PAP discovery report
bank.notjustabank.com
Publishes a poppy.json with 1 problem to fix. Organization: Not Just a Bank.
Publishes poppy.json, with problems
1problem
HTTP 200 Version 0.3 Routes APIs, web Checked 18 hours ago
First seen 27 Oct 2026
Draft 0.3 of the Personal Agent Protocol is still in progress: it is not published or frozen, and its text is still changing. These results follow draft 0.3 as written on 2 November 2026, and will change when the draft does.
Findings1 problem · 10 passed · 1 note · 18 skipped
Results from the Personal Agent Protocol's official Company validator, commit 7205250, draft 0.3 (read-only survey + file check).
Discovery
Note
Draft 0.3 is still in progress
Draft 0.3 is not published or frozen yet, and its text is still changing. These results follow it as written on 2 November 2026, and may change when the draft does.
OK
poppy.json is served over HTTPS at the well-known path
Served at https://bank.notjustabank.com/.well-known/poppy.json.
discovery.https
OK
Every redirect of the well-known URL is to an HTTPS URL
No redirects.
discovery.redirects-https
OK
Redirects of the well-known URL end at /.well-known/poppy.json, with no query
No redirects.
discovery.redirects-well-known
OK
poppy.json is a JSON object
The JSON document a Company publishes at /.well-known/poppy.json.
discovery.json
OK
poppy.json fields have the forms section 3.1 describes
discovery.schema
OK
protocol_version is the version this validator checks
protocol_version 0.3.
discovery.protocol-version
OK
organization.domain is the host that serves poppy.json, after redirects
organization.domain bank.notjustabank.com matches the host.
discovery.domain-matches-host
OK
poppy.json lists at least one of agent, apis, or web
At least one of agent, apis, or web.
discovery.interface-present
OK
Extension names are ones the protocol defines, or start with a domain
Anyone else MUST start an extension's name with a domain they control, such as example.com/gift-wrap.
discovery.extension-names
OK
A Company that turns off sign-in lists no way to sign in
Sign-in isn't turned off.
discovery.sign-in-disabled
Skipped
The excluded-tasks document loads and has the fields in 9.1
Not checked: the validator checks this only in its online mode, which we do not run.
discovery.excluded-tasks
Skipped
Each openapi or mcp reference in an alternative names an API listed in poppy.json
Not checked: the validator checks this only in its online mode, which we do not run.
discovery.alternative-references
Sign-in server
Problem
The Company has an issuer when it offers account access
Found: auth.issuer in poppy.json, but no issuer. Expected: Protected resource metadata naming an OAuth issuer. Publish authorization_servers naming the issuer, or remove the declarations that require account access.
metadata.issuer-required
Skipped
The domain's protected resource metadata is for https://{organization.domain} and names authorization servers
Not checked: The Company has no OAuth issuer.
metadata.resource-metadata
Skipped
auth.issuer is one of authorization_servers, and is present when there are several
Not checked: The Company has no OAuth issuer.
metadata.issuer-chosen
Skipped
The issuer publishes OAuth Authorization Server Metadata
Not checked: The Company has no OAuth issuer.
metadata.published
Skipped
The metadata has the fields section 3.2 requires, in the right forms
Not checked: The Company has no OAuth issuer.
metadata.schema
Skipped
The metadata's issuer exactly matches the issuer the protected resource metadata names
Not checked: The Company has no OAuth issuer.
metadata.issuer-matches
Skipped
protected_resources includes https://{organization.domain}
Not checked: The Company has no OAuth issuer.
metadata.protected-resources
Skipped
The metadata has a token_endpoint
Not checked: The Company has no OAuth issuer.
metadata.token-endpoint
Skipped
The metadata has a revocation_endpoint
Not checked: The Company has no OAuth issuer.
metadata.revocation-endpoint
Skipped
grant_types_supported includes refresh_token
Not checked: The Company has no OAuth issuer.
metadata.grant-types
Skipped
The metadata has an authorization_endpoint when it offers Direct Sign-In
Not checked: The Company has no OAuth issuer.
metadata.authorization-endpoint
Skipped
The metadata has a device_authorization_endpoint when it offers Device Sign-In
Not checked: The Company has no OAuth issuer.
metadata.device-authorization-endpoint
Skipped
scopes_supported lists every scope a sign-in can grant
Not checked: The Company has no OAuth issuer.
metadata.scopes-supported
Skipped
Every scope in scopes_supported has a description
Not checked: The Company has no OAuth issuer.
metadata.scopes-described
Skipped
Other Company domains select the same issuer
Not checked: The Company has no OAuth issuer.
metadata.same-issuer
Skipped
Other domains with the same issuer have matching scope descriptions and hints
Not checked: The Company has no OAuth issuer.
metadata.same-auth
Skipped
With Mediated Sign-In listed, the issuer's metadata lists its grant type
Not checked: The Company has no OAuth issuer.
metadata.mediated-grant
poppy.json as served
0.9 KB
{
"protocol_version": "0.3",
"organization": {
"name": "Not Just a Bank",
"domain": "bank.notjustabank.com"
},
"auth": {
"issuer": "https://bank.notjustabank.com",
"scopes": {
"northpine:account:read": "View card balance, available credit, due date and transactions.",
"northpine:payments:write": "Propose, confirm and cancel card-balance payments; separate approval is required for every payment.",
"northpine:payment_tokens": "Obtain short-lived, single-use payment credentials restricted to North & Pine orders."
}
},
"apis": [
{
"type": "openapi",
"url": "https://bank.notjustabank.com/poc/bank/openapi.json",
"description": "Read fictional card information, propose approved payments and prepare North & Pine purchases",
"resource": "https://bank.notjustabank.com/poc/bank/api"
}
],
"web": {},
"extensions": {
"operations": {
"version": "1",
"endpoint": "https://bank.notjustabank.com/poc/bank/operations",
"resource": "https://bank.notjustabank.com/poc/bank/api"
}
}
}
OAuth server metadata as served
0.9 KB
{
"issuer": "https://bank.notjustabank.com",
"authorization_endpoint": "https://bank.notjustabank.com/poc/bank/oauth/authorize",
"token_endpoint": "https://bank.notjustabank.com/poc/bank/oauth/token",
"revocation_endpoint": "https://bank.notjustabank.com/poc/bank/oauth/revoke",
"protected_resources": [
"https://bank.notjustabank.com",
"https://bank.notjustabank.com/poc/bank/api"
],
"dpop_bound_access_tokens": true,
"response_types_supported": [
"code"
],
"grant_types_supported": [
"urn:ietf:params:oauth:grant-type:jwt-bearer",
"authorization_code",
"refresh_token"
],
"token_endpoint_auth_methods_supported": [
"private_key_jwt"
],
"token_endpoint_auth_signing_alg_values_supported": [
"ES256"
],
"code_challenge_methods_supported": [
"S256"
],
"scopes_supported": [
"northpine:account:read",
"northpine:payments:write",
"northpine:payment_tokens"
],
"dpop_signing_alg_values_supported": [
"ES256"
],
"authorization_response_iss_parameter_supported": true
}
Each document is checked against the Personal Agent Protocol draft it declares in protocol_version: 0.1, 0.2 or 0.3. Section numbers refer to that draft's specification. Drafts 0.1 and 0.2 are published and frozen; draft 0.3 is in progress, and any draft can change before a stable version; see the path to 1.0.
PAP Checker