Skip to main content
Every registered Proofable agent has a public card: owner, identity, capabilities, and current status other apps can check. That card is the portable record. Other marketplaces can list the same agent. Proofable keeps identity, control, and proof state in one place.

​
Discovery paths

Per-agent cards resolve to GET https://api.proofable.me/api/v1/agents/card/{agentId}. The platform A2A card is also available at /api/agent/config?format=a2a. Proofable is not currently registered on ERC-8004; the platform metadata reports that status explicitly.

​
Examples

​
What a card shows

Public cards do not expose full allow/deny lists. External callers see who the agent is and who approved it, not the full permission matrix.

​
Visibility

An agent is its identity proof, so it has exactly one visibility setting, the same three values every Proofable proof has. The setting covers the whole agent, including its instructions. Unlisted is link-addressed, exactly like a proof: GET on the card by its own URL returns it to any caller, and it simply never appears in a listing. Do not treat “not discoverable” as “not fetchable”. An unlisted agent is meant to be handed to someone directly. A Private agent:
  • answers 403 with error.code = "AGENT_NOT_PUBLIC" to a caller with no access, so you can distinguish “exists but not shared with you” from 404 AGENT_NOT_FOUND;
  • opens fully for the owner and for anyone holding a live access grant on that agent’s identity proof.
Grants are per-record and per-viewer, created by the owner (POST /api/v1/verification/access/grant) and stored against the identity proof’s qHash. Fetching a private agent as a granted viewer behaves identically to fetching it as the owner. An expired or revoked grant falls back to 403. The owner changes visibility from the agent’s own Share sheet, which edits the identity proof in place; the change takes effect on the same link immediately.

​
CORS and caching

Discovery endpoints return Access-Control-Allow-Origin: *. Platform cards cache for about an hour; per-agent cards cache for about five minutes. A card served to its owner is never cached publicly: the response carries the viewer marker and must not be replayed to a later visitor.

​
Platform A2A card

The platform card includes registered skills, MCP / REST / payment interfaces, auth options (OAuth and server keys), and networks listed by CAIP-2 id.

​
Cross-chain identifiers

​
How to use it

  1. Discover: fetch the card for the agent you need.
  2. Confirm: check the permission proof before a sensitive action.
  3. Connect: call the agent through MCP, A2A, or your own runtime.

​
Next

Agent identity

Register an agent so it appears in discovery.

Team agents

One approving account, many agents.

Connect agent context

Mount a verified agent into a project.

MCP

Check proofs and resolve agents at runtime.
Last modified on October 20, 2026