Personal Agent Protocol draft 0.2 published, draft 0.3 in progress · What changes in poppy.json →
PAP Checker/Sites/ticketfairy.com
PAP discovery report

ticketfairy.com

Publishes a poppy.json with no problems found. Organization: Ticket Fairy.

Publishes poppy.json
0problems
HTTP 200 Version 0.2 Sign-in direct, device Routes agent, APIs, web Checked 14 hours ago First seen 30 Oct 2026
Open poppy.json ↗
Findings18 passed · 4 notes
Discovery
OK
poppy.json published
Served over HTTPS at /.well-known/poppy.json.
§3
Note
Served after 1 redirect
Allowed when every hop is HTTPS. The document speaks for the host that serves it after the redirects, so organization.domain must name that host. Final URL: https://www.ticketfairy.com/.well-known/poppy.json
§3
OK
Protocol version 0.2
Checked against the rules of draft 0.2, the version the document declares.
§3.1
OK
organization.domain matches the host that serves it
It must be the host that serves the document, after any redirects, compared ignoring case.
§3.1
Sign-in
OK
OAuth issuer: https://www.ticketfairy.com
An HTTPS issuer identifier.
§3.1
OK
Sign-in types: direct, device
How a user can sign in through a personal agent.
§4.4
Sign-in server
OK
OAuth server metadata published
Found at the issuer (RFC 8414).
§3.2
OK
issuer matches auth.issuer
Exact match, as agents must check.
§3.2
OK
poppy_domains lists www.ticketfairy.com
The issuer confirms this domain may use it.
§3.2
OK
DPoP algorithms published: ES256, RS256
dpop_signing_alg_values_supported lists ES256, which every company must accept.
§3.2, §4.3
OK
token_endpoint published
Issues Session and Account Tokens.
§3.2
OK
revocation_endpoint published
Revokes Account Tokens (sign-out).
§3.2
OK
authorization_endpoint published
Starts Direct Sign-In.
§3.2
OK
device_authorization_endpoint published
Starts Device Sign-In.
§3.2
Routes
OK
Offers: company agent, APIs, website
At least one of agent, apis or web is listed.
§3.1
OK
Company agent reachable over Personal Agent Protocol conversations
A conversation endpoint of type poppy is listed.
§7.1
Note
Website: signed-out browsing
No browser_session_endpoint, so personal agents browse the site as ordinary signed-out visitors.
§5
APIs
OK
apis[0]: OpenAPI 3.1.0 description
Reachable, and a version the draft allows (3.0 or 3.1).
§6
Note
apis[1]: MCP server takes Bearer tokens only
Its protected resource metadata lists no dpop_signing_alg_values_supported, so agents get Bearer tokens for it. Draft 0.2 says new MCP servers should support DPoP; leaving it out is meant for existing servers that cannot verify proofs yet.
§4.3, §6
OK
apis[1]: MCP server names the company's issuer
Its protected resource metadata lists auth.issuer in authorization_servers, so MCP clients can sign in.
§6
Note
apis[2]: MCP server takes Bearer tokens only
Its protected resource metadata lists no dpop_signing_alg_values_supported, so agents get Bearer tokens for it. Draft 0.2 says new MCP servers should support DPoP; leaving it out is meant for existing servers that cannot verify proofs yet.
§4.3, §6
OK
apis[2]: MCP server names the company's issuer
Its protected resource metadata lists auth.issuer in authorization_servers, so MCP clients can sign in.
§6

poppy.json as served

1.2 KB
{
    "protocol_version": "0.2",
    "organization": {
        "name": "Ticket Fairy",
        "domain": "www.ticketfairy.com"
    },
    "auth": {
        "issuer": "https://www.ticketfairy.com",
        "direct": {
            "scopes": [
                "poppy:read"
            ]
        },
        "device": {
            "scopes": [
                "poppy:read"
            ]
        }
    },
    "agent": {
        "protocols": [
            {
                "type": "poppy",
                "endpoint": "https://www.ticketfairy.com/api/v1/poppy/conversations"
            }
        ]
    },
    "web": {},
    "apis": [
        {
            "type": "openapi",
            "url": "https://www.ticketfairy.com/api/v1/poppy/openapi.json",
            "description": "Search live events, and read the signed-in buyer's orders and tickets."
        },
        {
            "type": "mcp",
            "url": "https://www.ticketfairy.com/agentic/mcp",
            "description": "Search live public events and read one event."
        },
        {
            "type": "mcp",
            "url": "https://www.ticketfairy.com/docs/mcp",
            "description": "Search and read the Ticket Fairy how-to guides."
        }
    ]
}

OAuth server metadata as served

2.9 KB
{
    "issuer": "https://www.ticketfairy.com",
    "authorization_endpoint": "https://www.ticketfairy.com/oauth/authorize",
    "token_endpoint": "https://www.ticketfairy.com/api/v1/oauth/access_token",
    "scopes_supported": [
        "profile",
        "poppy:read"
    ],
    "response_types_supported": [
        "code"
    ],
    "response_modes_supported": [
        "query"
    ],
    "grant_types_supported": [
        "authorization_code",
        "refresh_token",
        "urn:workos:agent-auth:grant-type:claim",
        "urn:ietf:params:oauth:grant-type:jwt-bearer",
        "urn:ietf:params:oauth:grant-type:device_code"
    ],
    "token_endpoint_auth_methods_supported": [
        "client_secret_post",
        "none",
        "private_key_jwt"
    ],
    "code_challenge_methods_supported": [
        "S256"
    ],
    "client_id_metadata_document_supported": true,
    "service_documentation": "https://ticketfairy.com/auth.md",
    "agent_auth": {
        "skill": "https://ticketfairy.com/auth.md",
        "identity_endpoint": "https://www.ticketfairy.com/api/v1/agent/identity",
        "register_uri": "https://www.ticketfairy.com/api/v1/agent/identity",
        "identity_types_supported": [
            "service_auth",
            "identity_assertion"
        ],
        "service_auth": {
            "token_endpoint": "https://www.ticketfairy.com/api/v1/oauth/access_token",
            "grant_types_supported": [
                "urn:workos:agent-auth:grant-type:claim"
            ],
            "credential_types_supported": [
                "access_token",
                "refresh_token"
            ]
        },
        "identity_assertion": {
            "assertion_types_supported": [
                "verified_email"
            ]
        },
        "oauth_authorization_code": {
            "authorization_endpoint": "https://www.ticketfairy.com/oauth/authorize",
            "token_endpoint": "https://www.ticketfairy.com/api/v1/oauth/access_token",
            "code_challenge_methods_supported": [
                "S256"
            ],
            "credential_types_supported": [
                "access_token",
                "refresh_token"
            ]
        },
        "personal_access_token": {
            "issue_uri": "https://manage.ticketfairy.com/account",
            "credential_types_supported": [
                "access_token"
            ]
        },
        "revocation_uri": "https://www.theticketfairy.com/api/oauth/sessions"
    },
    "device_authorization_endpoint": "https://www.ticketfairy.com/api/v1/oauth/device",
    "token_endpoint_auth_signing_alg_values_supported": [
        "ES256",
        "RS256"
    ],
    "dpop_signing_alg_values_supported": [
        "ES256",
        "RS256"
    ],
    "revocation_endpoint": "https://www.ticketfairy.com/api/v1/oauth/revoke",
    "revocation_endpoint_auth_methods_supported": [
        "private_key_jwt"
    ],
    "poppy_domains": [
        "www.ticketfairy.com"
    ]
}

Each document is checked against the Personal Agent Protocol draft it declares in protocol_version: 0.1, 0.2 or 0.3. Section numbers refer to that draft's specification. Drafts 0.1 and 0.2 are published and frozen; draft 0.3 is in progress, and any draft can change before a stable version; see the path to 1.0.