Discovery Files
Machine-readable manifests an agent reads to find the plane, its spec, its onboarding path and the skills it offers.
On this page (7)
Discovery Files Documentation
An agent with no instructions can find the whole surface by reading these. Every path answers with no key, on https://rdap.whisper.online.
curl -s https://rdap.whisper.online/.well-known/agent-onboarding.json
The index files
| Path | Holds |
|---|---|
GET /llms.txt | A short index written for a reader that is not a person: what the plane does, and the order to do it in. |
GET /llms-full.txt | The long form of the same index, with the endpoint catalogue and worked transcripts. |
GET /.well-known/llms.txt | The short index at its well-known location. |
The OpenAPI document
GET /openapi.json returns an OpenAPI 3.1.0 document with one security scheme, the X-API-Key header. It describes the surfaces that have no standard of their own and names the RFC for the rest, so encrypted DNS, the registry and the log formats are pointed at rather than restated.
The onboarding manifest
GET /.well-known/agent-onboarding.json is the same journey as structured data: where to discover the plane, how to get a key, where that key is used, the registration call with the fields it returns, the commands that verify an identity afterwards, and the connectivity tiers available to it.
The agent card
GET /.well-known/agent-card.json, also served at /.well-known/agent.json, is an A2A 1.0 Agent Card. It names one JSON-RPC interface, the X-API-Key scheme, and one skill per operation. Each keyed agents.* skill is a binding of the matching CALL whisper.agents({op: ...}), so the card and Operations describe the same surface in two formats.
POST /a2a is that interface: JSON-RPC 2.0, method SendMessage. The keyless skills answer without a credential, and the agents.* skills need one. Protocol failures use the standard JSON-RPC codes from -32700 to -32603, plus -32004.
The skills index
GET /.well-known/skills/index.json holds one entry, whisper-identity, pointing at an Agent Skill. The skill tells an agent when to verify an identity with no key, and how to mint one of its own.
The identity document
This one is served on an agent's own name rather than on the gateway.
| Path | Holds |
|---|---|
GET https://<fqdn>/.well-known/whisper-identity | A compact ES256 JWS binding the address, the name, the account handle and the issue time to the key the DANE record pins. |
GET https://<fqdn>/.well-known/jwks.json | The public key in JWK form. |
GET https://<fqdn>/.well-known/did.json | The did:web document for the same identity. |
Keys, signing and encryption covers the key these documents are signed with, and the jws_ok field on the keyless verdict reports whether the document checks out.
The security contact
GET /.well-known/security.txt returns the RFC 9116 file, clearsigned, with the reporting address and links to the disclosure policy and the acknowledgements page.