Install
$ agentstack add skill-orcaqubits-agentic-commerce-skills-plugins-acp-checkout-rest ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
ACP Checkout — REST Binding
Before writing code
Fetch live docs:
- Fetch
https://developers.openai.com/commerce/specs/checkout/for the canonical checkout specification - Web-search
site:github.com agentic-commerce-protocol spec openapi checkoutfor the latest OpenAPI YAML - Fetch
https://developers.openai.com/commerce/guides/key-concepts/for data model details - Web-search
site:docs.stripe.com agentic-commerce protocol specificationfor Stripe's merchant-side reference
Conceptual Architecture
Five Checkout Operations
| Operation | Method | Path | Success | |-----------|--------|------|---------| | Create | POST | /checkout_sessions | 201 | | Update | POST | /checkout_sessions/{id} | 200 | | Retrieve | GET | /checkout_sessions/{id} | 200 | | Complete | POST | /checkout_sessions/{id}/complete | 200 | | Cancel | POST | /checkout_sessions/{id}/cancel | 200 |
Session State Machine
not_ready_for_payment → ready_for_payment → completed
| | |
+──────────────────────+→ canceled ←────+
|
in_progress
|
authentication_required
The five core status enum values are: not_ready_for_payment, ready_for_payment, completed, canceled, in_progress. Note that authentication_required is a transitional/conditional state (returned during 3DS flows), not one of the five core status values.
The merchant controls status transitions. The agent reads the status and reacts.
Required Headers (Every Request)
Authorization: Bearer— REQUIREDAPI-Version: YYYY-MM-DD— REQUIREDIdempotency-Key:— REQUIRED on all POSTContent-Type: application/json
Core Data Objects
- CheckoutSession — The central primitive: ID, status, currency, line items, fulfillment options, totals, messages, links, payment provider
- Item —
id+quantity(sent by agent in create/update) - LineItem — Merchant's expanded view: base amount, discount, subtotal, tax, total, name, description, images
- Total — Typed breakdown:
items_base_amount,items_discount,subtotal,discount,fulfillment,tax,fee,total - FulfillmentOption — Shipping/digital/pickup/local delivery with pricing and windows
- Address — Buyer's fulfillment address
- Buyer — First name, last name, email, optional phone
Monetary Values
All amounts are integers in minor currency units (cents). $19.99 = 1999. Floating-point is prohibited.
Messages
The messages[] array allows merchant-to-agent communication:
- Inform the agent about restrictions, policies, or required actions
- Messages have types (info, warning, error) that influence agent behavior
Links
The links[] array provides actionable URLs with spec-defined link types:
terms_of_use— Merchant terms of use pageprivacy_policy— Merchant privacy policy pageseller_shop_policies— Merchant shop policies page
Create Flow
- Agent sends items + optional buyer info + optional address
- Merchant validates items against inventory
- Merchant computes line items, fulfillment options, totals
- Returns session with
not_ready_for_paymentorready_for_payment
Update Flow
- Agent sends modified items, address, fulfillment choice, or buyer info
- Merchant revalidates and recomputes everything
- Returns updated session with new status
Complete Flow
- Agent sends payment data (SPT from delegated payment)
- Merchant processes payment via PSP
- On success: returns session with
completedstatus + order details - On 3DS required: returns
authentication_required+ authentication challenge - Agent must handle 3DS and retry complete with authentication result
Error Handling
- All errors return flat objects:
type,code,message,param - Use
param(JSONPath) to indicate which field caused the error - Handle idempotency conflicts (422) and in-flight duplicates (409)
Fetch the OpenAPI spec for exact request/response schemas, field types, and all possible error codes before implementing.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: OrcaQubits
- Source: OrcaQubits/agentic-commerce-skills-plugins
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.