Opens in a new tabSkip to content
Agent LighthouseAgent Lighthouse

    Searches the text of every published page. The evidence sources themselves are not in this index — search all of them on the trusted sources page.

    GitHub ↗
    Browse checks and page contents
    agentic-commerce/ucp-profile-conformance

    UCP capability and payment declarations conform

    What it checks

    Checks declared capabilities and payment handlers in the business profile at /.well-known/ucp. The selected ucp.version chooses the declaration rules. Supported versions are 2026-01-11, 2026-04-08 and 2026-08-25.

    The check covers registry or array shape, required declaration fields, their types, date-version syntax, absolute URI syntax and extension-parent names. Modern handler declarations also receive instrument-list type checks. August 2026 profiles additionally receive nested constraint-expression checks. Each entry is inspected independently, so one malformed declaration does not erase the readable entries beside it.

    Profile state Result
    No declared UCP profile notApplicable
    Unreadable profile notApplicable; ucp-profile reports the unreadable artifact
    Missing protocol version notApplicable; ucp-profile reports the missing version
    Protocol version this audit does not know notApplicable; declarations not assessed
    A checked declaration field violates the selected rules fail, informative only
    All checked fields conform pass, informative only

    Why it matters

    Google’s Merchant UCP guide describes the business profile as the way to discover a merchant’s supported features and payment configuration. A declaration with the wrong shape cannot describe that configuration reliably. This check reports published declaration defects before a merchant tests checkout.

    Evidence

    Google documents the profile’s discovery role in its Merchant UCP guide (verified 2026-10-23).

    The selected protocol schemas define different discovery contexts:

    The 2026-08-25 constraint-expression schema defines closed recursive object constraints with required, properties and anyOf. Value constraints permit enum, const, or both. Nonempty and unique item rules apply where the schema names them. An empty root object is valid, but an empty anyOf branch is not. The April instrument schema instead permits any nonempty constraint object. The profile version selects these rules, even when a handler declares a different component version (verified 2026-10-23).

    Grade: B. The UCP standard has a named merchant integration. This supports checking declared protocol fields, but it does not prove how a live checkout handles each malformed declaration. The audit remains informative.

    Limits

    • This is bounded declaration-field validation, not a complete JSON Schema evaluation. It does not validate provider-specific config, compose capability payload schemas or establish that checkout works.
    • Nested constraint checks validate expression structure for 2026-08-25. They do not test submitted payment data against those expressions or verify provider-defined instrument fields. Earlier profiles retain their published open constraint-object rules.
    • Each nested expression has local limits of 32 levels, 2048 JSON values and 64 KiB of UTF-8 strings and object keys. A limit produces constraintValidationLimited: true. Up to 40 path and limit messages appear in constraintValidationLimits. With no other defects, the result warns instead of passing. An unassessed handler does not count as valid. Known defects still fail when another expression exceeds a limit.
    • URI checks establish syntax only. The audit makes no new requests and does not fetch a merchant-supplied schema or prove its contents valid.
    • Independent component versions need not equal ucp.version. Unknown fields and vendor instrument names remain open.
    • A protocol version this audit does not know, such as one published after it, is notApplicable with validationPerformed: false and the supported versions in supportedVersions. The profile did nothing wrong; the audit has no rules for that version. It does not receive a false conformance pass either. A missing ucp.version is also notApplicable here, because ucp-profile already reports it.
    • Only 40 issue strings appear in details. issueCount records the full count and issuesTruncated shows when that limit applies.

    How it scores

    Tier: informative, weight 0 from weightForGrade. No result changes the site score. The existing ucp-profile audit keeps its own readability verdict; this audit does not add score weight for the same profile.

    An absent optional artifact is notApplicable. For a supported adopted profile, a required declaration field or required registry can fail. Empty registries pass where the selected schema permits them.

    Example finding

    A 2026-08-25 profile declares a checkout capability with version but no schema. Report the missing declaration field. A 2026-04-08 business capability with the same fields passes because that schema does not require the URL. Neither result proves the merchant can complete checkout.

    Sources