# Discovery Files

> Whisper discovery manifests: llms.txt, the OpenAPI document, the agent onboarding file, the A2A agent card and JSON-RPC endpoint, and the skills index.

*Source: https://www.whisper.security/docs/control-plane/discovery*

---
An agent with no instructions can find the whole surface by reading these. Every path answers with no key, on `https://rdap.whisper.online`.

```bash
curl -s https://rdap.whisper.online/.well-known/agent-onboarding.json
```

## The index files

| Path | Holds |
|---|---|
| `GET /llms.txt` | A short index written for a reader that is not a person: what the plane does, and the order to do it in. |
| `GET /llms-full.txt` | The long form of the same index, with the endpoint catalogue and worked transcripts. |
| `GET /.well-known/llms.txt` | The short index at its well-known location. |

## The OpenAPI document

`GET /openapi.json` returns an OpenAPI 3.1.0 document with one security scheme, the `X-API-Key` header. It describes the surfaces that have no standard of their own and names the RFC for the rest, so encrypted DNS, the registry and the log formats are pointed at rather than restated.

## The onboarding manifest

`GET /.well-known/agent-onboarding.json` is the same journey as structured data: where to discover the plane, how to get a key, where that key is used, the registration call with the fields it returns, the commands that verify an identity afterwards, and the connectivity tiers available to it.

## The agent card

`GET /.well-known/agent-card.json`, also served at `/.well-known/agent.json`, is an A2A 1.0 Agent Card. It names one JSON-RPC interface, the `X-API-Key` scheme, and one skill per operation. Each keyed `agents.*` skill is a binding of the matching `CALL whisper.agents({op: ...})`, so the card and [Operations](/docs/control-plane/operations) describe the same surface in two formats.

`POST /a2a` is that interface: JSON-RPC 2.0, method `SendMessage`. The keyless skills answer without a credential, and the `agents.*` skills need one. Protocol failures use the standard JSON-RPC codes from `-32700` to `-32603`, plus `-32004`.

## The skills index

`GET /.well-known/skills/index.json` holds one entry, `whisper-identity`, pointing at an Agent Skill. The skill tells an agent when to verify an identity with no key, and how to mint one of its own.

## The identity document

This one is served on an agent's own name rather than on the gateway.

| Path | Holds |
|---|---|
| `GET https://<fqdn>/.well-known/whisper-identity` | A compact ES256 JWS binding the address, the name, the account handle and the issue time to the key the DANE record pins. |
| `GET https://<fqdn>/.well-known/jwks.json` | The public key in JWK form. |
| `GET https://<fqdn>/.well-known/did.json` | The did:web document for the same identity. |

[Keys, signing and encryption](/docs/identity/keys) covers the key these documents are signed with, and the `jws_ok` field on the keyless verdict reports whether the document checks out.

## The security contact

`GET /.well-known/security.txt` returns the RFC 9116 file, clearsigned, with the reporting address and links to the disclosure policy and the acknowledgements page.