Technical guide · Experimental practice
Universal Commerce Protocol: publishing a commerce capability profile
How UCP discovery describes protocol version and commerce capabilities, and why a public profile must remain separate from authentication and transaction authority.
- Published
- Updated
Scope: this guide explains a technical signal observed by AI Web Check. It does not claim that the signal causes ranking, indexing, citation or inclusion in AI answers.
What the public profile does
UCP uses a versioned capability profile so a platform can discover what a business supports. The public discovery document is exposed at /.well-known/ucp and describes protocol version and supported capabilities.
The document is useful only when it reflects real server behavior. Publishing JSON at the well-known path is not enough if version-specific fields or declared capabilities do not match production.
What AI Web Check evaluates
UCP is evaluated only in a confirmed commerce context and only as a bounded public discovery document. The checker validates published profile fields without invoking checkout, payment, order creation, or other commerce operations.
Missing UCP is optional and does not reduce AI Readiness.
Discovery is not transaction authority
A well-known profile may describe capabilities and authentication requirements, but it must not contain credentials. An execution endpoint must independently enforce authentication, authorization, scopes, and resource ownership.
This separation is especially important for checkout and payment: public metadata tells a client what exists; it does not grant permission to act on behalf of a user.
Common mistakes
- Declaring a capability that the live API does not actually support.
- Mixing fields from incompatible protocol revisions.
- Publishing API keys, bearer tokens, or private endpoints in the well-known JSON.
- Redirecting discovery to another origin or an insecure HTTP endpoint.