PAP discovery report

x402broker.com

Publishes a poppy.json with no problems found. Organization: X402-BROKER — Universal A2A, MCP & x402 Clearinghouse.

Publishes poppy.json

0problems

HTTP 200 Version 0.2 Sign-in direct, device, mediated Routes agent, APIs, web Checked 14 hours ago First seen 30 Oct 2026

Open poppy.json ↗

Findings18 passed · 2 notes

Discovery

OK

poppy.json published

Served over HTTPS at /.well-known/poppy.json.

§3

OK

Protocol version 0.2

Checked against the rules of draft 0.2, the version the document declares.

§3.1

OK

organization.domain matches the host that serves it

It must be the host that serves the document, after any redirects, compared ignoring case.

§3.1

Sign-in

OK

OAuth issuer: https://x402broker.com

An HTTPS issuer identifier.

§3.1

OK

Sign-in types: direct, device, mediated

How a user can sign in through a personal agent.

§4.4

Note

Accepts credentials from personal agents (mediated)

A company offering Mediated Sign-In must rate-limit attempts and should require a one-time code when a sign-in looks unusual.

§4.7

Sign-in server

OK

OAuth server metadata published

Found at the issuer (RFC 8414).

§3.2

OK

issuer matches auth.issuer

Exact match, as agents must check.

§3.2

OK

poppy_domains lists x402broker.com

The issuer confirms this domain may use it.

§3.2

OK

DPoP algorithms published: ES256

dpop_signing_alg_values_supported lists ES256, which every company must accept.

§3.2, §4.3

OK

token_endpoint published

Issues Session and Account Tokens.

§3.2

OK

revocation_endpoint published

Revokes Account Tokens (sign-out).

§3.2

OK

authorization_endpoint published

Starts Direct Sign-In.

§3.2

OK

device_authorization_endpoint published

Starts Device Sign-In.

§3.2

Routes

OK

Offers: company agent, APIs, website

At least one of agent, apis or web is listed.

§3.1

OK

Company agent reachable over Personal Agent Protocol conversations

A conversation endpoint of type poppy is listed.

§7.1

OK

Website joins the agent's session

A browser_session_endpoint is listed, so web pages apply the session's sign-in and scopes.

§5

APIs

Note

apis[0]: OpenAPI description not checked

It is larger than the 2 MB PAP Checker downloads, so we did not read it. The protocol sets no size limit for it. https://x402broker.com/openapi.json

§6

Feedback

OK

Feedback endpoint listed

Personal agents can tell the company where they got stuck (kind, task and a description with no identifiers).

§8

Extensions

OK

Supports the operations extension

§3.3

poppy.json as served

1.6 KB

{
    "protocol_version": "0.2",
    "organization": {
        "name": "X402-BROKER — Universal A2A, MCP & x402 Clearinghouse",
        "domain": "x402broker.com"
    },
    "auth": {
        "issuer": "https://x402broker.com",
        "direct": {
            "scopes": [
                "poppy:read",
                "poppy:write",
                "execute:tools"
            ]
        },
        "device": {
            "scopes": [
                "poppy:read",
                "poppy:write",
                "execute:tools"
            ]
        },
        "mediated": {
            "endpoint": "https://x402broker.com/poppy/sign-in",
            "fields": [
                {
                    "name": "email",
                    "label": "Work Email",
                    "secret": false
                },
                {
                    "name": "api_key",
                    "label": "API Key or Passphrase",
                    "secret": true
                }
            ],
            "scopes": [
                "poppy:read",
                "poppy:write",
                "execute:tools"
            ]
        },
        "custom_scopes": {
            "execute:tools": "Execute B2A, MCP, and A2A tools and multi-agent workflows"
        }
    },
    "agent": {
        "protocols": [
            {
                "type": "poppy",
                "endpoint": "https://x402broker.com/poppy/conversations"
            }
        ]
    },
    "web": {
        "browser_session_endpoint": "https://x402broker.com/poppy/browser-session"
    },
    "feedback": {
        "endpoint": "https://x402broker.com/poppy/feedback"
    },
    "apis": [
        {
            "type": "openapi",
            "url": "https://x402broker.com/openapi.json",
            "description": "OpenAPI 3.1 REST & B2A specification for X402-BROKER — Universal A2A, MCP & x402 Clearinghouse (x402broker.com)"
        }
    ],
    "extensions": {
        "operations": {
            "version": "1",
            "endpoint": "https://x402broker.com/poppy/operations"
        }
    }
}

OAuth server metadata as served

2.1 KB

{
    "issuer": "https://x402broker.com",
    "authorization_endpoint": "https://x402broker.com/oauth/authorize",
    "token_endpoint": "https://x402broker.com/oauth/token",
    "revocation_endpoint": "https://x402broker.com/oauth/revoke",
    "device_authorization_endpoint": "https://x402broker.com/oauth/device",
    "jwks_uri": "https://x402broker.com/.well-known/jwks.json",
    "registration_endpoint": "https://x402broker.com/v1/wallet",
    "poppy_domains": [
        "x402broker.com"
    ],
    "dpop_signing_alg_values_supported": [
        "ES256"
    ],
    "client_id_metadata_document_supported": true,
    "authorization_response_iss_parameter_supported": true,
    "scopes_supported": [
        "poppy:read",
        "poppy:write",
        "execute:tools",
        "mcp:read",
        "mcp:tools",
        "a2a:invoke"
    ],
    "response_types_supported": [
        "code",
        "token"
    ],
    "grant_types_supported": [
        "urn:ietf:params:oauth:grant-type:jwt-bearer",
        "authorization_code",
        "urn:ietf:params:oauth:grant-type:device_code",
        "refresh_token",
        "client_credentials",
        "urn:ietf:params:oauth:grant-type:token-exchange",
        "urn:workos:agent-auth:grant-type:claim",
        "urn:workos:agent-auth:grant-type:identity",
        "urn:workos:agent-auth:grant-type:assertion"
    ],
    "token_endpoint_auth_methods_supported": [
        "private_key_jwt",
        "client_secret_basic",
        "client_secret_post",
        "none"
    ],
    "token_endpoint_auth_signing_alg_values_supported": [
        "ES256",
        "EdDSA",
        "RS256"
    ],
    "code_challenge_methods_supported": [
        "S256"
    ],
    "service_documentation": "https://x402broker.com/auth.md",
    "agent_auth": {
        "version": "1.0",
        "skill": "https://x402broker.com/auth.md",
        "identity_endpoint": "https://x402broker.com/agent/identity",
        "claim_endpoint": "https://x402broker.com/agent/claim",
        "events_endpoint": "https://x402broker.com/agent/events",
        "identity_types_supported": [
            "anonymous",
            "identity_assertion",
            "service_auth"
        ],
        "identity_assertion": {
            "assertion_types_supported": [
                "urn:ietf:params:oauth:token-type:id-jag"
            ]
        }
    }
}