Issue

POST /issue runs before the buyer approves. The door assembles the ATR from what you send, writes its bytes to the seller's storage, hashes them, and answers with the values to place in the payment request.

The requestCopy Anchor Link

Slot names match ^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$. atrVersion, id and the binding's slot (such as x402) are reserved. A slot's bytes must be exactly one JSON value (RFC 8259): the door writes them into the ATR as received.

The request commitmentCopy Anchor Link

On x402, request commits the ATR to the HTTP request its options answer:

• method: the method token, such as GET;
• path: the request-target up to its first ?;
• query: what follows the first ?, or "";
• bodyDigest: 0x and the SHA-256 hex of the body bytes as received. An empty body gives 0xe3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855.

import { createHash } from "node:crypto";
import type { RequestCommitment } from "@integraledger/agentic-connectors";

/** The commitment for a request as received: its method, raw target and body bytes. */
function commitment(method: string, target: string, body: Uint8Array): RequestCommitment {
  const at = target.indexOf("?");
  return {
    method,
    path: at === -1 ? target : target.slice(0, at),
    query: at === -1 ? "" : target.slice(at + 1),
    bodyDigest: `0x${createHash("sha256").update(body).digest("hex")}`,
  };
}

console.log(JSON.stringify(commitment("GET", "/v1/report", new Uint8Array())));
console.log(JSON.stringify(commitment("POST", "/v1/quote?region=eu", new TextEncoder().encode('{"n":1}'))));

{"method":"GET","path":"/v1/report","query":"","bodyDigest":"0xe3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"}
{"method":"POST","path":"/v1/quote","query":"region=eu","bodyDigest":"0x2bfd14f43d17fc7cea24e0917a8879b4b2f880b8baeec1b9d90fbaad655e71bd"}

@integraledger/lcp computes the same commitment (requestCommitment in @integraledger/lcp/x402); use either.

The answerCopy Anchor Link

Retries and changesCopy Anchor Link

The same mintRequestId with the same input returns the first answer, byte for byte, and writes no second file (vector CV2):

import { VECTORS } from "@integraledger/agentic-connectors";

const door = process.env.SELLER_DOOR_URL ?? "https://seller.example/door";
const credential = process.env.SELLER_CREDENTIAL ?? "";

async function issue(body: unknown): Promise<{ status: number; text: string }> {
  const res = await fetch(`${door}/issue`, {
    method: "POST",
    headers: { authorization: `Bearer ${credential}`, "content-type": "application/json" },
    body: JSON.stringify(body),
  });
  return { status: res.status, text: await res.text() };
}

const [first, second] = VECTORS["CV2"]!.steps;
const a = await issue(first!.request.body);
const b = await issue(second!.request.body);
console.log(a.status, b.status, a.text === b.text);

// CV3: the same id with a changed amount is refused.
const changed = await issue(VECTORS["CV3"]!.steps[1]!.request.body);
console.log(changed.status, (JSON.parse(changed.text) as { code: string }).code);

200 200 true
409 issue/mint-request-reused

A changed checkout gets a new id. When an id's record has lapsed, the door answers 409 issue/mint-request-lapsed: append :<n> with a new n and issue again.

Failure modesCopy Anchor Link

• 422: the request cannot be served as sent. The most common are issue/pairing-not-served (the resource does not serve that pairing), issue/offer-refused (the pairing cannot place H in that option; the sentence names the pairing and its code), issue/mixed-protocols, and the core/… codes for content.
• 503: issue/storage-unavailable means the ATR could not be written, so no challenge may go out. Every 503 carries Retry-After: 1; retry the same request, with the same mintRequestId.

Whatever the failure, the checkout path stops: a connector never completes a sale without the values issue returns (rule 5).