> ## Documentation Index
> Fetch the complete documentation index at: https://learn.orbexa.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Glossary

> Comprehensive glossary of agentic commerce terminology — covering UCP, ACP, MCP, OTR protocols and related technical standards in detail.

# Glossary

Agentic commerce spans multiple protocols and technical standards. This glossary defines each core term in one line, with deep-read links for further study.

## A

### A2A (Agent-to-Agent)

**Definition**: A communication protocol by Google that enables different AI agents to collaborate on tasks through structured inter-agent messaging.

**Relation to UCP**: UCP supports A2A as one of its four transport mechanisms, using the Agent Card Specification for inter-agent commerce collaboration.

***

### ACP (Agentic Commerce Protocol)

**Definition**: An open standard for programmatic commerce interactions between buyers, AI agents, merchants, and payment providers. Created by Stripe; OpenAI ChatGPT was the first implementer.

**Official spec**: [agenticcommerce.dev](https://agenticcommerce.dev) | **Spec version**: 2026-01-30

**Deep read**: [ACP Protocol Deep Dive](/en/book-4/index)

***

### agent.json

**Definition**: A JSON file placed in a website's `/.well-known/` directory that declares the site's supported AI agent interaction capabilities.

**File path**: `https://yourdomain.com/.well-known/agent.json`

**Deep read**: [Book 6 Chapter 7](/en/book-6/ch7-agent-json)

***

### Agentic Commerce

**Definition**: A new commerce paradigm in which AI agents perform product discovery, price comparison, checkout, and customer service on behalf of human users.

**Deep read**: [Book 1 Chapter 1](/en/book-1/ch1-ai-agents-changing-shopping)

***

### Agentic Storefronts

**Definition**: Shopify's AI agent access interface for merchants, enabled by default for U.S.-based Shopify stores (launched 2025).

***

### AI-SEO

**Definition**: The practice of optimizing website visibility for AI agent crawlers (ChatGPT-User, Claude-Web, etc.), as distinct from traditional Google SEO.

**Deep read**: [SEO for AI](/en/book-6/index)

***

### AUTH Mode (Authorized Mode)

**Definition**: The second operating mode of OTR trust scoring, activated when a merchant connects to ORBEXA and authorizes data access. In AUTH mode, all six dimensions (V/S/G/T/D/F) are active, with the F (Fulfillment) dimension carrying the highest weight (40%). AUTH mode provides the most accurate trust assessment by incorporating real behavioral data such as order fulfillment rates and customer satisfaction.

**Contrast with COLD mode**: COLD mode runs without merchant authorization using only publicly available signals (5 active dimensions, F weight = 0%). AUTH mode requires merchant connection but produces a richer, more accurate trust score.

**Deep read**: [Book 2 Chapter 5](/en/book-2/ch5-scoring-engine)

***

## B

### Badge (Trust Badge)

**Definition**: The tier label assigned by the OTR trust scoring system. Five tiers: PLATINUM (90+) / GOLD (80-89) / SILVER (70-79) / BRONZE (60-69) / UNRATED (under 60).

**Deep read**: [Book 2 Chapter 5](/en/book-2/ch5-scoring-engine)

***

### BreadcrumbList

**Definition**: A Schema.org markup type for breadcrumb navigation that helps search engines and AI agents understand a site's hierarchical structure.

**Deep read**: [Book 6 Chapter 3](/en/book-6/ch3-schema-org)

***

## C

### CAA (Certificate Authority Authorization)

**Definition**: A DNS record type that specifies which Certificate Authorities are permitted to issue SSL certificates for a given domain.

***

### Capability Negotiation

**Definition**: The process in UCP by which a platform and a merchant establish their mutually supported capabilities through a four-step algorithm.

**Four-step algorithm**: Compute intersection, select highest version, prune orphan extensions, repeat pruning until stable.

**Deep read**: [Book 3 Chapter 8](/en/book-3/ch8-platform-integration)

***

### Checkout Session

**Definition**: The core object in both UCP and ACP that represents a single transaction, containing the shopping cart, buyer information, shipping method, and payment status.

**UCP states**: incomplete / requires\_escalation / ready\_for\_complete / complete\_in\_progress / completed / canceled

**ACP states**: 11 states (including authentication\_required, pending\_approval, etc.)

***

### COLD Mode

**Definition**: The current operating mode of the OTR scoring engine. Evaluates trust entirely from publicly verifiable data without requiring merchant authorization. COLD mode has two weight variants depending on site classification.

**Ecommerce weight formula**: V x 0.40 + S x 0.15 + G x 0.20 + T x 0.10 + D x 0.15

**SaaS weight formula**: V x 0.37 + S x 0.20 + G x 0.23 + T x 0.15 + D x 0.05

**Contrast with AUTH mode**: AUTH mode (V x 0.10 + S x 0.10 + G x 0.10 + T x 0.05 + D x 0.25 + F x 0.40) activates when a merchant authorizes data access.

***

## D

### Delegate Payment

**Definition**: A Stripe-hosted secure payment API in ACP. The AI agent sends payment credentials to Stripe for tokenization and receives a vault token (format: `vt_...`). The merchant never handles raw card numbers.

**Endpoint**: `POST /agentic_commerce/delegate_payment`

**Deep read**: [Book 4 Chapter 1](/en/book-4/ch1-core-concepts)

***

### DKIM (DomainKeys Identified Mail)

**Definition**: An email authentication standard that attaches a digital signature to each outgoing message, allowing recipients to verify authenticity.

**Related terms**: SPF, DMARC

***

### DMARC (Domain-based Message Authentication)

**Definition**: An email authentication protocol that tells receiving mail servers how to handle messages that fail SPF or DKIM verification.

***

### DNSSEC (DNS Security Extensions)

**Definition**: A suite of DNS extensions that use digital signatures to ensure DNS query results have not been tampered with.

***

## E

### Elicitation

**Definition**: An MCP primitive that allows a Server to request additional information or confirmation from the user, implemented via the `elicitation/request` method.

**Deep read**: [Book 5 Chapter 2](/en/book-5/ch2-data-layer)

***

## F

### Finnhub

**Definition**: A financial data API platform used by OTR to verify publicly traded company identities and stock information.

***

## G

### GLEIF (Global Legal Entity Identifier Foundation)

**Definition**: The international foundation that administers the global Legal Entity Identifier (LEI) system for financial institutions and corporations.

**Official website**: [gleif.org](https://www.gleif.org/)

***

## H

### HSTS (HTTP Strict Transport Security)

**Definition**: An HTTP security header that forces browsers to use HTTPS exclusively, preventing protocol downgrade attacks.

***

## I

### Identity Linking

**Definition**: One of UCP's four core capabilities. Based on OAuth 2.0 Authorization Code flow, it establishes a secure user identity association between an AI agent platform and a merchant.

**Namespace**: `dev.ucp.common.identity_linking`

**Deep read**: [Book 3 Chapter 3](/en/book-3/ch3-identity)

***

### IndexNow

**Definition**: A real-time URL notification protocol by Microsoft and Yandex that proactively informs search engines of content updates.

***

## J

### JSON-LD (JavaScript Object Notation for Linked Data)

**Definition**: Google's recommended structured data format, embedding machine-readable information in HTML via a standalone script tag.

**Related terms**: Schema.org, Microdata

**Deep read**: [Book 6 Chapter 3](/en/book-6/ch3-schema-org)

***

### JSON-RPC 2.0

**Definition**: A lightweight remote procedure call protocol used by both MCP and ACP as their message transport format.

**Message types**: Request (has id, expects response), Response (reply to a Request), Notification (no id, no response expected)

***

### JWK (JSON Web Key)

**Definition**: A standard for representing cryptographic keys in JSON format. UCP's `/.well-known/ucp` Profile uses a JWK array to declare signing keys.

**Key fields**: kid (key ID) / kty (key type, e.g. EC) / crv (curve, e.g. P-256) / alg (algorithm, e.g. ES256)

***

## L

### LEI (Legal Entity Identifier)

**Definition**: A 20-character global identifier issued by GLEIF that certifies a legal entity's registered identity. Annual fee approximately \$60-100.

***

### llms.txt

**Definition**: A Markdown file at the website root that tells AI agents who you are, what you do, and what you sell in concise, structured language.

**Specification**: [llmstxt.org](https://llmstxt.org/)

**Deep read**: [Book 6 Chapter 6](/en/book-6/ch6-llms-txt)

***

## M

### MCP (Model Context Protocol)

**Definition**: A standard protocol for connecting AI applications to external tools and data sources. Originally created by Anthropic, now governed by the Linux Foundation.

**Spec version**: 2025-11-25 | **Official spec**: [modelcontextprotocol.io](https://modelcontextprotocol.io)

**Three primitives**: Tools (functions the model can call) / Resources (data the application can read) / Prompts (user-triggered templates)

**Deep read**: [MCP Protocol Deep Dive](/en/book-5/index)

***

### Microdata

**Definition**: A structured data format that embeds machine-readable information via HTML tag attributes (`itemprop`, `itemscope`). An alternative to JSON-LD.

***

### Minor Currency Units

**Definition**: The representation of monetary amounts in ACP and UCP using the smallest denomination defined by ISO 4217. \$79.99 = 7999 (cents), EUR 3.50 = 350 (euro cents), JPY 1000 = 1000 (yen has no fractional unit).

***

## O

### OAuth 2.1

**Definition**: The authorization framework used by MCP for authentication. Requires PKCE (S256) and prohibits the implicit grant flow, making it more secure than OAuth 2.0.

***

### OpenRPC

**Definition**: A specification format for describing JSON-RPC 2.0 APIs. UCP's MCP transport mode uses OpenRPC to define commerce tool schemas.

***

### OTR (Open Trust Registry)

**Definition**: An open trust registry protocol that provides AI agents with domain and merchant trust scores based on publicly available data. Covers 3,200,000+ domains. Created by ORBEXA.

**Open source**: [github.com/yb48666-ctrl/OTR-Protocol-by-orbexa](https://github.com/yb48666-ctrl/OTR-Protocol-by-orbexa)

**Deep read**: [OTR Protocol Deep Dive](/en/book-2/index)

***

### OTR-ID

**Definition**: A unique identifier generated by the OTR system for each assessed domain. Format: `OTR-{hash}`.

***

## P

### Payment Token Exchange

**Definition**: One of UCP's four core capabilities. Defines a three-step flow for securely exchanging payment credentials between a platform and a merchant: negotiate, acquire, complete.

**Credential flow**: Unidirectional, platform to merchant (the merchant must never transmit credentials back).

**Deep read**: [Book 3 Chapter 1](/en/book-3/ch1-core-concepts)

***

### Product Feed

**Definition**: The system in ACP through which merchants push product catalog data to OpenAI. Supports both SFTP file upload and REST API delivery methods.

**File formats**: Parquet (zstd) / jsonl.gz / csv.gz / tsv.gz

**Deep read**: [Book 4 Chapter 3](/en/book-4/ch3-file-upload)

***

## R

### Refinery Pipeline

**Definition**: ORBEXA's built-in AI data quality engine that automatically improves product data before it reaches protocol endpoints. Processes data through four stages: field mapping, AI description optimization, visual attribute extraction, and AI-powered standardization. Includes a hierarchical flywheel learning system that continuously improves mapping accuracy and a human-in-the-loop review mechanism for low-confidence records.

**Deep read**: [Book 7 Chapter 7](/en/book-7/ch7-data-quality)

***

### RFC 9421 (HTTP Message Signatures)

**Definition**: The HTTP message signing standard used by UCP for Webhook and API authentication, ensuring message integrity and origin authenticity.

***

### robots.txt

**Definition**: A file at the website root that tells crawlers which pages they may access. In the AI era, it must distinguish between traditional search engine bots and AI agent crawlers.

**Deep read**: [Book 6 Chapter 5](/en/book-6/ch5-robots-txt)

***

## S

### Sampling

**Definition**: An MCP primitive that allows a Server to request the Client to perform LLM inference, with support for model preference settings (cost / speed / intelligence trade-offs).

**Deep read**: [Book 5 Chapter 2](/en/book-5/ch2-data-layer)

***

### Schema.org

**Definition**: A structured data vocabulary jointly maintained by Google, Microsoft, Yahoo, and Yandex for marking up web content.

**Official website**: [schema.org](https://schema.org)

**Deep read**: [Book 6 Chapter 3](/en/book-6/ch3-schema-org)

***

### SEC EDGAR

**Definition**: The U.S. Securities and Exchange Commission's electronic filing system. OTR uses it to verify public company identities.

***

### Sitemap

**Definition**: An XML-formatted directory of website pages that helps search engines and AI crawlers discover all available content.

**Deep read**: [Book 6 Chapter 8](/en/book-6/ch8-sitemap)

***

### SPF (Sender Policy Framework)

**Definition**: An email authentication protocol that uses DNS records to declare which mail servers are authorized to send email on behalf of a domain.

***

### Streamable HTTP

**Definition**: The latest MCP transport mechanism (replacing the older HTTP+SSE approach). Uses a single endpoint supporting both POST requests and SSE streaming responses, with session management via the `Mcp-Session-Id` header.

**Deep read**: [Book 5 Chapter 3](/en/book-5/ch3-transport)

***

## T

### Trust Score

**Definition**: The OTR system's 0-100 composite score for a domain, assessed across six dimensions (V/S/G/T/D/F). In COLD mode, five active dimensions are weighted to produce the final score.

**Badges**: PLATINUM (90+) / GOLD (80-89) / SILVER (70-79) / BRONZE (60-69) / UNRATED (under 60)

***

## U

### UCP (Universal Commerce Protocol)

**Definition**: An open commerce protocol jointly initiated by Google, Shopify, Etsy, Wayfair, Target, and Walmart. Defines standardized interactions for checkout, identity, orders, and payments between AI agents and merchants.

**Spec version**: 2026-04-08 | **Official spec**: [ucp.dev](https://ucp.dev) | **GitHub**: 2.6k stars

**Four core capabilities**: Checkout / Identity Linking / Order / Payment Token Exchange

**Deep read**: [UCP Protocol Deep Dive](/en/book-3/index)

***

### UCP Profile

**Definition**: A JSON document deployed by merchants at `/.well-known/ucp` that declares supported UCP versions, capabilities, service endpoints, and signing keys.

**Deployment requirements**: HTTPS required, no redirects (3xx), Cache-Control max-age of at least 60 seconds.

**Deep read**: [Book 3 Chapter 7](/en/book-3/ch7-merchant-integration)

***

## V

### Vault Token

**Definition**: The payment token returned by the ACP Delegate Payment API (format: `vt_...`). Used in place of raw card numbers when transmitting payment information between merchants and payment providers.

***

## W

### WebRisk

**Definition**: Google's malicious website detection service. OTR uses it as a safety signal in the V (Verification) dimension.

***

### WHOIS

**Definition**: The domain registration information lookup protocol. OTR uses it to assess domain age and registration information completeness.

***

### Wikidata

**Definition**: Wikipedia's structured data repository. OTR uses it to verify a company's public notability and presence.

**Official website**: [wikidata.org](https://www.wikidata.org)

***

<Note>
  This glossary covers the UCP, ACP, MCP, and OTR protocols along with related technical standards. If you notice any missing terms, please submit an issue on [GitHub](https://github.com/yb48666-ctrl/OTR-Protocol-by-orbexa).
</Note>