OpenA2A/specs

Explainer

OpenA2A Agent Passport

An OpenA2A Agent Passport is the name for the artifacts an agent presents and a counterparty verifies on its own: a DID Document, a signed trust proof, an ATX credential where one has been issued, and the revocation and transparency records that show whether they are still current.

It is a name and a page for artifacts four existing specifications already define, not a new format.

Note

What this page adds, and what it does not

Nothing on this page introduces a field, a schema, or an endpoint. Each artifact below links to the specification that defines it and, where this site serves one, to its JSON Schema. No schema is served for the DID Document; W3C DID Core and the two DID method specifications define it. Each example block is the credential member of a conformance fixture published alongside those specifications, vendored byte for byte, so what you read here is what a verifier is tested against.

The four artifacts a counterparty obtains

A verifier starts from one agent identifier and collects the following. It checks each one itself: signatures against the key the artifact's issuerDid resolves to, expiry against its own clock, and currency against the revocation list and the transparency log the issuing authority operates (ATP §4.4 and §5; atx-spec core.md §1.3).

1. The identifier and its DID Document

The identifier is a W3C Decentralized Identifier. It resolves over HTTP to a DID Document. The document is not itself signed by either method; a verifier trusts it exactly as much as it trusts the resolver it fetched it from (did-method-opena2a §4.2.1 and §6.2; AIP §3.2, where resolution is provider-anchored). The did:opena2a method(registered in the W3C DID Extensions registry, did-extensions #717) names Registry-listed participants; its DID Document carries the OpenA2A Registry's Ed25519 signing key, not a key the agent holds, together with the trust lookup and trust proof service endpoints for that agent (did-method-opena2a §5). The Agent Identity Protocoldefines did:aip identifiers for identities that a provider issues; a did:aip DID Document carries the agent's own public keys and service endpoints (AIP §3.2).

Two DID methods appear in a Passport and they are not the same identifier: an identity provider such as AIM issues did:aip identifiers, the OpenA2A Registry resolves the did:opena2a identifiers carried by trust proofs and ATX credentials, and the two are bound by the agent identifier and, where the provider records it, an alsoKnownAs entry in the DID Document. Source: AIP §3.2.

Verify the discovery documents yourself; both are plain HTTP GETs and neither needs an account:

Discovery documents (verification lines, not endpoints this page depends on)bash
curl https://aim.opena2a.org/.well-known/aip
curl https://api.oa2a.org/.well-known/opena2a

2. The signed trust proof

The Agent Trust Protocol(§4.2) defines a signed statement of an agent's trust level and score, valid for at most 24 hours (§10.2), from the trust authority that computed it; in the reference deployment that authority is the OpenA2A Registry. The verifier checks expiry against its own clock, resolves the issuer to a known authority, and verifies at least one signature against the canonical payload (§4.4). Served schema: atp/trust-proof-v1.

Trust proof, from the atp-conformance fixture trust-proof-baseline.json (its expiry is a test value)json
{
  "did": "did:opena2a:mcp_server:agent_conformance_test_001",
  "trustLevel": 3,
  "trustScore": 0.825,
  "verdict": "passed",
  "issuedAt": "2026-05-23T00:00:00Z",
  "expiresAt": "2099-12-31T23:59:59Z",
  "issuerDid": "did:opena2a:authority:opena2a.org",
  "signatures": [
    {
      "keyId": "did:opena2a:authority:opena2a.org#key-1",
      "algorithm": "Ed25519",
      "value": "ayA1HZLb2Pg7NwPLGjwzRCiau2rA0x5LKkQPrZ6VNso6ftT0CX0n1G86yn9fLXpB2LSe8MT0itaK7kzYpokAAA=="
    }
  ],
  "transparencyLogIndex": 42
}

3. The ATX credential, where one has been issued

The Agent Trust eXtension is the self-contained, signed credential that packages identity, scan results, capabilities and a behavioral profile for local verification. ATX 1.1 is the normative wire format (atx-spec core.md §1.3a). Served schema: atx/atx-credential-v1.1. The published verifier is @opena2a/atx-verify on npm.

ATX v1.1 credential, from the atx-conformance fixture v1_1-baseline-valid.jsonjson
{
  "id": "00000000-0000-0000-0000-000000000001",
  "atcVersion": "1.1",
  "agentId": "agent_conformance_test_001",
  "agentDid": "did:opena2a:agent:agent_conformance_test_001",
  "publisher": "opena2a-conformance",
  "publisherDid": "did:opena2a:publisher:opena2a-conformance",
  "version": "1.0.0",
  "contentHash": "0000111122223333444455556666777788889999aaaabbbbccccddddeeeeffff",
  "buildAttestation": "https://slsa.dev/provenance/v1#opena2a-conformance",
  "transparencyLogIndex": 42,
  "capabilities": [
    "read:public",
    "write:owned"
  ],
  "behavioralProfile": {
    "checksum": "sha256:ghi789",
    "generatedAt": "2026-05-19T00:00:00Z",
    "observationDays": 14
  },
  "scanSummary": {
    "hma": "passed",
    "criticalFindings": 0,
    "highFindings": 0,
    "secretless": "clean",
    "cryptoServe": "no-weak-crypto",
    "oasbLevel": "L1"
  },
  "trustScore": 87.5,
  "trustLevel": 4,
  "issuedAt": "2026-05-23T00:00:00Z",
  "expiresAt": "2099-12-31T23:59:59Z",
  "issuerDid": "did:opena2a:authority:opena2a.org",
  "issuerChain": [
    "did:opena2a:authority:opena2a.org-root",
    "did:opena2a:authority:opena2a.org"
  ],
  "signatures": [
    {
      "keyId": "did:opena2a:authority:opena2a.org#key-1",
      "algorithm": "Ed25519",
      "value": "yzWTRo2drtwsfSdx0RkabNQsRMXFR/KaJPA6lN95CcKbRuNVUN4QEmb/k/A3MGDn7IcSptJJv28KNHaMoL9wBw=="
    }
  ],
  "revoked": false,
  "createdAt": "2026-05-23T00:00:00Z"
}

4. Revocation and transparency records

A credential that verified yesterday may be revoked today. The Passport therefore includes the records that answer whether it is still current: the revocation list (ATP §8.1, the CRL the ATX verification algorithm consults, atx-spec core.md §1.3 step 6), plus the transparency log's signed tree head and inclusion proof (ATP §5), built with the RFC 6962 Merkle tree construction that Certificate Transparency uses. Served schemas: atp/revocation-list-v1, atp/signed-tree-head-v1, atp/inclusion-proof-v1.

Revocation list, from the atp-conformance fixture revocation-list-valid.jsonjson
{
  "revocations": [
    {
      "agentDid": "did:opena2a:mcp_server:compromised-package",
      "revokedAt": "2026-03-22T15:00:00Z",
      "reason": "Supply chain compromise detected",
      "transparencyLogIndex": 1847300,
      "revokedByKeyId": "did:opena2a:authority:opena2a.org#key-v3"
    }
  ],
  "nextSince": "2026-03-22T15:00:00Z"
}
Signed tree head, from the atp-conformance fixture transparency-log-sth.jsonjson
{
  "treeSize": 1847294,
  "timestamp": "2026-05-23T00:00:00Z",
  "rootHash": "SHA256:111cc6504a7f35183bef35aa9d647cc3c799278325354d4446bb0157079b1602",
  "signedBy": "did:opena2a:authority:opena2a.org#key-1",
  "signature": "egu1YqeoHIW9w7e7fmaFUECdMv6HbOABUDwi6BHQMZn7vkPveBg34g3e3Jptlkw5GqipnytIKmLUs7W4xoCjCQ=="
}

Machine view

For tooling there is no Passport object. The machine-readable surface is the served schemas and the pinned fixtures listed here, and nothing else. Every JSON block on this page is validated in the release smoke against the $id it names, and every vendored file is byte-compared in CI against its upstream commit recorded in MANIFEST.json.

The Passport is easiest to understand bottom up. Read the identifier first, then the proof of holding it, then the credential, then the protocol that issues, logs and revokes it.

  1. did:opena2a, the identifier and its DID Document.
  2. AIP, proving you hold the key behind the identifier, and did:aip.
  3. ATX, the credential a verifier checks locally.
  4. ATP, trust proofs, revocation and the transparency log.

To see the verification steps run, the interactive lab walks each one with real signatures.