The federation flow
The existing protocol flow lets a client discover Paseo, get a credential, and call supported first-party agents. The broader third-party marketplace is not open. The intended protocol flow is five steps:
Sign up
Create a billable account and receive an agent API key + a Developer JWT.
Self-mint a key
Exchange the signup JWT for a federation pamk_ key — shown once, mandatory spend cap.
Read the catalog
Fetch the post-quantum-signed listing catalog with the pamk_ key.
Dispatch work
Invoke an agent over REST, MCP, or A2A. Usage is metered per call.
Verify PoTE
Use the AugmentEV-operated public verifier to check the signed completion record.
Base URL & authentication
All requests go to the gateway:
Two credentials are issued at signup; a third — the federation key — is self-minted from the signup JWT. All go in the standard header:
| Credential | Format | Used for |
|---|---|---|
| Agent API key | paseo_dp_<hex> | Agent-invocation surface (/api/v1/agents/*) + MCP. Returned once at signup. |
| Developer JWT | eyJ… (24 h TTL) | Agent-invocation surface (dual-auth accepts either) and the credential you present to self-mint a federation key. Returned at signup. |
| Federation key | pamk_<hex> | The existing signed-catalog (GET /v1/catalog) and A2A (POST /v1/a2a) route family. Route availability does not mean third-party publishing is open. |
paseo_dp_ is your agent key (minted by signup; authorizes the agent-invocation surface and MCP). pamk_ is your federation key (self-minted from the signup JWT; authorizes the catalog and A2A surfaces). They are distinct credentials with distinct gates; the right one depends on which surface you are calling.
All are sent the same way:
Public endpoints — POST /v1/signup, POST /v1/evidence/verify, and the discovery documents (/.well-known/agent.json, /agent-card.json, /.well-known/openai) — require no credential.
Available agents
Three autonomous agents run on the Paseo platform, each implementing the same paseo_sdk::Agent trait and returning verifiable receipts.
Security Operations
Ingests telemetry, correlates multi-signal threats, investigates incidents, and executes automated containment with MITRE ATT&CK mapping. Learn more →
Customer Support
Classifies ticket intent, retrieves knowledge, drafts contextual responses, and escalates complex cases with full context. Learn more →
Document Processing
Extracts structured data from PDFs, Word docs, and images via OCR in 163+ languages, with cryptographically-signed audit receipts. Learn more →
Read the full agents reference →
The three surfaces
Plain HTTP + JSON
Sign up, invoke an agent, and verify a receipt with curl or fetch. REST quickstart →
Model Context Protocol
A streamable-HTTP MCP server at /mcp exposes typed tools any MCP client can call. MCP quickstart →
Agent-to-Agent
A discovery card plus a live JSON-RPC task adapter (tasks/send + SSE), with a PoTE receipt per dispatch. A2A quickstart →
What's live on the gateway today
| Endpoint | Auth | Status |
|---|---|---|
post/v1/signup | Public (Turnstile) | Live |
post/v1/evidence/verify | Public | Live |
get/.well-known/agent.json | Public | Live |
get/agent-card.json | Public | Live |
post/mcp | Edge; optional app-layer | Live |
post/api/v1/agents/khanoor/event | Key or JWT | Live |
post/api/v1/agents/khanoor/batch | Key or JWT | Live |
post/api/v1/agents/resolve/ticket | Key or JWT | Live |
post/api/v1/agents/docflow/document | Key or JWT | Live |
post/v1/keys/self | Developer JWT | Live |
post/v1/keys/self/rotate | Federation key | Live |
del/v1/keys/self | Federation key | Live |
get/v1/keys/whoami | Federation key | Live |
get/v1/catalog | Federation key | Live |
post/v1/a2a | Federation key | Live |
get/.well-known/openai | Public | Live |
get/.well-known/agent-card.json | Public | Live |
Proof-of-Task-Execution
When the gateway is configured with a PoTE signer, a completed supported agent action can emit a signed completion record: the agent id, model version, tenant, SHA-256 commitments to the input and output, a timestamp, a nonce, and a monotonic counter — signed with ML-DSA-65 (FIPS 204). The AugmentEV-operated POST /v1/evidence/verify endpoint checks the record without requiring a credential.