The Agentic Experience Protocol (AXP) extends UCP to enable rich product experiences in agentic commerce interfaces. AXP is based on A2A (Agent-to-Agent), ACP (Agent Communication Protocol), and UCP (Universal Commerce Protocol) standards.

AXP uses the same security protocols and patterns as UCP, ensuring seamless integration and consistent security posture across both protocols.

AXP addresses three core requirements for modern agentic commerce:

1. Product Data - Structured product information supporting complex types (variants, configurators, events, subscriptions)
2. Quality Data - Trust signals including reviews, returns, intent information, and merchant reputation
3. Experience Embedding - Sandboxed live experiences from merchants (3D viewers, configurators, AR)

Current version: 2026-01-13

AXP is designed to work as an addon within UCP or as a standalone protocol:

{
  "ucp": {
    "version": "2026-01-11",
    "capabilities": [
      {"name": "dev.ucp.shopping.checkout", "version": "2026-01-11", ...}
    ]
  },
  "axp": {
    "version": "2026-01-13",
    "capabilities": [
      {"name": "dev.axp.product_data", "version": "2026-01-13", ...}
    ]
  },
  "signing_keys": [...]
}

AXP products can be directly used in UCP checkout sessions:

# Get UCP-compatible item from AXP product
GET /api/axp/products/{id}/ucp-item

# Use in UCP checkout
POST /api/ucp/checkout-sessions
{
  "line_items": [{
    "item": { /* UCP item from AXP */ },
    "quantity": 1
  }]
}

AXP profiles are discoverable at /.well-known/axp (standalone) or within /.well-known/ucp (addon mode).

# Standalone discovery
curl https://merchant.example.com/.well-known/axp

# UCP addon discovery
curl https://merchant.example.com/.well-known/ucp

AXP supports multiple transport protocols:

• REST API - OpenAPI 3.1 specification (services/openapi.json)
• MCP - Model Context Protocol for AI agents (services/openrpc.json)
• A2A - Agent-to-Agent protocol
• GraphQL - Query language support
• WebSocket - Real-time updates

product-protocol/
├── schemas/
│   ├── axp.json              # Core protocol metadata (references UCP)
│   ├── capability.json       # Capability definitions (extends UCP capabilities)
│   ├── security.json         # Security schemas (UCP-compatible)
│   ├── product.json          # Product schema
│   ├── quality_data.json     # Quality data schema
│   ├── experience.json       # Experience embedding schema
│   └── types/
│       ├── availability.json
│       ├── price.json
│       ├── variants.json
│       ├── configurator.json
│       ├── event.json
│       ├── subscription.json
│       ├── bundle.json
│       ├── digital.json
│       ├── reviews.json
│       ├── returns.json
│       ├── intent_signals.json
│       ├── merchant_trust.json
│       ├── product_trust.json
│       ├── social_proof.json
│       ├── sandbox_policy.json
│       ├── experience_entry_point.json
│       └── experience_interaction.json
├── discovery/
│   ├── profile_schema.json          # Discovery profile schema
│   └── unified_profile_example.json # Example UCP+AXP unified profile
└── services/
    ├── service_schema.json   # Service definition schema
    ├── openapi.json          # REST API specification
    └── openrpc.json          # MCP/RPC specification

AXP supports these product types:

Embedded experiences run in secure sandboxes with configurable policies:

{
  "sandbox_policy": {
    "isolation_level": "standard",
    "permissions": {
      "allow_scripts": true,
      "allow_same_origin": false,
      "allow_popups": false
    },
    "content_security_policy": {
      "default_src": ["'self'"],
      "script_src": ["'self'", "https://cdn.merchant.com"],
      "connect_src": ["'self'", "https://api.merchant.com"]
    },
    "resource_limits": {
      "max_memory_mb": 128,
      "execution_timeout_ms": 30000
    }
  }
}

Experiences communicate with the host via structured events:

Inbound Events (host → experience):

• product_data_update - Product information changed
• variant_selected - User selected a variant
• locale_changed - Language/locale changed

Outbound Events (experience → host):

• ready - Experience loaded and ready
• configuration_changed - User modified configuration
• add_to_cart_request - Request to add item to cart
• view_changed - 3D view angle changed
• ar_launch_request - Request to launch AR mode

{
  "reviews": {
    "aggregate": {
      "rating": 4.3,
      "count": 1247,
      "rating_distribution": {
        "5": 782,
        "4": 312,
        "3": 98,
        "2": 34,
        "1": 21
      },
      "recommendation_percentage": 94,
      "verified_purchase_count": 1089
    },
    "aspect_ratings": [
      {"aspect": "quality", "rating": 4.5},
      {"aspect": "value", "rating": 4.1},
      {"aspect": "durability", "rating": 4.4}
    ]
  }
}

{
  "returns": {
    "return_rate": {
      "percentage": 8.2,
      "category_comparison": "below_average",
      "trend": "improving"
    },
    "return_reasons": [
      {"reason": "wrong_size", "percentage": 45},
      {"reason": "not_as_described", "percentage": 18},
      {"reason": "changed_mind", "percentage": 22}
    ],
    "size_fit_analysis": {
      "fit_indicator": "runs_small",
      "size_recommendation": "Order one size up"
    }
  }
}

{
  "merchant_trust": {
    "trust_score": {
      "score": 94,
      "tier": "gold"
    },
    "verification": {
      "business_verified": true,
      "address_verified": true
    },
    "performance_metrics": {
      "on_time_delivery_rate": 97.3,
      "resolution_rate": 99.1,
      "response_time_hours": 2.4
    }
  }
}

# Get product with quality data
curl https://merchant.example.com/api/axp/products/SKU123?include_quality=true

# Get product reviews
curl https://merchant.example.com/api/axp/products/SKU123/reviews?sort=helpful&limit=10

# Get configurator definition
curl https://merchant.example.com/api/axp/products/SKU123/configurator

# Calculate configuration price
curl -X POST https://merchant.example.com/api/axp/products/SKU123/configurator \
  -H "Content-Type: application/json" \
  -d '{"selections": {"color": "blue", "size": "medium", "engraving": "JD"}}'

# Get experience definition
curl https://merchant.example.com/api/axp/experiences/EXP456

{
  "jsonrpc": "2.0",
  "method": "axp.getProduct",
  "params": {
    "product_id": "SKU123",
    "include_quality": true,
    "include_experiences": true
  },
  "id": 1
}

{
  "jsonrpc": "2.0",
  "method": "axp.calculateConfiguration",
  "params": {
    "product_id": "SKU123",
    "selections": {
      "color": "blue",
      "size": "medium",
      "engraving": "JD"
    }
  },
  "id": 2
}

AXP extends UCP capabilities:

• AXP products can be used in UCP checkout sessions
• AXP quality data informs purchase decisions in agentic flows
• AXP experiences can be embedded in UCP-enabled platforms

{
  "ucp": {
    "version": "2026-01-11",
    "capabilities": ["dev.ucp.shopping.checkout"]
  },
  "axp": {
    "version": "2026-01-13",
    "capabilities": [
      "dev.axp.product_data",
      "dev.axp.product_data.variants",
      "dev.axp.quality_data",
      "dev.axp.quality_data.reviews",
      "dev.axp.experience_embedding",
      "dev.axp.experience_embedding.viewer_3d"
    ]
  }
}

AXP implements the same security protocols as UCP to ensure consistent security and easy integration.

AXP uses the same signing_keys format as UCP in discovery profiles:

{
  "signing_keys": [
    {
      "kid": "merchant-key-2026-01",
      "kty": "EC",
      "crv": "P-256",
      "x": "f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU",
      "y": "x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0",
      "use": "sig",
      "alg": "ES256"
    }
  ]
}

When AXP is used as a UCP addon, the same signing keys are shared between both protocols.

AXP uses the same detached JWS format as UCP:

Format: base64url(header)..base64url(signature)
Header: {"alg":"ES256","typ":"JWT","kid":"key-id"}

HTTP Headers:

• Request-Signature - Signs request body (same as UCP)
• Response-Signature - Signs response body
• Content-Signature - Signs experience content for integrity
• AXP-Agent - Agent identification (same format as UCP-Agent)

For embedded experiences, optional content signing ensures integrity:

{
  "experience_signature": {
    "signature": "eyJhbGciOiJFUzI1NiJ9..signature",
    "content_hash": "sha256-base64url-hash",
    "signed_at": "2026-01-13T12:00:00Z",
    "kid": "merchant-key-2026-01"
  }
}

• All embedded experiences run in isolated contexts
• Network access restricted to whitelisted domains
• No access to parent window or cookies
• Resource limits enforced (memory, CPU, network)
• CSP headers strictly applied

See schemas/security.json for full security type definitions.

• Quality data aggregated to protect individual privacy
• PII handling configurable per experience
• Audit logging available for compliance

Detailed flow diagrams for AXP integration into UCP flows can be found in docs/flow-diagrams.md:

• Scenario 1: Product Discovery with Quality Data
• Scenario 2: Configurable Product with Embedded Experience
• Scenario 3: Checkout Flow with AXP-Enriched Products
• Scenario 4: Event/Ticket Booking with Time Selection
• Scenario 5: Subscription with Personalization
• Scenario 6: Trust-Based Purchase Decision
• Scenario 7: Complete E2E Flow

Apache License 2.0