Personal Agent Protocol draft 0.2 published, draft 0.3 in progress · What changes in poppy.json →
PAP Checker
PAP Checker/Sites/vzlabnb.com
PAP discovery report

vzlabnb.com

Publishes a poppy.json with no problems found. Organization: VzlaBnB.

Publishes poppy.json
0problems
HTTP 200 Version 0.2 Routes APIs, web Checked 2 hours ago First seen 5 Nov 2026
Open poppy.json ↗
Findings12 passed · 2 notes
Discovery
OK
poppy.json published
Served over HTTPS at /.well-known/poppy.json.
§3
OK
Protocol version 0.2
Checked against the rules of draft 0.2, the version the document declares.
§3.1
OK
organization.domain matches the host that serves it
It must be the host that serves the document, after any redirects, compared ignoring case.
§3.1
Sign-in
OK
OAuth issuer: https://vzlabnb.com/poppy
An HTTPS issuer identifier.
§3.1
Note
No sign-in types: signed-out sessions only
With none of direct, device or mediated, the company offers only signed-out Sessions.
§4.4
Sign-in server
OK
OAuth server metadata published
Found at the issuer (RFC 8414).
§3.2
OK
issuer matches auth.issuer
Exact match, as agents must check.
§3.2
OK
poppy_domains lists vzlabnb.com
The issuer confirms this domain may use it.
§3.2
OK
DPoP algorithms published: ES256
dpop_signing_alg_values_supported lists ES256, which every company must accept.
§3.2, §4.3
OK
token_endpoint published
Issues Session and Account Tokens.
§3.2
OK
revocation_endpoint published
Revokes Account Tokens (sign-out).
§3.2
Routes
OK
Offers: APIs, website
At least one of agent, apis or web is listed.
§3.1
Note
Website: signed-out browsing
No browser_session_endpoint, so personal agents browse the site as ordinary signed-out visitors.
§5
APIs
OK
apis[0]: OpenAPI 3.1.1 description
Reachable, and a version the draft allows (3.0 or 3.1).
§6

poppy.json as served

0.4 KB
{
    "protocol_version": "0.2",
    "organization": {
        "name": "VzlaBnB",
        "domain": "vzlabnb.com"
    },
    "auth": {
        "issuer": "https://vzlabnb.com/poppy"
    },
    "apis": [
        {
            "type": "openapi",
            "url": "https://vzlabnb.com/poppy/openapi.json",
            "resource": "https://vzlabnb.com/poppy/stays",
            "description": "Public stays, indicative rates and temporary guest suggestions. Suggestions expire after 30 days and never reserve inventory; only administrators can create reservations."
        }
    ],
    "web": {}
}

OAuth server metadata as served

0.4 KB
{
    "issuer": "https://vzlabnb.com/poppy",
    "token_endpoint": "https://vzlabnb.com/poppy/token",
    "revocation_endpoint": "https://vzlabnb.com/poppy/revoke",
    "grant_types_supported": [
        "urn:ietf:params:oauth:grant-type:jwt-bearer"
    ],
    "token_endpoint_auth_methods_supported": [
        "private_key_jwt"
    ],
    "token_endpoint_auth_signing_alg_values_supported": [
        "ES256"
    ],
    "dpop_signing_alg_values_supported": [
        "ES256"
    ],
    "poppy_domains": [
        "vzlabnb.com"
    ]
}

Each document is checked against the Personal Agent Protocol draft it declares in protocol_version: 0.1, 0.2 or 0.3. Section numbers refer to that draft's specification. Drafts 0.1 and 0.2 are published and frozen; draft 0.3 is in progress, and any draft can change before a stable version; see the path to 1.0.