API Reference
Full REST API documentation with interactive Swagger UI. All endpoints require Bearer authentication with your organization API key.
POST /v1/agents — enablePqc
Optional boolean (default false). When true, registration adds an ML-DSA-44 post-quantum Data Integrity proof (mldsa44-jcs-2024) alongside the standard Ed25519 credential signature, plus a Multikey verification method (#key-2). See the RegisterAgentRequest schema and the W3C VC Data Integrity Quantum-Resistant draft.
Payment Authorization Credentials
A Payment Authorization Credential (PAC) is a protocol-agnostic, platform-signed spending mandate — a W3C Verifiable Credential that attests an agent may spend up to maxAmount in a given currency (ISO 4217), within scope, until expirationDate. Issuing a PAC does not change policy limits: maxAmountmust stay within the agent's existing perTransactionLimitUsd.
POST /v1/agents/:did/payment-authorization— issueGET /v1/agents/:did/payment-authorizations— list (display, no re-verify)POST /v1/credentials/payment-authorization/verify— verifyGET /v1/platform/did.json— platform issuer DID Document (public)
PAC is designed to attach to any of the major agent payment protocols (AP2, ACP, x402, MPP, Visa TAP, Mastercard Agent Pay). NeurionOcta does not implement those protocols — it issues a portable proof of authorization they can consume. See packages/api/scripts/pac-x402-example.ts for a conceptual x402 header attachment example.
A2A Identity Extension
Agent owners can advertise NeurionOcta W3C DID/VC identity inside a standard A2A Agent Card via capabilities.extensions — the same extension mechanism payment protocols like AP2 use. Counterparties discover and verify identity through public passport and DID Document URLs without a NeurionOcta account.
GET /v1/extensions/agent-identity/v1— public extension specificationGET /v1/agents/:did/agent-card-extension— ready-to-paste AgentExtension fragment for your agent (owner-authenticated; also available as "Copy A2A Identity Extension" in the dashboard)
NeurionOcta does nothost a full A2A Agent Card. That remains on the agent owner's origin (/.well-known/agent-card.json). We only provide the identity extension fragment and public verification endpoints.