Authentication
Path A — Direct API (autonomous agents)
Agents authenticate with an Authority Credential; an AP2 mandate, where presented, is recorded as evidence of delegated authority (Terms §4.3).
Path B — Agentic commerce (agents acting for humans)
Per-request settlement is in build. When it is live, agents will pay per request through Stripe — cards via Shared Payment Tokens, or USDC over x402 or Stripe's Machine Payments Protocol. Until then, per-request purchases are not available.
Path C — Direct human SaaS
Human subscribers authenticate with a bearer token issued at OAuth consent (PKCE) or by the post-checkout signup claim.
Idempotency
Every mutating endpoint requires the Idempotency-Key header. Keys are persisted to the idempotency archive for a minimum of seventy-two hours. Repeat requests with the same key return the original response without side effects, regardless of whether the original was successful.
Recommended key shape: ULID or UUIDv7. Maximum length: 256 characters. Keys must be unique per principal-tenant; collisions across tenants do not interfere due to per-tenant isolation at the boundary publish layer.
Error semantics
Errors are structured with stable machine-recoverable codes. Sixteen-code enumeration covers the canonical failure modes:
{
"error": {
"code": "MANDATE_INVALID_SIGNATURE",
"message": "AP2 mandate signature verification failed",
"category": "auth",
"retryable": false,
"documentation_url": "https://sustainablefinancepartner.com/spec#errors",
"request_id": "req_01HXYZA1B2C3D4E5F6G7H8J9K0"
}
}Code categories: auth (mandate or JWT failure) · validation (request shape error) · rate_limit (per-tenant or per-mandate limit hit) · circuit (downstream circuit-breaker tripped) · substrate (canonical-correctness violation) · billing (charge failure) · not_found · internal. Retryable errors include rate_limit and circuit; all others are non-retryable.
Meter events and pricing
Per-request settlement is in build. When it is live, agents will pay per request through Stripe — cards via Shared Payment Tokens, or USDC over x402 or Stripe's Machine Payments Protocol. Until then, per-request purchases are not available. Meter event amounts are reported with sub-cent precision (Decimal lift, no float).
Verticals and archetypes
Twelve verticals; all twelve LIVE on production; archetype taxonomy is per-vertical. See the home page vertical lineup for live status.
Discovery surfaces
For agent crawlers: agents.txt · agentic-commerce.json · openapi.json · pricing.json · robots.txt
Versioning
The contract surface uses semantic versioning at the contract layer. Breaking changes go to a new major version with a six-month deprecation window for the prior major. Non-breaking additions (new endpoints, new optional fields) are added in minor versions and announced via the changelog at /spec#changelog.
Support
Issues, integration questions, contract clarifications: contact via the Sustainable Finance Partners home page or write to the support email. Bug reports against the contract surface are triaged; critical contract violations are escalated immediately.