Skip to main content
You can inspect the canonical source from spec/bindings/graphql/schema.graphql below. These are reference, not production bindings; nothing is deployed. No UCP conformance is claimed. Example data, not real prices. You submit a request, poll validation, obtain trusted provider review and explicitly approve the exact deposit and policies before checkout handoff. The provider is merchant of record; UQP never holds funds. Only trusted processor confirmation can mark a deposit paid. See the lifecycle.

Authorization and deferred bindings

OAuth 2.0 is the intended authorization foundation for protected operations, but scopes, grant profiles, issuer discovery and token requirements are not defined. OAuth is not itself an identity protocol. Enforce business access and consent at the service boundary; schema validation is not authorization. Keep credentials and contact information out of answers. A2A is deferred; no UQP task mapping is defined. See checkout handoff for deposit approval and payment boundaries.

Source