ACP Checkout — REST Binding
Before writing code
Fetch live docs:
- Fetch
https://developers.openai.com/commerce/specs/checkout/ for the canonical checkout specification
- Web-search
site:github.com agentic-commerce-protocol spec openapi checkout for the latest OpenAPI YAML
- Fetch
https://developers.openai.com/commerce/guides/key-concepts/ for data model details
- Web-search
site:docs.stripe.com agentic-commerce protocol specification for Stripe's merchant-side reference
Conceptual Architecture
Five Checkout Operations
| Operation |
Method |
Path |
Success |
| Create |
POST |
/checkout_sessions |
201 |
| Update |
POST |
/checkout_sessions/{id} |
200 |
| Retrieve |
GET |
/checkout_sessions/{id} |
200 |
| Complete |
POST |
/checkout_sessions/{id}/complete |
200 |
| Cancel |
POST |
/checkout_sessions/{id}/cancel |
200 |
Session State Machine
not_ready_for_payment → ready_for_payment → completed
| | |
+──────────────────────+→ canceled ←────+
|
in_progress
|
authentication_required
The five core status enum values are: not_ready_for_payment, ready_for_payment, completed, canceled, in_progress. Note that authentication_required is a transitional/conditional state (returned during 3DS flows), not one of the five core status values.
The merchant controls status transitions. The agent reads the status and reacts.
Required Headers (Every Request)
Authorization: Bearer <token> — REQUIRED
API-Version: YYYY-MM-DD — REQUIRED
Idempotency-Key: <UUID> — REQUIRED on all POST
Content-Type: application/json
Core Data Objects
- CheckoutSession — The central primitive: ID, status, currency, line items, fulfillment options, totals, messages, links, payment provider
- Item —
id + quantity (sent by agent in create/update)
- LineItem — Merchant's expanded view: base amount, discount, subtotal, tax, total, name, description, images
- Total — Typed breakdown:
items_base_amount, items_discount, subtotal, discount, fulfillment, tax, fee, total
- FulfillmentOption — Shipping/digital/pickup/local delivery with pricing and windows
- Address — Buyer's fulfillment address
- Buyer — First name, last name, email, optional phone
Monetary Values
All amounts are integers in minor currency units (cents). $19.99 = 1999. Floating-point is prohibited.
Messages
The messages[] array allows merchant-to-agent communication:
- Inform the agent about restrictions, policies, or required actions
- Messages have types (info, warning, error) that influence agent behavior
Links
The links[] array provides actionable URLs with spec-defined link types:
terms_of_use — Merchant terms of use page
privacy_policy — Merchant privacy policy page
seller_shop_policies — Merchant shop policies page
Create Flow
- Agent sends items + optional buyer info + optional address
- Merchant validates items against inventory
- Merchant computes line items, fulfillment options, totals
- Returns session with
not_ready_for_payment or ready_for_payment
Update Flow
- Agent sends modified items, address, fulfillment choice, or buyer info
- Merchant revalidates and recomputes everything
- Returns updated session with new status
Complete Flow
- Agent sends payment data (SPT from delegated payment)
- Merchant processes payment via PSP
- On success: returns session with
completed status + order details
- On 3DS required: returns
authentication_required + authentication challenge
- Agent must handle 3DS and retry complete with authentication result
Error Handling
- All errors return flat objects:
type, code, message, param
- Use
param (JSONPath) to indicate which field caused the error
- Handle idempotency conflicts (422) and in-flight duplicates (409)
Fetch the OpenAPI spec for exact request/response schemas, field types, and all possible error codes before implementing.
1---2name: acp-checkout-rest3description: Implement the ACP REST checkout API — create, update, retrieve, complete, and cancel checkout sessions. Use when building merchant-side checkout endpoints, handling the checkout session state machine, or integrating with AI agent checkout flows.4---5
6# ACP Checkout — REST Binding
7
8## Before writing code
9
10**Fetch live docs**:
111. Fetch `https://developers.openai.com/commerce/specs/checkout/` for the canonical checkout specification
122. Web-search `site:github.com agentic-commerce-protocol spec openapi checkout` for the latest OpenAPI YAML
133. Fetch `https://developers.openai.com/commerce/guides/key-concepts/` for data model details
144. Web-search `site:docs.stripe.com agentic-commerce protocol specification` for Stripe's merchant-side reference
15
16## Conceptual Architecture
17
18### Five Checkout Operations
19
20| Operation | Method | Path | Success |
21|-----------|--------|------|---------|
22| Create | POST | `/checkout_sessions` | 201 |
23| Update | POST | `/checkout_sessions/{id}` | 200 |
24| Retrieve | GET | `/checkout_sessions/{id}` | 200 |
25| Complete | POST | `/checkout_sessions/{id}/complete` | 200 |
26| Cancel | POST | `/checkout_sessions/{id}/cancel` | 200 |
27
28### Session State Machine
29
30```
31not_ready_for_payment → ready_for_payment → completed
32 | | |
33 +──────────────────────+→ canceled ←────+
34 |
35 in_progress
36 |
37 authentication_required
38```
39
40The five core status enum values are: `not_ready_for_payment`, `ready_for_payment`, `completed`, `canceled`, `in_progress`. Note that `authentication_required` is a transitional/conditional state (returned during 3DS flows), not one of the five core status values.
41
42The merchant controls status transitions. The agent reads the status and reacts.
43
44### Required Headers (Every Request)
45
46- `Authorization: Bearer <token>` — REQUIRED
47- `API-Version: YYYY-MM-DD` — REQUIRED
48- `Idempotency-Key: <UUID>` — REQUIRED on all POST
49- `Content-Type: application/json`
50
51### Core Data Objects
52
53- **CheckoutSession** — The central primitive: ID, status, currency, line items, fulfillment options, totals, messages, links, payment provider
54- **Item** — `id` + `quantity` (sent by agent in create/update)
55- **LineItem** — Merchant's expanded view: base amount, discount, subtotal, tax, total, name, description, images
56- **Total** — Typed breakdown: `items_base_amount`, `items_discount`, `subtotal`, `discount`, `fulfillment`, `tax`, `fee`, `total`
57- **FulfillmentOption** — Shipping/digital/pickup/local delivery with pricing and windows
58- **Address** — Buyer's fulfillment address
59- **Buyer** — First name, last name, email, optional phone
60
61### Monetary Values
62
63All amounts are **integers in minor currency units** (cents). `$19.99` = `1999`. Floating-point is prohibited.
64
65### Messages
66
67The `messages[]` array allows merchant-to-agent communication:
68- Inform the agent about restrictions, policies, or required actions
69- Messages have types (info, warning, error) that influence agent behavior
70
71### Links
72
73The `links[]` array provides actionable URLs with spec-defined link types:
74- `terms_of_use` — Merchant terms of use page
75- `privacy_policy` — Merchant privacy policy page
76- `seller_shop_policies` — Merchant shop policies page
77
78### Create Flow
79
801. Agent sends items + optional buyer info + optional address
812. Merchant validates items against inventory
823. Merchant computes line items, fulfillment options, totals
834. Returns session with `not_ready_for_payment` or `ready_for_payment`
84
85### Update Flow
86
871. Agent sends modified items, address, fulfillment choice, or buyer info
882. Merchant revalidates and recomputes everything
893. Returns updated session with new status
90
91### Complete Flow
92
931. Agent sends payment data (SPT from delegated payment)
942. Merchant processes payment via PSP
953. On success: returns session with `completed` status + order details
964. On 3DS required: returns `authentication_required` + authentication challenge
975. Agent must handle 3DS and retry complete with authentication result
98
99### Error Handling
100
101- All errors return flat objects: `type`, `code`, `message`, `param`
102- Use `param` (JSONPath) to indicate which field caused the error
103- Handle idempotency conflicts (422) and in-flight duplicates (409)
104
105Fetch the OpenAPI spec for exact request/response schemas, field types, and all possible error codes before implementing.