Personal Agent Protocol draft 0.1 was published on 9 Oct 2026 · What goes in poppy.json →
PAP Checker
PAP Checker/Sites/emorahealth.com
PAP discovery report

emorahealth.com

Publishes a poppy.json with no problems found. Organization: Emora Health.

Publishes poppy.json
0problems
HTTP 200 Version 0.1 Routes agent Checked 18 hours ago First seen 12 Oct 2026
Open poppy.json ↗
Findings11 passed · 2 notes
Discovery
OK
poppy.json published
Served over HTTPS at /.well-known/poppy.json.
§3
Note
Served after 1 redirect
Allowed: every hop is HTTPS, and the document still speaks for the domain requested. Final URL: https://www.emorahealth.com/.well-known/poppy.json
§3
OK
Protocol version 0.1
A major.minor version this checker reads.
§3.1
OK
organization.domain matches the domain checked
It must match the host the agent requested, ignoring a leading www.
§3.1
Sign-in
OK
OAuth issuer: https://www.emorahealth.com/poppy
An HTTPS issuer identifier.
§3.1
Note
No sign-in types: signed-out sessions only
With none of direct, device or mediated, the company offers only signed-out Sessions.
§4.4
Sign-in server
OK
OAuth server metadata published
Found at the issuer (RFC 8414).
§3.2
OK
issuer matches auth.issuer
Exact match, as agents must check.
§3.2
OK
poppy_domains lists emorahealth.com
The issuer confirms this domain may use it.
§3.2
OK
token_endpoint published
Issues Session and Account Tokens.
§3.2
OK
revocation_endpoint published
Revokes Account Tokens (sign-out).
§3.2
Routes
OK
Offers: company agent
At least one of agent, apis or web is listed.
§3.1
OK
Company agent reachable over Personal Agent Protocol conversations
A conversation endpoint of type poppy is listed.
§7.1

poppy.json as served

0.3 KB
{
    "protocol_version": "0.1",
    "organization": {
        "name": "Emora Health",
        "domain": "emorahealth.com"
    },
    "auth": {
        "issuer": "https://www.emorahealth.com/poppy"
    },
    "agent": {
        "protocols": [
            {
                "type": "poppy",
                "endpoint": "https://www.emorahealth.com/poppy/conversations"
            }
        ]
    }
}

OAuth server metadata as served

0.8 KB
{
    "issuer": "https://www.emorahealth.com/poppy",
    "token_endpoint": "https://www.emorahealth.com/poppy/oauth/token",
    "revocation_endpoint": "https://www.emorahealth.com/poppy/oauth/revoke",
    "poppy_domains": [
        "emorahealth.com"
    ],
    "grant_types_supported": [
        "urn:ietf:params:oauth:grant-type:jwt-bearer"
    ],
    "token_endpoint_auth_methods_supported": [
        "private_key_jwt"
    ],
    "token_endpoint_auth_signing_alg_values_supported": [
        "ES256",
        "RS256"
    ],
    "revocation_endpoint_auth_methods_supported": [
        "private_key_jwt"
    ],
    "dpop_signing_alg_values_supported": [
        "ES256",
        "ES384",
        "RS256",
        "PS256",
        "EdDSA"
    ],
    "scopes_supported": [],
    "client_id_metadata_document_supported": true,
    "service_documentation": "https://www.emorahealth.com/developers"
}

Rules from Personal Agent Protocol draft 0.1 (updated 12 Oct 2026). Section numbers refer to the specification. The draft can change before a stable version; see the path to 1.0.