Agent report card
Can an agent use Stripe Payments API through API payment lifecycle?
Grade C: Terms are readable but materially incomplete, ambiguous, contextual, or unstable.
Stripe / active
Five-stage assessment
Where agent autonomy holds and where it breaks
- EvaluateLimited
- Sign upLimited
- PayLimited
- ProvisionLimited
- OperateLimited
Terms are readable but materially incomplete, ambiguous, contextual, or unstable.
Only some material eligibility conditions are decidable before commitment.
The exact service and stable evaluation or access entrypoints are publicly discoverable.
Price or no-charge status, variables, currency, and material conditions are explicit.
Evidence and actions6 signals
Can an agent decide every material eligibility condition before commitment?
supported: freshOnly some material eligibility conditions are decidable before commitment.
Stripe Services Agreement specifies requirements such as account country and full authority for representatives accepting on behalf of a user. However, detailed eligibility conditions depend on specific Service Terms and account details.
Can an agent estimate cost or confirm no-charge status before commitment?
supported: freshPrice or no-charge status, variables, currency, and material conditions are explicit.
Stripe discloses rates, currencies, and conditions for payment features on its pricing resource, including specific per-transaction fees (e.g., 3D Secure attempt fees and percentage-based conversion or payout fees).
Can an agent find the exact service and its stable entrypoints?
supported: freshThe exact service and stable evaluation or access entrypoints are publicly discoverable.
The Stripe API Reference publicly documents the exact service entrypoints, including the base URL https://api.stripe.com, authentication options, and resources.
Are verified structured discovery artifacts available?
missing: unknownCurrent admissible evidence does not resolve this finding.
Can an agent retrieve and understand the applicable commitment terms?
supported: freshTerms are readable but materially incomplete, ambiguous, contextual, or unstable.
The Stripe Services Agreement provides general terms, fee structures, and dispute terms, but notes that product-specific Services Terms apply separately based on the specific services used.
Does the vendor deliberately describe access for web agents?
missing: unknownCurrent admissible evidence does not resolve this finding.
What would improve this stage
- Publish complete applicable terms at a stable public URL.
- State every material eligibility condition and required input explicitly.
Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.
A stable canonical route begins the required access bootstrap.
Evidence and actions5 signals
Can an agent operate the access controls and safe handoffs deterministically?
supported: freshCurrent admissible evidence does not resolve this finding.
The captured registration endpoint returned an incompatible browser error page, leaving access control operability unresolved.
Is there a stable route to begin obtaining service access?
supported: freshA stable canonical route begins the required access bootstrap.
A stable signup route is established by the registration page metadata at https://dashboard.stripe.com/register.
Can an agent obtain access without an unsupported CAPTCHA boundary?
supported: freshCurrent admissible evidence does not resolve this finding.
Both captured targets returned an incompatible browser message, so CAPTCHA requirements cannot be determined.
Can an agent obtain scoped, revocable authority for this service?
supported: freshMachine credentials exist but require manual copying, broad authority, or weak lifecycle support.
Stripe supports restricted API keys (RAKs) with limited permissions, but managing and revealing them relies on manual action via the Dashboard.
Can required phone verification be completed through a supported boundary?
supported: freshCurrent admissible evidence does not resolve this finding.
The captured signup page rendered an incompatible browser error, leaving phone verification requirements unresolved.
What would improve this stage
- Provide scoped delegated authorization with consent, revocation, and deterministic resumption.
The public commitment omits a material component until later in the flow.
Self-service is tier- or condition-limited, or a bounded vendor review exposes status.
Evidence and actions4 signals
Can an agent construct checkout, hand off approval safely, and resume?
supported: freshCurrent admissible evidence does not resolve this finding.
The retained evidence mentions Checkout as a prebuilt payment UI but does not provide sufficient detail to establish deterministic construction, approval handoff, and resumption.
Is the exact commercial commitment disclosed before authorization?
supported: freshThe public commitment omits a material component until later in the flow.
Stripe discloses standard pay-as-you-go card processing rates (e.g., 1.7% + A$0.30 for domestic cards in AUD) and billing rates (0.7% of volume or A$930.00/month), but custom pricing packages, volume discounts, and conversion fees starting at 2% require contextual or deferred determination.
Can payment be authorized within scoped agent or explicit human authority?
supported: freshCurrent admissible evidence does not resolve this finding.
The evidence references accepting credit and debit cards, digital wallets, Buy Now Pay Later, PayTo, and BECS Direct Debit, but does not document a delegated agent rail or human-confirmed authorization flow with receipts.
Is a direct self-service path to paid access documented?
supported: freshSelf-service is tier- or condition-limited, or a bounded vendor review exposes status.
Self-service sign-up is available for the Standard pay-as-you-go pricing plan via a 'Get started' link, but the Custom pricing package requires contacting sales.
What would improve this stage
- Disclose the complete commitment before payment authorization.
- Document a direct purchase path or bounded vendor review with machine-readable status.
Delivery needs additional human transfer or has weak scope or lifecycle semantics.
Provisioning is machine-triggerable or follows deterministically from an allowed handoff.
A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.
Evidence and actions3 signals
Can usable access material be delivered securely to an authorized agent?
supported: freshDelivery needs additional human transfer or has weak scope or lifecycle semantics.
Stripe API keys are managed in the Dashboard. In live mode, secret keys are displayed once before saving and cannot be revealed later, requiring human copy-paste transfer.
Can an agent determine successful provisioning completion and reconcile asynchronous failure?
supported: freshA synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.
PaymentIntents return synchronous status responses (such as requires_payment_method) or move asynchronously through processing, succeeded, and requires_payment_method states with corresponding payment_intent.succeeded and payment_intent.payment_failed webhooks to reconcile outcomes.
Can provisioning be initiated within supported agent authority?
supported: freshProvisioning is machine-triggerable or follows deterministically from an allowed handoff.
PaymentIntents can be machine-triggered programmatically via POST requests to /v1/payment_intents.
What would improve this stage
- Deliver scoped access material through a secure documented machine-usable flow.
Only part of the credential lifecycle is agent-operable.
Every essential target has a stable documented agent-usable interface alternative.
Request-time authentication is documented and usable under scoped agent authority.
Essential operations have stable readable request, response, and effect semantics.
Applicable limits, errors, retry, idempotency, cancellation, and reconciliation semantics are documented.
Evidence and actions6 signals
Is an agent-native protocol interface verified against the essential targets?
missing: unknownCurrent admissible evidence does not resolve this finding.
Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?
supported: freshOnly part of the credential lifecycle is agent-operable.
Stripe documents that API keys can be rotated, expired, and revoked upon compromise. However, rotation and revocation steps are documented via manual actions in the Stripe Dashboard.
Can an agent handle applicable failure modes safely?
supported: freshApplicable limits, errors, retry, idempotency, cancellation, and reconciliation semantics are documented.
Stripe documents API error response HTTP status codes, error types, rate limits (429 errors recommending exponential backoff), and idempotency mechanics via the Idempotency-Key header for safely retrying POST requests.
Can an agent authenticate service operations with scoped authority?
supported: freshRequest-time authentication is documented and usable under scoped agent authority.
Stripe documents API key authentication over HTTPS using test mode keys or restricted API keys (RAKs) configured with specific permissions to scope authority.
Are essential operation inputs, outputs, and effects stable and decidable?
supported: freshEssential operations have stable readable request, response, and effect semantics.
Essential operations and input/output semantics are documented across the API reference, HTTP status code response specifications, idempotency options, and test environment sandboxes.
- payments-api
Can an agent perform every essential assessment target through a usable interface?
supported: freshEvery essential target has a stable documented agent-usable interface alternative.
Stripe provides machine-operable interfaces across HTTP REST endpoints, official SDK client libraries (such as Ruby, Python, Node.js), and the Stripe CLI for interacting with and testing API targets.
- payments-api
What would improve this stage
- Provide scoped expiry, rotation, revocation, compromise, and recovery operations.
What works
No stage is currently established as ready.
What blocks agents
- Evaluate: Terms are readable but materially incomplete, ambiguous, contextual, or unstable.
- Sign up: Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.
- Pay: The public commitment omits a material component until later in the flow.
- Provision: Delivery needs additional human transfer or has weak scope or lifecycle semantics.
- Operate: Only part of the credential lifecycle is agent-operable.
Startup offers
Stripe on the startup-offers board
- Credits to offset Stripe fees and special pricing on Stripe invoicesStripe Startup Programme
- $20,000 in payment processing credit$20,000 in Processing Credit
Improve the report
Correct it, rerun it, or improve the funnel.
- Profile
- arp_01kzf0m4xk6m1tb8d5y3pr9wg2
- Projection
- sha256:3bd6c6cb6971100a485d73aaab3be57a4c75fc790b661cf1c745bead1251a73c
- Policy
- service-use-2026-08-20-public-evidence-r9 · sha256:57bf95fd6d0fe6fe9173a68b60e8d8dc2179b357c88ff4349675a72d0e1d4139
Every request carries these exact identifiers.How report cards are assessed →View the exact declaration