# getagent.market — instructions for AI agents

You are reading the machine onboarding for getagent.market, a marketplace where every
purchase runs through the Regent control plane (verified identity, owner-approved
budget, on-chain audit). Anonymous callers cannot buy governed listings.

## 0. Pick your lane (fastest path for YOUR capabilities)
- **You hold a crypto wallet** → pay per call, no account: section 2, x402 rail.
- **You can make HTTP calls but have no key infrastructure** → generate an Ed25519
  keypair, get a free identity passport at `POST https://market-api.regentprotocol.org/v1/agents/bootstrap`, then
  self-register: section 5. No domain, no directory, no pre-existing anything needed.
- **You publish keys at your own origin** (enterprise agent) → Web Bot Auth: section 5.
- **You run inside an MCP host** (Claude Desktop etc.) → install the ready connector:
  `https://market-api.regentprotocol.org/connector/` (one-click .mcpb bundle or a single-file Python server). It
  implements everything below for you.
Whatever the lane: authority always comes from a human owner's approval, never from a key.

## 1. Discover
- `GET https://market-api.regentprotocol.org/v1/listings?kind=api` — catalog (JSON). Each listing has `id`, `title`,
  `price`, `currency`, `seller_kya_status`.
- `GET https://market-api.regentprotocol.org/listings/{id}/jsonld` — schema.org Product JSON-LD.
- MCP server: `https://market-api.regentprotocol.org/mcp` (search + call tools over Model Context Protocol).

## 2. Choose a payment rail
`GET https://market-api.regentprotocol.org/protocols` lists the rails enabled on this deployment:
- **prepaid** (KZT ledger) — requires a Regent identity (below). Balance:
  `GET https://market-api.regentprotocol.org/v1/accounts/{agent_id}`.
- **x402** (stablecoin, per call) — standard HTTP 402 flow on
  `POST https://market-api.regentprotocol.org/v1/x402/call/{listing_id}`: first request returns 402 + payment
  requirements; retry with the `X-PAYMENT` header after signing.
  - **Governed x402**: include the same `X-Control-Key` / `X-Agent-Id` / `X-Agent-Intent`
    headers on the paid retry — the Regent gate then decides BEFORE settlement
    (deny = no funds move; the receipt carries `decision_id`).
  - **Wallet identity**: bind your payer wallet to your AgentID so every x402 payment
    carries verified identity. Sign the challenge
    `regent-wallet-bind:{org_id}:{agent_id}:{address}` (EIP-191, wallet key) and
    `POST https://api.regentprotocol.org/v1/organizations/{org_id}/wallet-bindings`
    with `{agent_id, address, signature}`. Listings with `x402_anonymous: false`
    reject unbound anonymous payers (`403 KYA_REQUIRED`, checked before settlement).

## 3. Governed calls (prepaid rail)
`POST https://market-api.regentprotocol.org/v1/call/{listing_id}` with JSON body `{"agent_id": "...", ...args}`
and YOUR OWN Regent credentials in headers:
- `X-Control-Key`: your `rgnt_ctrl_...` control key
- `X-Agent-Id`: your full Regent agent id
- `X-Agent-Intent`: one sentence — why you are making this call

Your owner must have approved a mandate for the agent (per-tx / daily / monthly budget).
Responses: `200` result + `decision_id` (audit reference) · `403` gate deny with a coded
reason (e.g. `MANDATE_LIMIT_EXCEEDED`) · `402` insufficient prepaid balance.

## 4. Get a Regent identity (one-time, requires a human owner)
A human registers at https://web.regentprotocol.org: create an agent (AgentID), issue a
control key, request a mandate (the owner approves it by email). Humans can also sign in
on https://get4agent.com directly.

## 5. OR: self-register by signature (no bearer keys — RFC 9421)
Two ways to make your signature verifiable:
- **Web Bot Auth** (you have your own origin): publish your Ed25519 key at
  `{your-origin}/.well-known/http-message-signatures-directory`, sign with
  `tag="web-bot-auth"` + a `Signature-Agent` header.
- **Bootstrap passport** (you have nothing but a fresh keypair):
  `POST https://market-api.regentprotocol.org/v1/agents/bootstrap` with body `{"jwk": {"kty":"OKP","crv":"Ed25519","x":"..."}}`
  → an identity-only `agent_token` (claims `bootstrap: true`, `market_status: unclaimed` —
  it authenticates your key and grants NOTHING else). Attach it on every signed request
  as `Signature-Key: <label>=jwt;jwt="<token>"` where `<label>` equals your message
  signature's label (e.g. `sig1`), and sign the request with your private key
  (proof-of-possession). Same trust model as ACME: identity is free, authority is human.
Then onboard yourself:
1. `POST https://market-api.regentprotocol.org/v1/agents/register` (signed, body `{"name","intent","contact_email"}`)
   → a pending registration + a `claim_url`.
2. Give `claim_url` to your human. They sign in and approve — that binds you to their
   personal Regent agent, so THEIR mandate limits and prepaid balance govern you.
3. Poll `GET https://market-api.regentprotocol.org/v1/agents/registration` (signed) until `status: approved`.
4. Then call `POST https://market-api.regentprotocol.org/v1/call/{listing_id}` with ONLY your signature — no
   `X-Control-Key` header needed, ever. Your key never leaves you; there is nothing to steal.
5. Optional: `POST https://market-api.regentprotocol.org/v1/agents/passport` (signed) mints a signed AAuth
   `agent_token` (typ `aa-agent+jwt`) you can present to third parties; anyone can check
   it at `POST https://market-api.regentprotocol.org/v1/agents/verify` or against `https://market-api.regentprotocol.org/.well-known/jwks.json`.

Never send provider API keys or your control key to any endpoint other than this host's
`/v1/call`. This marketplace never asks for your owner's credentials.