ucp-checkout-session — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ucp-checkout-session (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
中文摘要:用 UCP 真实 REST 端点驱动结算会话——create / get / update(PUT,整体替换)/ complete / cancel。购物车就是 session 里的 `line_items`(UCP 没有独立 cart 能力)。包含 buyer、totals、messages,以及完成时返回的 order。对应能力 dev.ucp.shopping.checkout。item.ids from discovery and need to build + complete a purchase.line_items on the session.Cart = the session. Core UCP has no separate cart object; the cart is theline_itemsarray of a checkout session. 购物车即 session 的line_items。
Capability dev.ucp.shopping.checkout. Base URL = ucp.services["dev.ucp.shopping"].endpoint from the merchant's /.well-known/ucp. Five real endpoints:
| Operation | Method | Path |
|---|---|---|
| Create | POST | /checkout-sessions |
| Get | GET | /checkout-sessions/{id} |
| Update | PUT | /checkout-sessions/{id} |
| Complete | POST | /checkout-sessions/{id}/complete |
| Cancel | POST | /checkout-sessions/{id}/cancel |
PUT replaces the entire session. You must resend every field you want to keep — it is not a partial PATCH. PUT 是整体替换,需带上所有要保留的字段。
UCP-Agent: profile="https://platform.example/.well-known/ucp"
Idempotency-Key: <uuid> # on POST/PUT state changes — prevents double orders
Request-Id: <uuid>
Content-Type: application/json
Accept: application/json
# auth (one of): Authorization: Bearer {token} | X-API-Key: {key}
# | HTTP Message Signatures (RFC 9421): Signature, Signature-Input, Content-DigestCreate/Update request body:
{
"line_items": [ { "id": "li_1", "item": { "id": "sku_8821" }, "quantity": 2 } ],
"buyer": { "first_name": "Ada", "last_name": "L", "email": "[email protected]", "phone_number": "+49…" },
"fulfillment": { "methods": [ /* see ucp-fulfillment skill */ ] },
"payment": { "instruments": [ /* see ap2-payment-mandate skill */ ] },
"signals": { /* provided on complete */ }
}Response (checkout session):
{
"ucp": { "version": "2026-04-08", "capabilities": { }, "payment_handlers": { }, "status": "success" },
"id": "cs_01H…",
"status": "ready_for_complete", // incomplete | ready_for_complete | completed | canceled | requires_escalation
"currency": "EUR",
"messages": [
{ "type": "error", "code": "buyer.email.missing", "path": "$.buyer.email",
"content": "Email required", "severity": "recoverable" } // severity: recoverable | unrecoverable
],
"line_items": [
{ "id": "li_1", "item": { "id": "sku_8821", "title": "Trail Runner GTX", "price": 11900 },
"quantity": 2, "totals": [ { "type": "subtotal", "amount": 23800 } ] }
],
"totals": [ // type: subtotal | tax | fulfillment | fee | discount | total
{ "type": "subtotal", "display_text": "Subtotal", "amount": 23800 },
{ "type": "fulfillment", "display_text": "Shipping", "amount": 0 },
{ "type": "tax", "display_text": "Tax", "amount": 4522 },
{ "type": "total", "display_text": "Total", "amount": 28322 }
],
"fulfillment": { "methods": [ ] },
"payment": { "instruments": [ ] },
"links": [ ],
"continue_url": "https://merchant.example/checkout/cs_01H…",
"order": { "id": "ord_77Q…", "label": "#1042", "permalink_url": "https://merchant.example/orders/ord_77Q…" }
}All money amount/price are integers in the currency's minor units. 金额均为最小货币单位整数。
line_items → capture id. Server may re-validateinventory and return messages (severity: recoverable|unrecoverable).
buyer, fulfillment (address + selected option),apply discounts → server returns authoritative totals. Resend all fields (full replace).
status toward `ready_for_complete`; resolve every recoverable message. Ifrequires_escalation, hand back to the user/UI — it can't be resolved via API.
totals[type=total].amount) and get explicit confirmation.payment + signals and anIdempotency-Key. Build the AP2 payment proof first — see ap2-payment-mandate.
status: completed + order { id, label, permalink_url } → hand toIdempotency-Key returns the same order, never double-charges.ready_for_complete.2 × sku_8821, ship-to DE, Acme account linked.
POST /checkout-sessions {line_items:[{item:{id:"sku_8821"},quantity:2}]} → cs_01H…, status:incomplete.PUT /checkout-sessions/cs_01H… with full body incl. buyer, selected fulfillment option,Authorization: Bearer … → totals: subtotal 23800 + fulfillment 0 + tax 4522 = total 28322 EUR, status:ready_for_complete.
POST /checkout-sessions/cs_01H…/complete (+Idempotency-Key) → status:completed, order.id=ord_77Q….ap2-payment-mandate~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.