every path to consequence must cross the authorization boundary.","pass_condition":"The protected consequence cannot execute unless valid A2SPA authorization reaches the execution boundary.","target_acknowledgement":"Bind target commit/result evidence to the A2SPA authorization receipt id and canonical hash when commit evidence is needed."},"dashboard_management_source":"A2SPA authenticated dashboard only","delegation_boundary":["on_behalf_of is rejected unless the sender agent has an explicit delegation policy allowing that principal.","Cryptographic binding proves integrity. Policy determines semantic permission.","Agent policies can enforce target, sender, intent, action, workflow scope, currency, and spend limits before nonce consumption."],"forbidden_shortcuts":["Direct backend storage writes","Skipping the verify_payload API","Protected target routes that commit without checking an authorized A2SPA receipt","Embedding private keys in git","Replacing server-side verification with local-only checks"],"runtime_verification_source":"A2SPA API only"},"spec_kind":"api_integration_pack","spec_version":"2026-09-25"}