{ "contract": "sourcey.site-record/v1alpha1", "release_id": "sha256:5f55a0147eca9a82d821b7cfb73339dd8059c146b9acbb6ed66c9e3d40a8e1b0", "snapshot_id": "sha256:fbf4583b80f8936d9b7b75906adc86f38f5612cd0a7329839daea7b71ad2b9ce", "artifact_sha256": "sha256:ec393385ec4e7be15a393d925f0df78d54a12787f2995a84fad1b570583dac06", "data": { "entity_id": "ent_01kyygma830fqh16kvj744sk1c", "entity_slug": "stripe", "profile": { "projection_contract": "sourcey.agent-readiness-projection/v1alpha1", "agent_readiness_profile_id": "arp_01kzf0m4xk6m1tb8d5y3pr9wg2", "entity_id": "ent_01kyygma830fqh16kvj744sk1c", "scope": { "product": { "key": "stripe-payments-api", "name": "Stripe Payments API" }, "funnel": { "key": "api-payment-lifecycle", "name": "API payment lifecycle" } }, "catalog_binding": { "base_release_id": "sha256:8986cb1640fd748dd005e5c94c7b02d3f44a3d39ff6b72573091bd81af84c61e", "entity_revision_digest": "sha256:13a1e13a935baf054379e0920ee70976c984b5f482098bed447cd0a4554b7afe" }, "declaration_revision_digest": "sha256:a81bdfbb491f2fe21afdd527f05027fbd7b85f25ea725043056eab981f9aff56", "declaration": { "declaration_id": "declaration_stripe_payments_api_lifecycle", "provenance": { "repository": "sourcey/agent-ready-services", "commit": "ca383f7867c18d91567fcb8326be55f7411d9554", "path": "entities/st/stripe.yaml", "git_blob_oid": "2541a4324bf3163306f1d84a27179ed55ce583ca", "blob_digest": "sha256:4071d4ed229dab1899832182b2f7fe5169e79aebb6930794c4c7853f89529a40" }, "status": "community_declared" }, "surface_catalog": { "assessment_targets": [ { "target_id": "service-use", "name": "Create and reconcile payments through the Payments API", "interface_ids": [ "payments-api" ] } ], "participants": [ { "participant_id": "stripe", "roles": [ "access_operator", "identity_provider", "operations_provider", "payment_provider", "provisioning_provider", "subject" ], "identity": { "entity_id": "ent_01kyygma830fqh16kvj744sk1c" } } ], "resources": [ { "resource_id": "api-errors", "uri": "https://docs.stripe.com/api/errors", "roles": [ "documentation", "operations", "recovery", "status" ], "operated_by_participant_id": "stripe", "standard_bindings": [] }, { "resource_id": "api-reference", "uri": "https://docs.stripe.com/api", "roles": [ "discovery", "documentation", "operations" ], "operated_by_participant_id": "stripe", "standard_bindings": [] }, { "resource_id": "authentication", "uri": "https://docs.stripe.com/api/authentication", "roles": [ "authentication", "descriptor", "documentation" ], "operated_by_participant_id": "stripe", "standard_bindings": [] }, { "resource_id": "credential-lifecycle", "uri": "https://docs.stripe.com/keys.md", "roles": [ "authentication", "documentation", "operations", "provisioning", "recovery" ], "operated_by_participant_id": "stripe", "standard_bindings": [] }, { "resource_id": "dashboard-signup", "uri": "https://dashboard.stripe.com/register", "roles": [ "access" ], "operated_by_participant_id": "stripe", "standard_bindings": [] }, { "resource_id": "idempotency", "uri": "https://docs.stripe.com/api/idempotent_requests", "roles": [ "documentation", "operations", "recovery" ], "operated_by_participant_id": "stripe", "standard_bindings": [] }, { "resource_id": "payment-intents-create", "uri": "https://docs.stripe.com/api/payment_intents/create", "roles": [ "documentation", "provisioning", "status" ], "operated_by_participant_id": "stripe", "standard_bindings": [] }, { "resource_id": "pricing", "uri": "https://stripe.com/pricing", "roles": [ "checkout", "documentation", "pricing" ], "operated_by_participant_id": "stripe", "standard_bindings": [] }, { "resource_id": "service-terms", "uri": "https://stripe.com/legal/ssa", "roles": [ "terms" ], "operated_by_participant_id": "stripe", "standard_bindings": [] }, { "resource_id": "support", "uri": "https://support.stripe.com/", "roles": [ "documentation", "recovery" ], "operated_by_participant_id": "stripe", "standard_bindings": [] }, { "resource_id": "testing", "uri": "https://docs.stripe.com/testing", "roles": [ "documentation", "provisioning", "status" ], "operated_by_participant_id": "stripe", "standard_bindings": [] } ], "endpoints": [ { "endpoint_id": "registration", "uri": "https://dashboard.stripe.com/register", "transport": "http", "roles": [ "registration" ], "operated_by_participant_id": "stripe", "standard_bindings": [] }, { "endpoint_id": "stripe-api", "uri": "https://api.stripe.com/v1", "transport": "http", "roles": [ "service", "status" ], "operated_by_participant_id": "stripe", "standard_bindings": [] } ], "interfaces": [ { "interface_id": "api-authentication", "modality": "network_api", "functions": [ "authentication", "recovery" ], "endpoint_ids": [], "resource_ids": [ "authentication", "credential-lifecycle" ], "operated_by_participant_id": "stripe", "standard_bindings": [] }, { "interface_id": "payments-api", "modality": "network_api", "functions": [ "commerce", "service_operation" ], "endpoint_ids": [ "stripe-api" ], "resource_ids": [ "api-errors", "api-reference", "idempotency", "testing" ], "operated_by_participant_id": "stripe", "standard_bindings": [] } ], "relations": [ { "relation_id": "authentication-authenticates-api", "kind": "authenticates", "from": { "node_kind": "interface", "node_id": "api-authentication" }, "to": { "node_kind": "interface", "node_id": "payments-api" } }, { "relation_id": "credential-lifecycle-describes-authentication", "kind": "describes", "from": { "node_kind": "resource", "node_id": "credential-lifecycle" }, "to": { "node_kind": "interface", "node_id": "api-authentication" } }, { "relation_id": "idempotency-describes-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "idempotency" }, "to": { "node_kind": "interface", "node_id": "payments-api" } }, { "relation_id": "payment-intents-create-describes-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "payment-intents-create" }, "to": { "node_kind": "interface", "node_id": "payments-api" } }, { "relation_id": "reference-describes-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "api-reference" }, "to": { "node_kind": "interface", "node_id": "payments-api" } }, { "relation_id": "signup-precedes-authentication", "kind": "precedes", "from": { "node_kind": "resource", "node_id": "dashboard-signup" }, "to": { "node_kind": "interface", "node_id": "api-authentication" } } ], "surface_exclusions": [ { "exclusion_id": "separate-eligibility-resource", "role": "eligibility", "rationale": "Applicable access conditions are published within the service terms; no separate eligibility resource is declared." } ] }, "lifecycle": "active", "effective_from": "2026-09-06T08:47:58Z", "revision_digest": "sha256:59a44f16c7584a7acf0ca10b15651c79b9bd0f89bd37a472187ae17b4798c6d9", "policy_digest": "sha256:fc9e8f046d86fcf19ab2f1bc547219e503cdc11ffa135d020db7285965cd7d1d", "policy_version": "service-use-2026-09-07-blocking-barriers-r12", "policy_as_of": "2026-09-07T00:00:00Z", "assessment_basis": { "principal": "authorized_human_or_organization", "initial_state": { "product_specific_account": false, "product_credentials": false, "paid_subscription": false, "provisioned_resource": false, "external_identity": "only_when_declared_by_exact_funnel" }, "permitted_human_boundaries": [ "account_ownership_confirmation", "delegated_identity_consent", "regulated_approval", "final_payment_or_irreversible_commitment" ], "required_handoff_properties": [ "exact_disclosure", "resumable_handoff", "deterministic_continuation" ], "forbidden_substitutions": [ "captcha_solving", "human_password_or_session_sharing", "concealed_agent_identity", "invented_eligibility", "unbound_out_of_band_code", "vendor_policy_bypass", "unapproved_consequential_action" ], "success": { "target_coverage": "every_declared_target", "interface_coverage": "at_least_one_declared_alternative", "authority": "scoped", "failure_semantics": "documented", "recovery": "supported" }, "observed_assessment": { "allowed_sources": [ "public_documentation", "public_metadata", "public_endpoints", "non_mutating_interaction", "operator_attested_public_observation" ], "consequential_claims": "certification_required" } }, "overall_outcome": "constrained", "public_state": "limited", "state_label": "Limited", "grade": "C+", "grade_derivation": { "label": "Five-stage Agent Readiness report card", "explanation": "A through C grades count Limited stages; D and F reflect Blocked stages by lifecycle severity.", "coverage_rule": "Coverage is complete only when every graded signal has supported, fresh, non-conflicting evidence. Barrier and informational signals do not change coverage; only fresh, supported barrier values that passed their admission evidence rule participate in stage outcomes.", "outcome_rule": "Each stage takes its worst graded signal or verified barrier. A fresh, supported mandatory barrier that passed its admission evidence rule can block that stage; incomplete or stale barrier evidence remains context only. The overall grade is derived from the five stage states." }, "publication": { "visibility": "discoverable", "reasons": [] }, "primary_finding": { "stage": "sign_up", "stage_label": "Sign up", "public_state": "limited", "finding": { "signal_code": "delegated_identity_access", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.", "context": "Stripe documentation establishes restricted API keys with specific permissions and documents manual revocation/rotation rules when keys are lost, compromised, or team members leave, but leaves creation/issuance manual." } }, "limitations": [ { "stage": "sign_up", "stage_label": "Sign up", "finding": { "signal_code": "delegated_identity_access", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.", "context": "Stripe documentation establishes restricted API keys with specific permissions and documents manual revocation/rotation rules when keys are lost, compromised, or team members leave, but leaves creation/issuance manual." }, "remediation": { "signal_code": "delegated_identity_access", "code": "improve.sign_up.delegated_identity_access", "instruction": "Provide scoped delegated authorization with consent, revocation, and deterministic resumption." } }, { "stage": "pay", "stage_label": "Pay", "finding": { "signal_code": "self_service_purchase", "condition": "Is a direct self-service path to paid access documented?", "finding": "Self-service is tier- or condition-limited, or a bounded vendor review exposes status.", "context": "Stripe provides self-service standard pay-as-you-go card processing pricing starting with zero setup or monthly fees, but notes that large volume or unique business models require contacting sales for a custom package." }, "remediation": { "signal_code": "self_service_purchase", "code": "improve.pay.self_service_purchase", "instruction": "Document a direct purchase path or bounded vendor review with machine-readable status." } }, { "stage": "provision", "stage_label": "Provision", "finding": { "signal_code": "access_material_delivery", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "context": "Stripe API keys are managed in the Dashboard. In live mode, secret keys are displayed only once upon creation for copying, establishing a manual dashboard display path rather than a fully automated agent credential exchange flow." }, "remediation": { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." } }, { "stage": "operate", "stage_label": "Operate", "finding": { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "Stripe API keys can be managed, configured as restricted API keys, and rotated via the Dashboard or managed by hosting platforms. However, credential rotation and revocation depend on manual Dashboard steps or hosting platform automation rather than a direct programmatic agent API." }, "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } } ], "stages": [ { "stage": "evaluate", "stage_label": "Evaluate", "outcome": "pass", "public_state": "ready", "state_label": "Ready", "primary_finding": { "signal_code": "service_discovery", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "The exact service and stable evaluation or access entrypoints are publicly discoverable.", "context": "The Stripe API Reference provides the exact service entrypoints, including the Base URL (https://api.stripe.com) and link to the development quickstart guide." }, "secondary_context": [ { "signal_code": "verified_web_agent_access", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The provided documentation captures do not contain verified web-agent access rules or robots.txt directives for the assessed resources." }, { "signal_code": "eligibility_decidability", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Only some material eligibility conditions are decidable before commitment.", "context": "Stripe Services Agreement General Terms state that the agreement applies based on the User's Stripe Account Country, and that a Representative submitting an application represents they have full authority to legally bind the User. Complete eligibility conditions depend on specific Service Terms and the Prohibited and Restricted Businesses List." }, { "signal_code": "terms_access", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Applicable terms are stable, readable, retrievable, and materially complete.", "context": "The Stripe Services Agreement General Terms are publicly accessible and readable, explicitly governing access to and use of the Services and Stripe Technology." }, { "signal_code": "pricing_decidability", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "Price or no-charge status, variables, currency, and material conditions are explicit.", "context": "Stripe's pricing page explicitly states rates and variables for payment optimisations (e.g., A$0.04 per 3D Secure attempt for custom pricing, A$0.15 for standalone 3DS) and confirms that Stripe does not charge setup fees or monthly fees for standard pricing." }, { "signal_code": "structured_evaluation_discovery", "condition": "Are verified structured discovery artifacts available?", "finding": "Verified structured artifacts accelerate discovery of the evaluation surface.", "context": "The Stripe API Reference explicitly links to structured discovery artifacts, including 'llms.txt' ('LLM? Read llms.txt.')." } ], "signals": [ { "signal_code": "eligibility_decidability", "evaluation_role": "informational", "required": false, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Only some material eligibility conditions are decidable before commitment.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:08.723Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "service-terms" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:b23ffddf46e4f4c5db234593dfee60d6c256d21eec10c86aaea2990d467ae27b", "capture_rung": "http" } ], "artifact_digests": [ "sha256:2b59f5d0545e315ff17ce685f1acafb7d8b8540bacd4bb967c32f4e9e5624e46", "sha256:4f6dec17564079b9bf382a4b088ef5aea2c6cad1141b0c9e481d3cdcf92555eb", "sha256:7dff87c33cb5a4b8a59bacdc71ddf210121c96d6d5393c2585d670d6b6bba5b6", "sha256:ab6a6d00aaf10dc9a120480317dcb84200b40a656b736f02d738646e87494dcb" ], "source_surface": { "node_kind": "resource", "node_id": "service-terms" }, "locators": [ { "artifact_digest": "sha256:7dff87c33cb5a4b8a59bacdc71ddf210121c96d6d5393c2585d670d6b6bba5b6", "start_byte": 11085, "end_byte": 11894, "value_digest": "sha256:bb2e01515c02b348eb318416e38241425c5dd3ea437e9dd9b703ff289f1216e3" }, { "artifact_digest": "sha256:7dff87c33cb5a4b8a59bacdc71ddf210121c96d6d5393c2585d670d6b6bba5b6", "start_byte": 70578, "end_byte": 71400, "value_digest": "sha256:7054ca5d3ccd33127cab701eb3dc6e660a6e090b5d301da518fe77087864921d" } ] } ], "note": "Stripe Services Agreement General Terms state that the agreement applies based on the User's Stripe Account Country, and that a Representative submitting an application represents they have full authority to legally bind the User. Complete eligibility conditions depend on specific Service Terms and the Prohibited and Restricted Businesses List." }, { "signal_code": "pricing_decidability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "Price or no-charge status, variables, currency, and material conditions are explicit.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:40.030Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:7fb10460408ae30009fc9a24380859c0253bbfd57cd7a6d32a8ff0435e66fc57", "capture_rung": "http" } ], "artifact_digests": [ "sha256:1c7cdccf6789cdb3fab1cf56146979c6c847b2e09ea2ecf4a0f6578713f439d7", "sha256:3202ee9afd3c769b0fd94c59ccc537759b8b29b8d5c604a57c77c2e338b63d11", "sha256:a820932c6b5d4941206d306d59fdef2259a89774cf64470f60fc4028667d757e", "sha256:ede4c5bd09a49c2f094e4842f49a3fe97cd8ecf93160cf859873c1c8ba5402d3" ], "source_surface": { "node_kind": "resource", "node_id": "pricing" }, "locators": [ { "artifact_digest": "sha256:3202ee9afd3c769b0fd94c59ccc537759b8b29b8d5c604a57c77c2e338b63d11", "start_byte": 27557, "end_byte": 28346, "value_digest": "sha256:2162297ff8351b439e7a9686334c25a8f19c23e271a0193208344b4d2a0a82ec" }, { "artifact_digest": "sha256:3202ee9afd3c769b0fd94c59ccc537759b8b29b8d5c604a57c77c2e338b63d11", "start_byte": 44300, "end_byte": 45097, "value_digest": "sha256:eb2b39bf1bcb82d809819f5035a52e6c410fd5b57a6d63140918da5e00b78ed5" } ] } ], "note": "Stripe's pricing page explicitly states rates and variables for payment optimisations (e.g., A$0.04 per 3D Secure attempt for custom pricing, A$0.15 for standalone 3DS) and confirms that Stripe does not charge setup fees or monthly fees for standard pricing." }, { "signal_code": "service_discovery", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "The exact service and stable evaluation or access entrypoints are publicly discoverable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:52.306Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-reference" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:bb5bcbc66bceed1cf9e9af9139d1e33b69b13a7510eb8fe7d738e80a5bb3ae4e", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0919a14604b09c2e192ab2b00e28e4f821326b9af0acd56b3113c5eb04616bd3", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:57ce156c02dd322b6cd11391a305922a7c52310f1d9cfa7c8a126273980d1bd5", "sha256:e716624ebcc5a3c8ce6af1607981edbc69aee0f1a855aad9b83f37385d69e375" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:e716624ebcc5a3c8ce6af1607981edbc69aee0f1a855aad9b83f37385d69e375", "start_byte": 10266, "end_byte": 11026, "value_digest": "sha256:c98946e685c7a4c5c2e237256e5c90bfeaf78b6fdfa9fa91fad2aa2a4c4a18f9" } ] } ], "note": "The Stripe API Reference provides the exact service entrypoints, including the Base URL (https://api.stripe.com) and link to the development quickstart guide." }, { "signal_code": "structured_evaluation_discovery", "evaluation_role": "informational", "required": false, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Are verified structured discovery artifacts available?", "finding": "Verified structured artifacts accelerate discovery of the evaluation surface.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:52.306Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-reference" }, { "node_kind": "resource", "node_id": "authentication" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:bb5bcbc66bceed1cf9e9af9139d1e33b69b13a7510eb8fe7d738e80a5bb3ae4e", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:57ce156c02dd322b6cd11391a305922a7c52310f1d9cfa7c8a126273980d1bd5", "sha256:c02410ffde45df8ca64991e2cdb34d8ffc06ea0d1223e617f09fb931a4e1ef83", "sha256:e716624ebcc5a3c8ce6af1607981edbc69aee0f1a855aad9b83f37385d69e375" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:e716624ebcc5a3c8ce6af1607981edbc69aee0f1a855aad9b83f37385d69e375", "start_byte": 16276, "end_byte": 16560, "value_digest": "sha256:b2177832d5145af214dd6f99f48951c782240dd547d5cd234707649fec485ea8" } ] } ], "note": "The Stripe API Reference explicitly links to structured discovery artifacts, including 'llms.txt' ('LLM? Read llms.txt.')." }, { "signal_code": "terms_access", "evaluation_role": "informational", "required": false, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Applicable terms are stable, readable, retrievable, and materially complete.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:08.723Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "service-terms" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:b23ffddf46e4f4c5db234593dfee60d6c256d21eec10c86aaea2990d467ae27b", "capture_rung": "http" } ], "artifact_digests": [ "sha256:2b59f5d0545e315ff17ce685f1acafb7d8b8540bacd4bb967c32f4e9e5624e46", "sha256:4f6dec17564079b9bf382a4b088ef5aea2c6cad1141b0c9e481d3cdcf92555eb", "sha256:7dff87c33cb5a4b8a59bacdc71ddf210121c96d6d5393c2585d670d6b6bba5b6", "sha256:fd4a15a8f2b58f0c1652413f16ad67644dd1ceb20c301085501c8aa44355f206" ], "source_surface": { "node_kind": "resource", "node_id": "service-terms" }, "locators": [ { "artifact_digest": "sha256:7dff87c33cb5a4b8a59bacdc71ddf210121c96d6d5393c2585d670d6b6bba5b6", "start_byte": 10273, "end_byte": 11084, "value_digest": "sha256:bd8d6d8433c9e06ea57bbf594c4c915d8cfde69e2dc7ffe2f7a709adf263e86b" }, { "artifact_digest": "sha256:7dff87c33cb5a4b8a59bacdc71ddf210121c96d6d5393c2585d670d6b6bba5b6", "start_byte": 97121, "end_byte": 97920, "value_digest": "sha256:91ef2c0a03b29b7c9b9e78858eeff147947d0e6f1ba84772c030979be2d5238d" } ] } ], "note": "The Stripe Services Agreement General Terms are publicly accessible and readable, explicitly governing access to and use of the Services and Stripe Technology." }, { "signal_code": "verified_web_agent_access", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:52.306Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-reference" }, { "node_kind": "resource", "node_id": "authentication" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The provided documentation captures do not contain verified web-agent access rules or robots.txt directives for the assessed resources." } ], "blockers": [], "remediations": [] }, { "stage": "sign_up", "stage_label": "Sign up", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "delegated_identity_access", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.", "context": "Stripe documentation establishes restricted API keys with specific permissions and documents manual revocation/rotation rules when keys are lost, compromised, or team members leave, but leaves creation/issuance manual." }, "secondary_context": [ { "signal_code": "access_control_operability", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The captured registration endpoint returned an incompatible browser notice, leaving access control operability unresolved in the current evidence." }, { "signal_code": "captcha_compatible_access", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The captured registration targets returned browser compatibility notices without demonstrating the presence or absence of a CAPTCHA challenge." }, { "signal_code": "phone_verification_compatible", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The registration page capture returned an incompatible browser notice, providing no explicit evidence regarding phone verification requirements or safe handoffs." }, { "signal_code": "access_entrypoint_stability", "condition": "Is there a stable route to begin obtaining service access?", "finding": "A stable canonical route begins the required access bootstrap.", "context": "A stable registration metadata description establishes a sign-up route to create a Stripe account and start accepting payments at https://dashboard.stripe.com/register." } ], "signals": [ { "signal_code": "access_control_operability", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:09.253Z", "tested_surfaces": [ { "node_kind": "endpoint", "node_id": "registration" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The captured registration endpoint returned an incompatible browser notice, leaving access control operability unresolved in the current evidence." }, { "signal_code": "access_entrypoint_stability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is there a stable route to begin obtaining service access?", "finding": "A stable canonical route begins the required access bootstrap.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:09.253Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "dashboard-signup" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "direct_observation", "captures": [ { "retained_capture_digest": "sha256:9110672fd4d6341b1ded42403eb0d71bc5cd7ac291db7458cf004ab9e9e1cd07", "capture_rung": "headless" } ], "artifact_digests": [ "sha256:2c97cdd0d2866e28d7501d57869b1c6a0ac8614279ea489cef01dddcd39b7d71", "sha256:3878570f4a62a0d65f57cf1754e0269e56ec797f4e36e26b44c172eb6e800401", "sha256:4afc7fd88d474f640b7f7b4a3ab15ad645409964125d3a49ba9e96e993ab4c19", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:844e403ebdceb526816f4f356c0656663b1bf848ef232c192362ea9549eea265", "sha256:cd02f5a91146e001e07e0096a897b53f49bdfba025c49ed503c0ccc03de4188c" ], "locators": [ { "artifact_digest": "sha256:cd02f5a91146e001e07e0096a897b53f49bdfba025c49ed503c0ccc03de4188c", "start_byte": 0, "end_byte": 264, "value_digest": "sha256:6ae77c2872ac63a3733bb94ed92ef39aedaea3153fb974bc7d969167abe91785" } ] } ], "note": "A stable registration metadata description establishes a sign-up route to create a Stripe account and start accepting payments at https://dashboard.stripe.com/register." }, { "signal_code": "captcha_compatible_access", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:09.253Z", "tested_surfaces": [ { "node_kind": "endpoint", "node_id": "registration" }, { "node_kind": "resource", "node_id": "dashboard-signup" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The captured registration targets returned browser compatibility notices without demonstrating the presence or absence of a CAPTCHA challenge." }, { "signal_code": "delegated_identity_access", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:39.417Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authentication" }, { "node_kind": "resource", "node_id": "credential-lifecycle" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:d3d98efa30db55985c6e4a535a6d6c20c333c9494cb84349cd41b3def0d6eb68", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5c62c4e9c94441b858d0fa7e7c9b0e40f824625a24d3bdc87cba77cfbb9e71da", "sha256:ac6546ef5aaa320b4193300462306c0f7b4ba9decc413b30b8f109e80ef07901", "sha256:b96d506ebce1e956f1645a16a3e7e715ebcceac78dccfc3b0a05d8aa37585435" ], "source_surface": { "node_kind": "resource", "node_id": "authentication" }, "locators": [ { "artifact_digest": "sha256:b96d506ebce1e956f1645a16a3e7e715ebcceac78dccfc3b0a05d8aa37585435", "start_byte": 9731, "end_byte": 10528, "value_digest": "sha256:b595de453e38bcea7af8ae3c7e460fbaa3e457931182360d629180b48d97487f" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:09abfc629296b7dc0ec2cf91bc86cbab2a555e8d459afeef8f00f52229dfbedb", "capture_rung": "http" } ], "artifact_digests": [ "sha256:3b21b8663134d9b27f92e5292065e838d4d92f3118e605212f00d0ae0932fbe5", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:ad03e6e375856bf2dc9cefbdc7ee199d567c8db672a2e7e5df2dd752c36c8e78", "sha256:d7240f38b0ef68abe2fd07864fc36a3e840ab7447a61908940c26d3bbd0af6cc" ], "source_surface": { "node_kind": "resource", "node_id": "credential-lifecycle" }, "locators": [ { "artifact_digest": "sha256:ad03e6e375856bf2dc9cefbdc7ee199d567c8db672a2e7e5df2dd752c36c8e78", "start_byte": 13585, "end_byte": 13985, "value_digest": "sha256:6f7548cba582eb985ffce79c958a69dcaf4296cc2bc50f15d6775a200f88a810" } ] } ], "note": "Stripe documentation establishes restricted API keys with specific permissions and documents manual revocation/rotation rules when keys are lost, compromised, or team members leave, but leaves creation/issuance manual.", "remediation": { "signal_code": "delegated_identity_access", "code": "improve.sign_up.delegated_identity_access", "instruction": "Provide scoped delegated authorization with consent, revocation, and deterministic resumption." } }, { "signal_code": "phone_verification_compatible", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:09.253Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "dashboard-signup" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The registration page capture returned an incompatible browser notice, providing no explicit evidence regarding phone verification requirements or safe handoffs." } ], "blockers": [], "remediations": [ { "signal_code": "delegated_identity_access", "code": "improve.sign_up.delegated_identity_access", "instruction": "Provide scoped delegated authorization with consent, revocation, and deterministic resumption." } ] }, { "stage": "pay", "stage_label": "Pay", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "self_service_purchase", "condition": "Is a direct self-service path to paid access documented?", "finding": "Self-service is tier- or condition-limited, or a bounded vendor review exposes status.", "context": "Stripe provides self-service standard pay-as-you-go card processing pricing starting with zero setup or monthly fees, but notes that large volume or unique business models require contacting sales for a custom package." }, "secondary_context": [ { "signal_code": "checkout_operability", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained evidence lists Checkout and Payment Links as products, but it does not contain details establishing deterministic checkout construction, approval handoff, and resumption for agents." }, { "signal_code": "payment_authorization", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The evidence mentions 3D Secure authentication and payment authorization, but does not state a documented rail supporting scoped delegation or human-confirmed authorization with receipts." }, { "signal_code": "commitment_disclosure", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "Charge or no-charge status, currency, recurrence, and material conditions are disclosed.", "context": "Stripe discloses pricing for card payments at 1.7% + A$0.30 for domestic cards and 3.5% + A$0.30 for international cards (plus 2% if currency conversion is required), and billing options such as Pay as you go at 0.7% of Billing volume." } ], "signals": [ { "signal_code": "checkout_operability", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:40.030Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained evidence lists Checkout and Payment Links as products, but it does not contain details establishing deterministic checkout construction, approval handoff, and resumption for agents." }, { "signal_code": "commitment_disclosure", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "Charge or no-charge status, currency, recurrence, and material conditions are disclosed.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:40.030Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:7fb10460408ae30009fc9a24380859c0253bbfd57cd7a6d32a8ff0435e66fc57", "capture_rung": "http" } ], "artifact_digests": [ "sha256:1c7cdccf6789cdb3fab1cf56146979c6c847b2e09ea2ecf4a0f6578713f439d7", "sha256:3202ee9afd3c769b0fd94c59ccc537759b8b29b8d5c604a57c77c2e338b63d11", "sha256:a820932c6b5d4941206d306d59fdef2259a89774cf64470f60fc4028667d757e", "sha256:d6671c84868d6e7d051253e76c2b2b9bd72645bd853dbc8c55f71c7c3e82afd5" ], "source_surface": { "node_kind": "resource", "node_id": "pricing" }, "locators": [ { "artifact_digest": "sha256:3202ee9afd3c769b0fd94c59ccc537759b8b29b8d5c604a57c77c2e338b63d11", "start_byte": 21996, "end_byte": 22798, "value_digest": "sha256:9428668473f64c0bc7310eaef4c899c0f813227690eb3ade732e7d7adb2b85c6" }, { "artifact_digest": "sha256:3202ee9afd3c769b0fd94c59ccc537759b8b29b8d5c604a57c77c2e338b63d11", "start_byte": 33930, "end_byte": 34728, "value_digest": "sha256:c8e33c4beeda3e0129bcd2872903729b354122d7fccf795126d0f15f5fdcc6a6" } ] } ], "note": "Stripe discloses pricing for card payments at 1.7% + A$0.30 for domestic cards and 3.5% + A$0.30 for international cards (plus 2% if currency conversion is required), and billing options such as Pay as you go at 0.7% of Billing volume." }, { "signal_code": "payment_authorization", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:40.030Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The evidence mentions 3D Secure authentication and payment authorization, but does not state a documented rail supporting scoped delegation or human-confirmed authorization with receipts." }, { "signal_code": "self_service_purchase", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Is a direct self-service path to paid access documented?", "finding": "Self-service is tier- or condition-limited, or a bounded vendor review exposes status.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:40.030Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:7fb10460408ae30009fc9a24380859c0253bbfd57cd7a6d32a8ff0435e66fc57", "capture_rung": "http" } ], "artifact_digests": [ "sha256:1c7cdccf6789cdb3fab1cf56146979c6c847b2e09ea2ecf4a0f6578713f439d7", "sha256:3202ee9afd3c769b0fd94c59ccc537759b8b29b8d5c604a57c77c2e338b63d11", "sha256:7096bee9cf2df339506a2091cc18ec2102f1f083d9677208e9804a92fec88643", "sha256:a820932c6b5d4941206d306d59fdef2259a89774cf64470f60fc4028667d757e" ], "source_surface": { "node_kind": "resource", "node_id": "pricing" }, "locators": [ { "artifact_digest": "sha256:3202ee9afd3c769b0fd94c59ccc537759b8b29b8d5c604a57c77c2e338b63d11", "start_byte": 21197, "end_byte": 21995, "value_digest": "sha256:abdf90018a9b803fe1c564c903dcdbc94bf831694bb3878501f2797a998e0c92" } ] } ], "note": "Stripe provides self-service standard pay-as-you-go card processing pricing starting with zero setup or monthly fees, but notes that large volume or unique business models require contacting sales for a custom package.", "remediation": { "signal_code": "self_service_purchase", "code": "improve.pay.self_service_purchase", "instruction": "Document a direct purchase path or bounded vendor review with machine-readable status." } } ], "blockers": [], "remediations": [ { "signal_code": "self_service_purchase", "code": "improve.pay.self_service_purchase", "instruction": "Document a direct purchase path or bounded vendor review with machine-readable status." } ] }, { "stage": "provision", "stage_label": "Provision", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "access_material_delivery", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "context": "Stripe API keys are managed in the Dashboard. In live mode, secret keys are displayed only once upon creation for copying, establishing a manual dashboard display path rather than a fully automated agent credential exchange flow." }, "secondary_context": [ { "signal_code": "provisioning_operability", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "context": "Provisioning of PaymentIntent resources is machine-triggerable via an HTTP POST request to /v1/payment_intents using API authentication." }, { "signal_code": "provisioning_completion", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.", "context": "For asynchronous payment methods, PaymentIntents move to a processing state upon confirmation. Terminal outcomes are communicated via webhooks, with payment_intent.succeeded indicating success and payment_intent.payment_failed indicating failure, allowing agents to observe completion and reconcile failure." } ], "signals": [ { "signal_code": "access_material_delivery", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:39.417Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authentication" }, { "node_kind": "resource", "node_id": "credential-lifecycle" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:09abfc629296b7dc0ec2cf91bc86cbab2a555e8d459afeef8f00f52229dfbedb", "capture_rung": "http" } ], "artifact_digests": [ "sha256:3b21b8663134d9b27f92e5292065e838d4d92f3118e605212f00d0ae0932fbe5", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:ad03e6e375856bf2dc9cefbdc7ee199d567c8db672a2e7e5df2dd752c36c8e78", "sha256:d97b57030d4c81cfadc722405922a08b6aedc38bd9c14c98666c17f66e5076f8" ], "source_surface": { "node_kind": "resource", "node_id": "credential-lifecycle" }, "locators": [ { "artifact_digest": "sha256:ad03e6e375856bf2dc9cefbdc7ee199d567c8db672a2e7e5df2dd752c36c8e78", "start_byte": 9689, "end_byte": 10335, "value_digest": "sha256:78b13e60c10859b367d8f291dc34381e603e25fea4fb3847a6acb8d325585f93" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:d3d98efa30db55985c6e4a535a6d6c20c333c9494cb84349cd41b3def0d6eb68", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5c62c4e9c94441b858d0fa7e7c9b0e40f824625a24d3bdc87cba77cfbb9e71da", "sha256:b96d506ebce1e956f1645a16a3e7e715ebcceac78dccfc3b0a05d8aa37585435", "sha256:fd96c5a42b96ec706c706445566fcb502deabd9a13eeb4474219febb52262f9c" ], "source_surface": { "node_kind": "resource", "node_id": "authentication" }, "locators": [ { "artifact_digest": "sha256:b96d506ebce1e956f1645a16a3e7e715ebcceac78dccfc3b0a05d8aa37585435", "start_byte": 8932, "end_byte": 9730, "value_digest": "sha256:fddb86e547ed43ed8faf83ce237c33880621f5ebfbaece6f235beec745c9fa48" } ] } ], "note": "Stripe API keys are managed in the Dashboard. In live mode, secret keys are displayed only once upon creation for copying, establishing a manual dashboard display path rather than a fully automated agent credential exchange flow.", "remediation": { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." } }, { "signal_code": "provisioning_completion", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:08.915Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "payment-intents-create" }, { "node_kind": "resource", "node_id": "testing" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:bb40c833e8fd013c2d769287cb633ca4d28722786d45500fd0ddd5d480f2f188", "capture_rung": "http" } ], "artifact_digests": [ "sha256:1e3564623f84e1c0b87f3946a428e0b09ddae46e17e448020ad598d8cc5ce27f", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:828110c8e2bb4488c0ca87994808b35f431b8a7e76fed639a6229435eb09add8", "sha256:b9a4cf6b468db6a70041c82fde3b40d4857e5dda985079588d7b8153bbe97399" ], "source_surface": { "node_kind": "resource", "node_id": "testing" }, "locators": [ { "artifact_digest": "sha256:b9a4cf6b468db6a70041c82fde3b40d4857e5dda985079588d7b8153bbe97399", "start_byte": 40499, "end_byte": 41299, "value_digest": "sha256:38f85b341564e8a8d31fb255d75c45e07065f279fb0bcd534dcb0a841ffbfc56" }, { "artifact_digest": "sha256:b9a4cf6b468db6a70041c82fde3b40d4857e5dda985079588d7b8153bbe97399", "start_byte": 47619, "end_byte": 48413, "value_digest": "sha256:005cc33e21461bec46ce57ed6b7056e7d13adb26aba9ffecaa24bdc9ff8a311e" } ] } ], "note": "For asynchronous payment methods, PaymentIntents move to a processing state upon confirmation. Terminal outcomes are communicated via webhooks, with payment_intent.succeeded indicating success and payment_intent.payment_failed indicating failure, allowing agents to observe completion and reconcile failure." }, { "signal_code": "provisioning_operability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:16.056Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "credential-lifecycle" }, { "node_kind": "resource", "node_id": "payment-intents-create" }, { "node_kind": "resource", "node_id": "testing" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:bcd3ba027469916fe2909fc37a7afa068ba8acba545f12bdacfa5ca717dc40e1", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:7f253ded6b16143d59c27b9a97fe1f8278e33ec2ecb5e4d5f6a5160f2d55c9f1", "sha256:acd387d930f14a6efc5e56315372160d59e61d35836528e30e2261866d0de809", "sha256:c4ce10baa19df23b86504289ef6e02e8fd49fa9b4d7b1fcc582b43b495741b6e" ], "source_surface": { "node_kind": "resource", "node_id": "payment-intents-create" }, "locators": [ { "artifact_digest": "sha256:acd387d930f14a6efc5e56315372160d59e61d35836528e30e2261866d0de809", "start_byte": 11671, "end_byte": 12468, "value_digest": "sha256:24633918a8b9a10636b71063c2ab1e58a1e8b8e8d42dfa182ca6f7a7a0747394" } ] } ], "note": "Provisioning of PaymentIntent resources is machine-triggerable via an HTTP POST request to /v1/payment_intents using API authentication." } ], "blockers": [], "remediations": [ { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." } ] }, { "stage": "operate", "stage_label": "Operate", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "Stripe API keys can be managed, configured as restricted API keys, and rotated via the Dashboard or managed by hosting platforms. However, credential rotation and revocation depend on manual Dashboard steps or hosting platform automation rather than a direct programmatic agent API." }, "secondary_context": [ { "signal_code": "agent_protocol_interface", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained excerpts describe REST or RPC interfaces, SDKs and CLIs for Stripe Payments API; they contain no first-party statement that an agent-native protocol interface is absent, and several navigation excerpts mention MCP resources without establishing coverage of the assessed targets." }, { "signal_code": "target_interface_access", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "context": "Every essential target resource is operable through standard REST API endpoints, supported official client libraries, and the Stripe CLI." }, { "signal_code": "operation_authentication", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "context": "API requests are authenticated over HTTPS using API keys (such as secret keys or restricted API keys with specific permissions) provided via HTTP basic auth or headers under scoped authority." }, { "signal_code": "operation_contract", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "context": "Essential API operation contracts across targets are stable and decidable, defining REST endpoints, HTTP verbs, JSON/form parameters, error responses, idempotency headers, and test card/event behaviors." }, { "signal_code": "failure_contract", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Applicable limits, errors, retry, idempotency, cancellation, and reconciliation semantics are documented.", "context": "Failure modes, HTTP status codes (such as 400, 401, 402, 403, 404, 409, 424, 429, 500), error types, retry guidance with exponential backoff, and idempotency semantics using the Idempotency-Key header on POST requests are documented." } ], "signals": [ { "signal_code": "agent_protocol_interface", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:31.571Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "payments-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained excerpts describe REST or RPC interfaces, SDKs and CLIs for Stripe Payments API; they contain no first-party statement that an agent-native protocol interface is absent, and several navigation excerpts mention MCP resources without establishing coverage of the assessed targets." }, { "signal_code": "credential_lifecycle", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:39.417Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authentication" }, { "node_kind": "resource", "node_id": "credential-lifecycle" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:09abfc629296b7dc0ec2cf91bc86cbab2a555e8d459afeef8f00f52229dfbedb", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0247faa62aa6bdc813a604470593d94d805abd1f05370bedc0f98ec74aed3f65", "sha256:3b21b8663134d9b27f92e5292065e838d4d92f3118e605212f00d0ae0932fbe5", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:ad03e6e375856bf2dc9cefbdc7ee199d567c8db672a2e7e5df2dd752c36c8e78" ], "source_surface": { "node_kind": "resource", "node_id": "credential-lifecycle" }, "locators": [ { "artifact_digest": "sha256:ad03e6e375856bf2dc9cefbdc7ee199d567c8db672a2e7e5df2dd752c36c8e78", "start_byte": 13585, "end_byte": 13985, "value_digest": "sha256:6f7548cba582eb985ffce79c958a69dcaf4296cc2bc50f15d6775a200f88a810" }, { "artifact_digest": "sha256:ad03e6e375856bf2dc9cefbdc7ee199d567c8db672a2e7e5df2dd752c36c8e78", "start_byte": 14789, "end_byte": 15368, "value_digest": "sha256:53b81819d26425eb738e1364221753116bbb59ea9d2754be485b780b6f0a6195" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:d3d98efa30db55985c6e4a535a6d6c20c333c9494cb84349cd41b3def0d6eb68", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5c62c4e9c94441b858d0fa7e7c9b0e40f824625a24d3bdc87cba77cfbb9e71da", "sha256:b96d506ebce1e956f1645a16a3e7e715ebcceac78dccfc3b0a05d8aa37585435", "sha256:fd96c5a42b96ec706c706445566fcb502deabd9a13eeb4474219febb52262f9c" ], "source_surface": { "node_kind": "resource", "node_id": "authentication" }, "locators": [ { "artifact_digest": "sha256:b96d506ebce1e956f1645a16a3e7e715ebcceac78dccfc3b0a05d8aa37585435", "start_byte": 8932, "end_byte": 9730, "value_digest": "sha256:fddb86e547ed43ed8faf83ce237c33880621f5ebfbaece6f235beec745c9fa48" } ] } ], "note": "Stripe API keys can be managed, configured as restricted API keys, and rotated via the Dashboard or managed by hosting platforms. However, credential rotation and revocation depend on manual Dashboard steps or hosting platform automation rather than a direct programmatic agent API.", "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } }, { "signal_code": "failure_contract", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Applicable limits, errors, retry, idempotency, cancellation, and reconciliation semantics are documented.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:31.571Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-errors" }, { "node_kind": "resource", "node_id": "credential-lifecycle" }, { "node_kind": "resource", "node_id": "idempotency" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:60b8d5c09e647805aaacdf0a3913264bc22e17d02c74ef5a7968c1cbfcf796ec", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:8e86535a9b9fee763e5eeb980561784a473afa5e36717b0d69411a094890f981", "sha256:c04ce39bbf821cda1238f69c39c45981b87834c0e708570d2097104b00a7f5f2", "sha256:eb197066336bcfad4e69a56f76538bcf5735827297ea2456a167f38c3b7bc038" ], "source_surface": { "node_kind": "resource", "node_id": "api-errors" }, "locators": [ { "artifact_digest": "sha256:8e86535a9b9fee763e5eeb980561784a473afa5e36717b0d69411a094890f981", "start_byte": 11652, "end_byte": 12459, "value_digest": "sha256:62c0f229ad2749daed334e843e8ecf3caa0c1e7c3c0b0cd47afdacecda78a31c" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:9d0b9e29f56b0f080e9ca510f8db66f77eb7fd9d10e650188b9bb0235b6a652f", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:77646ed8fd8951854d0c75e9b477f6de97afbd9c9106b75b9af17089382c0002", "sha256:c4afc3002da689a464606f2238b2bf7feeb550755dc350a1e67105b5535031fb", "sha256:e8b1b05fe3740b838ae1ce275a12b6a00d4bcf9fadd13d7464d4414f9f1a439c" ], "source_surface": { "node_kind": "resource", "node_id": "idempotency" }, "locators": [ { "artifact_digest": "sha256:c4afc3002da689a464606f2238b2bf7feeb550755dc350a1e67105b5535031fb", "start_byte": 10422, "end_byte": 11228, "value_digest": "sha256:af2e649aa221e998bdaec38b5dc0622194a4ab0a55b7ddd8d1e51c7a651a163f" }, { "artifact_digest": "sha256:c4afc3002da689a464606f2238b2bf7feeb550755dc350a1e67105b5535031fb", "start_byte": 8824, "end_byte": 9623, "value_digest": "sha256:cf5e7967956faa0a178f30da5971b51dfb3f4b7a188afcbad107fa82cb601ec1" } ] } ], "note": "Failure modes, HTTP status codes (such as 400, 401, 402, 403, 404, 409, 424, 429, 500), error types, retry guidance with exponential backoff, and idempotency semantics using the Idempotency-Key header on POST requests are documented." }, { "signal_code": "operation_authentication", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:39.417Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authentication" }, { "node_kind": "resource", "node_id": "credential-lifecycle" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:09abfc629296b7dc0ec2cf91bc86cbab2a555e8d459afeef8f00f52229dfbedb", "capture_rung": "http" } ], "artifact_digests": [ "sha256:3b21b8663134d9b27f92e5292065e838d4d92f3118e605212f00d0ae0932fbe5", "sha256:3b96914e673a7d4dc95940c48e5c46ffb30e4437eaaa37714be3fc5faf909efb", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:ad03e6e375856bf2dc9cefbdc7ee199d567c8db672a2e7e5df2dd752c36c8e78" ], "source_surface": { "node_kind": "resource", "node_id": "credential-lifecycle" }, "locators": [ { "artifact_digest": "sha256:ad03e6e375856bf2dc9cefbdc7ee199d567c8db672a2e7e5df2dd752c36c8e78", "start_byte": 1910, "end_byte": 2711, "value_digest": "sha256:6480ffd20833595ab09138a328a2e13c11d75101a07cf9ebc65a9b673c130b28" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:d3d98efa30db55985c6e4a535a6d6c20c333c9494cb84349cd41b3def0d6eb68", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0c1ad9e94dc76a258f72d9151176d7d392900adb6f7f9c50c1b489d1d9a22288", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5c62c4e9c94441b858d0fa7e7c9b0e40f824625a24d3bdc87cba77cfbb9e71da", "sha256:b96d506ebce1e956f1645a16a3e7e715ebcceac78dccfc3b0a05d8aa37585435" ], "source_surface": { "node_kind": "resource", "node_id": "authentication" }, "locators": [ { "artifact_digest": "sha256:b96d506ebce1e956f1645a16a3e7e715ebcceac78dccfc3b0a05d8aa37585435", "start_byte": 9731, "end_byte": 10528, "value_digest": "sha256:b595de453e38bcea7af8ae3c7e460fbaa3e457931182360d629180b48d97487f" }, { "artifact_digest": "sha256:b96d506ebce1e956f1645a16a3e7e715ebcceac78dccfc3b0a05d8aa37585435", "start_byte": 8932, "end_byte": 9730, "value_digest": "sha256:fddb86e547ed43ed8faf83ce237c33880621f5ebfbaece6f235beec745c9fa48" } ] } ], "note": "API requests are authenticated over HTTPS using API keys (such as secret keys or restricted API keys with specific permissions) provided via HTTP basic auth or headers under scoped authority." }, { "signal_code": "operation_contract", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:31.571Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "payments-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:60b8d5c09e647805aaacdf0a3913264bc22e17d02c74ef5a7968c1cbfcf796ec", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:8e86535a9b9fee763e5eeb980561784a473afa5e36717b0d69411a094890f981", "sha256:c04ce39bbf821cda1238f69c39c45981b87834c0e708570d2097104b00a7f5f2", "sha256:f65c2bb1f87b2d1d33e7ca3294442e45ea6f0faa81648150d8f68c4bd80d1df9" ], "source_surface": { "node_kind": "resource", "node_id": "api-errors" }, "locators": [ { "artifact_digest": "sha256:8e86535a9b9fee763e5eeb980561784a473afa5e36717b0d69411a094890f981", "start_byte": 13257, "end_byte": 14055, "value_digest": "sha256:7bbbd512849bc54e66086a9937bfd40d7338d93083e1c2e56b0915cfc98d5514" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:bb5bcbc66bceed1cf9e9af9139d1e33b69b13a7510eb8fe7d738e80a5bb3ae4e", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0d2fd757334677cd1406bd8501c8e3a942f4c60ace902235c6eb0ada3dc60b3b", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:57ce156c02dd322b6cd11391a305922a7c52310f1d9cfa7c8a126273980d1bd5", "sha256:e716624ebcc5a3c8ce6af1607981edbc69aee0f1a855aad9b83f37385d69e375" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:e716624ebcc5a3c8ce6af1607981edbc69aee0f1a855aad9b83f37385d69e375", "start_byte": 12599, "end_byte": 13394, "value_digest": "sha256:cf789692113bc1536adf6854ab4abc48bb46f6411b242328652a6aadb9502b6b" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:bb40c833e8fd013c2d769287cb633ca4d28722786d45500fd0ddd5d480f2f188", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:6a8c1ab633d2b78993efed5e3ae8d176ec071f7c6d40e8cdcee9c91d1e7fdac1", "sha256:828110c8e2bb4488c0ca87994808b35f431b8a7e76fed639a6229435eb09add8", "sha256:b9a4cf6b468db6a70041c82fde3b40d4857e5dda985079588d7b8153bbe97399" ], "source_surface": { "node_kind": "resource", "node_id": "testing" }, "locators": [ { "artifact_digest": "sha256:b9a4cf6b468db6a70041c82fde3b40d4857e5dda985079588d7b8153bbe97399", "start_byte": 35795, "end_byte": 36593, "value_digest": "sha256:cc9946ceca56884a2e82bee98797e365feab671117ce54ada81e50b62e2cdd22" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:9d0b9e29f56b0f080e9ca510f8db66f77eb7fd9d10e650188b9bb0235b6a652f", "capture_rung": "http" } ], "artifact_digests": [ "sha256:40585103ef4a825e341051fb42df8cc42c97182c6d625039809e2b21bd0a19e0", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:c4afc3002da689a464606f2238b2bf7feeb550755dc350a1e67105b5535031fb", "sha256:e8b1b05fe3740b838ae1ce275a12b6a00d4bcf9fadd13d7464d4414f9f1a439c" ], "source_surface": { "node_kind": "resource", "node_id": "idempotency" }, "locators": [ { "artifact_digest": "sha256:c4afc3002da689a464606f2238b2bf7feeb550755dc350a1e67105b5535031fb", "start_byte": 11229, "end_byte": 12030, "value_digest": "sha256:4a0c06054a51513b392ec42b37d3c028c88bbc0b90b822700bc37b8bfe7d73c1" } ] } ], "note": "Essential API operation contracts across targets are stable and decidable, defining REST endpoints, HTTP verbs, JSON/form parameters, error responses, idempotency headers, and test card/event behaviors." }, { "signal_code": "target_interface_access", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:31.571Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "payments-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:60b8d5c09e647805aaacdf0a3913264bc22e17d02c74ef5a7968c1cbfcf796ec", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:8e86535a9b9fee763e5eeb980561784a473afa5e36717b0d69411a094890f981", "sha256:c04ce39bbf821cda1238f69c39c45981b87834c0e708570d2097104b00a7f5f2", "sha256:ea0c122812d69c9028f18e35dd20a7d2d0787fae7ec36d319d20c0167181b8f7" ], "source_surface": { "node_kind": "resource", "node_id": "api-errors" }, "locators": [ { "artifact_digest": "sha256:8e86535a9b9fee763e5eeb980561784a473afa5e36717b0d69411a094890f981", "start_byte": 7210, "end_byte": 7965, "value_digest": "sha256:572428a69eeb669ebf0c787ca32453291da54e6c7849113bdf96f8cd647f4992" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:bb40c833e8fd013c2d769287cb633ca4d28722786d45500fd0ddd5d480f2f188", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:828110c8e2bb4488c0ca87994808b35f431b8a7e76fed639a6229435eb09add8", "sha256:85e02fc0e3966c2e818fd0b27a3203f87a3f445960c19cc297e0315a67e6736d", "sha256:b9a4cf6b468db6a70041c82fde3b40d4857e5dda985079588d7b8153bbe97399" ], "source_surface": { "node_kind": "resource", "node_id": "testing" }, "locators": [ { "artifact_digest": "sha256:b9a4cf6b468db6a70041c82fde3b40d4857e5dda985079588d7b8153bbe97399", "start_byte": 31798, "end_byte": 32577, "value_digest": "sha256:ceff869d4a65f44c5ef149039fb7f484a1f52a4c586339b62deb780546391675" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:9d0b9e29f56b0f080e9ca510f8db66f77eb7fd9d10e650188b9bb0235b6a652f", "capture_rung": "http" } ], "artifact_digests": [ "sha256:1f6f1ba8893242daf0eba244669b4698f31070c02ff1fc54a7299961539c3e14", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:c4afc3002da689a464606f2238b2bf7feeb550755dc350a1e67105b5535031fb", "sha256:e8b1b05fe3740b838ae1ce275a12b6a00d4bcf9fadd13d7464d4414f9f1a439c" ], "source_surface": { "node_kind": "resource", "node_id": "idempotency" }, "locators": [ { "artifact_digest": "sha256:c4afc3002da689a464606f2238b2bf7feeb550755dc350a1e67105b5535031fb", "start_byte": 9624, "end_byte": 10421, "value_digest": "sha256:7c40cb431818d8f760b504330e2b0d781232bdd588829f41c28d6b7c5ec11fd5" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:bb5bcbc66bceed1cf9e9af9139d1e33b69b13a7510eb8fe7d738e80a5bb3ae4e", "capture_rung": "http" } ], "artifact_digests": [ "sha256:091a48faa108aa2c03ecfed69da20e07e269fe0c809321a03bb2602044ab2ba1", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:57ce156c02dd322b6cd11391a305922a7c52310f1d9cfa7c8a126273980d1bd5", "sha256:e716624ebcc5a3c8ce6af1607981edbc69aee0f1a855aad9b83f37385d69e375" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:e716624ebcc5a3c8ce6af1607981edbc69aee0f1a855aad9b83f37385d69e375", "start_byte": 11027, "end_byte": 11825, "value_digest": "sha256:d75dead307d7487ea4a779836ddfbcaf633924af22de19e62a1ba3bcc01caa9e" } ] } ], "note": "Every essential target resource is operable through standard REST API endpoints, supported official client libraries, and the Stripe CLI." } ], "blockers": [], "remediations": [ { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } ] } ], "coverage": { "status": "complete", "required_signals": 14, "covered_signals": 14, "ratio": 1, "barrier_signals": 5, "verified_barrier_signals": 0, "barrier_ratio": 0 }, "last_tested_at": "2026-09-06T08:51:40.030Z", "freshness": "fresh", "provenance": { "freshness": "fresh", "dispute": "none", "coverage_policy_digest": "sha256:fc9e8f046d86fcf19ab2f1bc547219e503cdc11ffa135d020db7285965cd7d1d", "freshness_policy_digest": "sha256:b71bacf415fdbef01024355fb3d080df7a9dca05d2cce9a2a1f691fe8a60f579", "basis_event_ids": [ "sha256:0688f2b809306cf2cb103e1e42a48e0a16a56fcefed4a711783d410c2a2050da", "sha256:08c257c8673ce258320bc3a27724a9c0b1688b8a96a5dc7e8d909de6e9079a97", "sha256:106bc06b55be748c31623feadd86e7c3934e198070d0e1ea36a2150100f596f9", "sha256:15114b54687bdaf1bc2520c3610a3771605fe100553e9bd650ce02125205e62a", "sha256:1ed77d1682d1bebc1f5dfd882d600b82f42866970fd925671178219790c4e98e", "sha256:2e4fe97e8d45e06639db6384090db991ba9e5a1620afda0cf618b676f547b942", "sha256:38b731818031f295a5e7be2661ec4b5b00b269d7113c3c7317fa5a1890be45ce", "sha256:3bfe67733ecacd08ac0abbf23d2d7e76f9780370654275d6f034a14b214e3141", "sha256:461ff4482f377b871193d83631053137c54b0d86ba6461823b493c54acd712a6", "sha256:51768f1b6a5317cac4b775d5a5610d13acd09eac3c253d460cc8d82feeadc7fe", "sha256:51f03fdcd87e521002c7d0f3b49d215e3a53425f8a4da68c72923b3d78e08867", "sha256:580ce5a724759291765ae404a75f560a2b4e5ad0060d5e6f02bed1f5c289a76b", "sha256:58a0c9192c0a7882d40c0878270a635f1ced3559f1a4603037db9921e7738a59", "sha256:597419ee43b1476cfdda58b9f4ad3e1c72fafccadb5c65b49f89ebe4c1c596e5", "sha256:5d1f5e944a15bb269e5595d4352cd13ddfdbe45146c0c28e08749a16263f4e0b", "sha256:5df7748d15f185f7953cc5cbb277b90817ab14e04edd1ce0b02a2d057913d536", "sha256:5e2e470c4c87386aa268c923b83b1ef2df6b8b168f5c169c8f1b3dcdd4f00b57", "sha256:5f0f4de69e76807184fb8979e867a9d5abbd67c0446efd85707db9050c9a7a95", "sha256:696a2b124b387935b0bd3bf781f130ef81b43faf782c7e6a67298aaf4fae2357", "sha256:6d1d4e2df4eec429231e1acd4b92857744788bab9636e4caed331ff565453ec7", "sha256:7a30727efe5eb3071c0bb82ee91b2d9a79e1fce62198819b227d46f1fc36864b", "sha256:7a739960dda1f6a92c8dcf91e4c40e5c616e74b728a892f73f261733152b8e65", "sha256:7d9094cd15f9dd7ec9c24c9999ee8839ab8bd0eff952a6210688d80c53032673", "sha256:83565e1af484937c6fbc0ab48102666ef73b4f99ed3b708cb03fe421076f4584", "sha256:876aab6dd00352c12d1438d9ff6100cded1b1a9608ad338144a94828d562371c", "sha256:88a5e6d44c05a2dabd3fb321683b1aa8b0c25169a9706b6caa7854655928e4ae", "sha256:8cc4ee56dfbab0b8eab27d0923c19ad4728fe9f5b00b2709d5c2ab1ebf6dd377", "sha256:96db5f7ea9db4c62e10b49a047183f7d682dac6af771547ecebc790480024fde", "sha256:9e5904e6742c5069cc0df601f4ee8590f847181b3489ce06e08e99b6d7272d15", "sha256:a7036b2ab4e340ba24bba4e3d58420b953c5a5f94e5cfb3da3ecc2a33d8c3154", "sha256:a9dfbfd7b7e770c851ad2891ff0fa3fff0e24105f1d6f4348088df4ed502b51f", "sha256:b3b877e3968dd200cdbffeb34af44da46722b1ffb7886663ebb924e33766a7ca", "sha256:b3fc4076b96fc18b25b61db0d927dc64742117d6307dc47d37aa653f99a06d81", "sha256:b553668d19ca1d741f2f5d610ea5a7a8d3ccdb789dac7be196d83fdd8c11c76e", "sha256:c552e16c8ea9c66d53fc3ed498302e8ba18cbc27cf208d11cc6453c912df8b57", "sha256:d1be7e799826cb2b9921a0dc6651513fe7a942e32a02c0d35dc78b00196ebff6", "sha256:de7080e384997583073c0e116e938a1816cc488f19a3140d2723af1b770ebdd8", "sha256:dff6a90a857d6eaee08474e8125e8b332fbe446a16fefd9eb1973dbaaf53d96a", "sha256:e2af1734b99eb841dfc235b763596e34a2f9f6f537fb5e3e7d6310398f328af8" ], "fields": [ { "path": "/signals/0", "supporting_event_ids": [ "sha256:7a30727efe5eb3071c0bb82ee91b2d9a79e1fce62198819b227d46f1fc36864b" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:08.723Z", "freshness": "fresh" }, { "path": "/signals/1", "supporting_event_ids": [ "sha256:696a2b124b387935b0bd3bf781f130ef81b43faf782c7e6a67298aaf4fae2357" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:40.030Z", "freshness": "fresh" }, { "path": "/signals/2", "supporting_event_ids": [ "sha256:7a739960dda1f6a92c8dcf91e4c40e5c616e74b728a892f73f261733152b8e65" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:52.306Z", "freshness": "fresh" }, { "path": "/signals/3", "supporting_event_ids": [ "sha256:de7080e384997583073c0e116e938a1816cc488f19a3140d2723af1b770ebdd8" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:52.306Z", "freshness": "fresh" }, { "path": "/signals/4", "supporting_event_ids": [ "sha256:51f03fdcd87e521002c7d0f3b49d215e3a53425f8a4da68c72923b3d78e08867" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:08.723Z", "freshness": "fresh" }, { "path": "/signals/5", "supporting_event_ids": [ "sha256:15114b54687bdaf1bc2520c3610a3771605fe100553e9bd650ce02125205e62a" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:52.306Z", "freshness": "fresh" }, { "path": "/signals/6", "supporting_event_ids": [ "sha256:580ce5a724759291765ae404a75f560a2b4e5ad0060d5e6f02bed1f5c289a76b" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:09.253Z", "freshness": "fresh" }, { "path": "/signals/7", "supporting_event_ids": [ "sha256:5f0f4de69e76807184fb8979e867a9d5abbd67c0446efd85707db9050c9a7a95" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:09.253Z", "freshness": "fresh" }, { "path": "/signals/8", "supporting_event_ids": [ "sha256:1ed77d1682d1bebc1f5dfd882d600b82f42866970fd925671178219790c4e98e", "sha256:2e4fe97e8d45e06639db6384090db991ba9e5a1620afda0cf618b676f547b942" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:09.253Z", "freshness": "fresh" }, { "path": "/signals/9", "supporting_event_ids": [ "sha256:38b731818031f295a5e7be2661ec4b5b00b269d7113c3c7317fa5a1890be45ce", "sha256:88a5e6d44c05a2dabd3fb321683b1aa8b0c25169a9706b6caa7854655928e4ae" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:39.417Z", "freshness": "fresh" }, { "path": "/signals/10", "supporting_event_ids": [ "sha256:58a0c9192c0a7882d40c0878270a635f1ced3559f1a4603037db9921e7738a59" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:09.253Z", "freshness": "fresh" }, { "path": "/signals/11", "supporting_event_ids": [ "sha256:9e5904e6742c5069cc0df601f4ee8590f847181b3489ce06e08e99b6d7272d15" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:40.030Z", "freshness": "fresh" }, { "path": "/signals/12", "supporting_event_ids": [ "sha256:83565e1af484937c6fbc0ab48102666ef73b4f99ed3b708cb03fe421076f4584" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:40.030Z", "freshness": "fresh" }, { "path": "/signals/13", "supporting_event_ids": [ "sha256:a7036b2ab4e340ba24bba4e3d58420b953c5a5f94e5cfb3da3ecc2a33d8c3154" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:40.030Z", "freshness": "fresh" }, { "path": "/signals/14", "supporting_event_ids": [ "sha256:0688f2b809306cf2cb103e1e42a48e0a16a56fcefed4a711783d410c2a2050da" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:40.030Z", "freshness": "fresh" }, { "path": "/signals/15", "supporting_event_ids": [ "sha256:597419ee43b1476cfdda58b9f4ad3e1c72fafccadb5c65b49f89ebe4c1c596e5", "sha256:876aab6dd00352c12d1438d9ff6100cded1b1a9608ad338144a94828d562371c" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:39.417Z", "freshness": "fresh" }, { "path": "/signals/16", "supporting_event_ids": [ "sha256:8cc4ee56dfbab0b8eab27d0923c19ad4728fe9f5b00b2709d5c2ab1ebf6dd377" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:08.915Z", "freshness": "fresh" }, { "path": "/signals/17", "supporting_event_ids": [ "sha256:5e2e470c4c87386aa268c923b83b1ef2df6b8b168f5c169c8f1b3dcdd4f00b57" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:16.056Z", "freshness": "fresh" }, { "path": "/signals/18", "supporting_event_ids": [ "sha256:51768f1b6a5317cac4b775d5a5610d13acd09eac3c253d460cc8d82feeadc7fe", "sha256:7d9094cd15f9dd7ec9c24c9999ee8839ab8bd0eff952a6210688d80c53032673", "sha256:b553668d19ca1d741f2f5d610ea5a7a8d3ccdb789dac7be196d83fdd8c11c76e", "sha256:c552e16c8ea9c66d53fc3ed498302e8ba18cbc27cf208d11cc6453c912df8b57" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:31.571Z", "freshness": "fresh" }, { "path": "/signals/19", "supporting_event_ids": [ "sha256:106bc06b55be748c31623feadd86e7c3934e198070d0e1ea36a2150100f596f9", "sha256:6d1d4e2df4eec429231e1acd4b92857744788bab9636e4caed331ff565453ec7" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:39.417Z", "freshness": "fresh" }, { "path": "/signals/20", "supporting_event_ids": [ "sha256:96db5f7ea9db4c62e10b49a047183f7d682dac6af771547ecebc790480024fde", "sha256:d1be7e799826cb2b9921a0dc6651513fe7a942e32a02c0d35dc78b00196ebff6" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:31.571Z", "freshness": "fresh" }, { "path": "/signals/21", "supporting_event_ids": [ "sha256:b3b877e3968dd200cdbffeb34af44da46722b1ffb7886663ebb924e33766a7ca", "sha256:b3fc4076b96fc18b25b61db0d927dc64742117d6307dc47d37aa653f99a06d81" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:39.417Z", "freshness": "fresh" }, { "path": "/signals/22", "supporting_event_ids": [ "sha256:08c257c8673ce258320bc3a27724a9c0b1688b8a96a5dc7e8d909de6e9079a97", "sha256:461ff4482f377b871193d83631053137c54b0d86ba6461823b493c54acd712a6", "sha256:5d1f5e944a15bb269e5595d4352cd13ddfdbe45146c0c28e08749a16263f4e0b", "sha256:5df7748d15f185f7953cc5cbb277b90817ab14e04edd1ce0b02a2d057913d536" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:31.571Z", "freshness": "fresh" }, { "path": "/signals/23", "supporting_event_ids": [ "sha256:3bfe67733ecacd08ac0abbf23d2d7e76f9780370654275d6f034a14b214e3141", "sha256:a9dfbfd7b7e770c851ad2891ff0fa3fff0e24105f1d6f4348088df4ed502b51f", "sha256:dff6a90a857d6eaee08474e8125e8b332fbe446a16fefd9eb1973dbaaf53d96a", "sha256:e2af1734b99eb841dfc235b763596e34a2f9f6f537fb5e3e7d6310398f328af8" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:31.571Z", "freshness": "fresh" } ], "vendor_attestation": { "status": "none" } }, "canonical_url": "https://sourcey.com/log/stripe/agent-readiness/stripe-payments-api/api-payment-lifecycle", "projection_digest": "sha256:9d5d993cf8becca579d781884f8807bdcd532a628427b5275787e99f1de59aa6" } } }