From efea311bf4bd30b890432a16e1965c3021eb38aa Mon Sep 17 00:00:00 2001 From: Vishal Katyal Date: Tue, 1 Sep 2026 17:23:07 -0400 Subject: [PATCH] docs(checkout-rest): cover ucp-agent in the example signed request The Example Signed Request in the checkout REST binding carries a UCP-Agent header, but its Signature-Input covers only "@method" "@authority" "@path" "idempotency-key" "content-digest" "content-type". The identity resolution gate in overview/index.md states that a signature MUST cover ucp-agent, signature-agent and idempotency-key when those headers are present, and that a verifier MUST skip a signature whose covered set omits any of them, since a header the signature does not cover is treated as unsigned. The example therefore shows a request whose signature a conformant verifier is required to skip, in the one place an implementer copies from. Adds "ucp-agent" to the covered set, which makes its covered set identical to the canonical REST request example in signatures.md line 515, the document this section links to for the complete signing algorithm. The two examples still differ elsewhere, for instance in their keyid. No normative text changes. validate_examples.py 343 passed, 0 failed, 50 skipped and test_validate_examples.py 52 passed on a test merge into main 1d39948 on 2026-09-01, both unchanged by this commit, because the example is an unannotated http fence that no CI job inspects. cspell clean on the changed file. --- docs/specification/shopping/checkout/rest.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/specification/shopping/checkout/rest.md b/docs/specification/shopping/checkout/rest.md index 1faa4e40f..1c0db05a5 100644 --- a/docs/specification/shopping/checkout/rest.md +++ b/docs/specification/shopping/checkout/rest.md @@ -1437,7 +1437,7 @@ Content-Type: application/json UCP-Agent: profile="https://platform.example/.well-known/ucp" Idempotency-Key: 550e8400-e29b-41d4-a716-446655440000 Content-Digest: sha-256=:X48E9q...: -Signature-Input: sig1=("@method" "@authority" "@path" "idempotency-key" "content-digest" "content-type");keyid="platform-2025" +Signature-Input: sig1=("@method" "@authority" "@path" "ucp-agent" "idempotency-key" "content-digest" "content-type");keyid="platform-2025" Signature: sig1=:6G4i8TS6oUkGrx8KnCFUpsSPwd74...: {"line_items":[{"item":{"id":"item_123"},"quantity":2}]}