ecommerce-gaetan.e-monsite.com
verified_user Multi-version UCP compliance, backward compatibility & transport audit
schedule Last scanned 5/4/2026
Conformance
90%Capability
100%Coverage
33%Backward Compat
0%Negative
100%Transport
100%Latency
94%Audit Details
Cache-Control max-age is within recommended bounds
Cache-Control "no-cache, private" disables caching — agents will re-fetch on every request
Profile response advertises cache headers
Completed in 453ms
Profile declares at least the checkout capability
Completed in 497ms
Capability version strings are valid ISO dates
Completed in 422ms
Profile response Content-Type is application/json
Completed in 386ms
Discovery endpoint exposes CORS headers
Discovery response is missing Access-Control-Allow-Origin header
Profile is served over HTTPS
Completed in 415ms
Two consecutive profile fetches return identical bodies
Completed in 548ms
Signing JWKs use only allowed kty/crv values
Completed in 264ms
No duplicate capability entries (same name + version)
Completed in 483ms
OpenAPI servers[] URL is reachable
Profile has no loadable service-level OpenAPI document
Business profile has a valid structure
Completed in 317ms
Merchant responses are signed with the published signing_keys
Merchant publishes signing_keys but did not sign this response (no X-UCP-Signature / RFC 9421 / body JWS). Signing is recommended so agents can verify response authenticity.
robots.txt allows AI agents to read the UCP profile
Completed in 4257ms
All declared schema URLs use HTTPS
Completed in 378ms
Signing keys are importable via Web Crypto
Completed in 1579ms
Profile advertises well-formed signing keys
Completed in 1064ms
Service binding transports are in the allowed set
Completed in 868ms
Profile declares a ucp.version string
Completed in 758ms
Profile ucp.version is one the grader recognizes
Completed in 460ms
Profile is served at the canonical .well-known/ucp path
Completed in 337ms
Declared capabilities match operations in the OpenAPI
No OpenAPI operations available to cross-check
Capability JSON Schemas declare a modern $schema draft
Profile declares no capability JSON Schemas
Capability-level JSON Schemas are well-formed
3 of 3 capability schemas are malformed
OpenAPI components.schemas has no orphans
Profile has no loadable service-level OpenAPI document
Service-level OpenAPI document is valid OpenAPI 3.x
No service-level OpenAPI schema was loaded
Every OpenAPI operation declares a 2xx JSON response schema
Profile has no loadable service-level OpenAPI document
Every $ref referenced schema document is reachable
Profile declares no loadable schema documents
All declared schema URLs return 200
5 of 5 schema URLs failed to load: [service] https://ucp.dev/services/shopping/rest.openapi.json → http_404 [capability] https://ucp.dev/schemas/shopping/checkout.json → http_404 [capability] https://ucp.dev/schemas/shopping/order.json → http_404 [capability] https://ucp.dev/schemas/common/identity-linking.json → http_404 [payment] https://ucp.dev/schemas/payment-handlers/com.stripe.json → http_404
Cancel session response matches the OpenAPI schema
Merchant gates checkout creation behind authentication (HTTP 401); cannot validate cancel_session shape without credentials
Create session response matches the OpenAPI schema
Merchant gates checkout creation behind authentication (HTTP 401); cannot validate the response shape without credentials
Discovery profile matches the published JSON Schema
Completed in 339ms
Get session response matches the OpenAPI schema
Merchant gates checkout creation behind authentication (HTTP 401); cannot validate get_session shape without credentials
Update session response matches the OpenAPI schema
Merchant gates checkout creation behind authentication (HTTP 401); cannot validate update_session shape without credentials
Canceling a session twice with the same idempotency key is idempotent
Merchant gates checkout creation behind authentication (HTTP 401); cannot probe further without credentials
Cancel a checkout session
Merchant gates checkout creation behind authentication (HTTP 401); cannot probe further without credentials
Create checkout session with defaults
Merchant gates checkout creation behind authentication (HTTP 401); cannot probe further without credentials
Repeated createSession with same idempotency key returns same session
Merchant gates checkout creation behind authentication (HTTP 401); cannot probe further without credentials
Create session then set shipping address
Merchant gates checkout creation behind authentication (HTTP 401); cannot probe further without credentials
Retrieve a checkout session by id
Merchant gates checkout creation behind authentication (HTTP 401); cannot probe further without credentials
Reusing an Idempotency-Key with a different body must be rejected
Merchant gates checkout creation behind authentication (HTTP 401); cannot probe further without credentials
update_checkout is idempotent on replay and rejects conflicting replays
Merchant gates checkout creation behind authentication (HTTP 401); cannot probe further without credentials
Select a shipping method on a checkout session
Merchant gates checkout creation behind authentication (HTTP 401); cannot probe further without credentials
Catalog capability advertised for product lookup
Profile does not declare dev.ucp.shopping.catalog.lookup
Catalog capability is declared
Profile does not declare dev.ucp.shopping.catalog.search
Checkout capability is declared and reachable
Completed in 381ms
Fulfillment capability is declared
Profile does not declare dev.ucp.shopping.fulfillment