Skip to content

Proposal: Agent authentication securityScheme for OpenAPI #5265

@razashariff

Description

@razashariff

As AI agents become primary API consumers, OpenAPI needs a way to describe agent-specific authentication requirements.

Current gap: securitySchemes supports apiKey, http, oauth2, openIdConnect -- all designed for human users or static services. None capture agent identity, trust level, or behavioural authorization.

Proposed securityScheme: agentAuth

securitySchemes:
  agentTrust:
    type: agentAuth
    description: Agent must present cryptographic identity with minimum trust level
    properties:
      identityMethod: challengeResponse
      minimumTrustLevel: L2
      sanctionsScreeningRequired: true
      spendLimit: 10000

This enables API providers to declare: "this endpoint requires a verified agent with trust level L2+ and sanctions screening clearance."

Every API gateway (Kong, Apigee, AWS API Gateway) could enforce this natively.

Reference: IETF draft-sharif-agent-payment-trust-00 defines the trust level framework.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions