Skip to content

Agent card

For every verified site, Sill publishes a signed, A2A-compatible agent card at its edge. The agent card is the canonical, machine-readable identity + capability statement for the site’s Sill surface.

GET https://edge.sill.so/v1/agent-card/{site_key}.json

The card is A2A-compatible: A2A’s discovery convention is the well-known path /.well-known/agent-card.json. Sill’s edge serves the per-site card at the URL above; you can publish the per-site URL anywhere an A2A client will accept a card location.

  • protocol_version: "a2a/1.2"
  • skills[]: the site’s exposed agent skills, in the A2A-conformant per-skill shape. The skill set is backing-filtered — only skills the site actually exposes through a wired backing appear here. No overclaim.
  • capabilities: A2A transport-flags object.
  • signing.algorithm: "ed25519".
  • signing.signing_key_id: the public key alias (matches the kid in the JWKS).
  • signing.issued_at / signing.expires_at: ISO-8601 UTC timestamps.
  • signing.envelope_signature: ed25519 signature over the JCS-canonical form of the card with envelope_signature removed (every other field, including the signing.* timestamps and key id, is bound by the signature).

The agent card is signed with an ed25519 key. The same public key is published in Sill’s JWKS as {kty: "OKP", crv: "Ed25519", alg: "EdDSA", use: "sig", kid: "foyer/edge/card-signing-v1"}. The kid in the JWKS matches the signing.signing_key_id on the card, so a verifier can resolve key → public bytes → verify in one step.

The JWKS endpoint:

GET https://edge.sill.so/.well-known/jwks.json

Any third party can fetch the JWKS and verify the agent card’s signature without any Sill-specific code. See Verify a signature.

  • The signed card advertises capabilities — it is a discovery surface, not a guarantee that every advertised skill is dispatchable today.
  • Transactional skill execution (money-movement skills) remains the Phase-2 mandate path. The card surface does not claim per-skill availability or SLA.
  • Sill claims no uptime SLA for this endpoint.