Preflight an external agent/server

Verify an external MCP server / A2A agent card before trusting it. Supply EITHER a url to fetch the card from OR an inline document (one is required). Returns the resolved identity (signature validity, key domain-binding), declared capabilities, auth, and a decision. Requires the cards:verify scope.

post/api/v1/gateway/verify-card

Request

  • Base URL: https://app.axiorank.com
  • URL: https://app.axiorank.com/api/v1/gateway/verify-card
  • Auth: HTTP bearer

Headers

Idempotency-Keystring

Optional. Safely retry a write: the first response for a given key is replayed on retries (24h TTL). A concurrent retry gets 409; reusing a key with a different body gets 422.

Request body

urlstring uri
documentunknown
protocol'a2a' | 'mcp' | 'oauth' | 'api-catalog' | 'x402' | 'acp' | 'ucp' | 'mpp' | 'did' | 'acp-comm' | 'anp' | 'agntcy-slim' | 'authmd' | 'ap2' | 'content-permission' | 'agntcy-directory' | 'nlweb' | 'ans' | 'agent-skills' | 'webmcp' | 'nanda' | 'vc' | 'visa-tap' | 'spiffe' | 'agents-json' | 'l402' | 'oid4vci' | 'authzen' | 'mc-agent-pay' | 'visa-intelligent-commerce' | 'skyfire' | 'nekuda' | 'amex-agent-pay' | 'paypal-agentic-checkout'

Response

The preflight verdict.

decision'allow' | 'review' | 'deny' required
reasonstring required
riskinteger required
protocolstring required

Resolved protocol of the card (a2a, mcp, oauth, …).

warningsstring[] required
cardIdstring required

Example response

{
  "signals": [
    {
      "detector": "secret.aws_access_key",
      "location": "body.env.AWS_SECRET"
    }
  ]
}

Changes

No recorded changes to this operation across all 1 revision of this API.