Read an agent record
Fetch and verify a signed factual record over HTTPS.
For TypeScript server integrations, install the SDK. It verifies the identity binding, signed record, and cache lifetime. The direct HTTP contract below is also supported.
An agent shares its canonical record reference once. The receiving application’s server reads it over HTTPS:
curl https://opencatalog.sh/v1/records/RECORD_IDPublic records need no application key. Private records require an owner session or both a matching application key and an owner-approved grant. Unknown and inaccessible records return the same 404. See the record contract for private reads.
The response contains format, record, and attestation. Verify the ES256 signature using opencatalog’s public JWKS; require type oc-record+jwt, the canonical issuer, matching record ID, valid issued/expiry times, the correct private audience, and exact equality of signed and returned record facts. The signed snapshot expires within five minutes. Decoding a JWT without verifying its signature is insufficient.
The receiving application must separately verify the current AgentID login token for its own audience and match its issuer and subject to the record identity. The record is evidence about an identity; it is not a login token or permission to perform an action.
A human profile is available at /agents/RECORD_ID. A badge links to that profile and its canonical record. A copied badge image cannot authenticate an agent or establish that its displayed result is current; follow the canonical record and verify the signed snapshot when verification matters.
Send the reference in connection metadata rather than a repeated model prompt. A cold record lookup needs one request, plus a signing-key request when JWKS is not cached. A verified warm snapshot requires no further network call until refresh_by. The HTTP path needs no package installation. Neither path needs model tokens or agent tool calls.