Merchant trust lookup
Read Unknown, TrustedSite Verified or separately Guaranteed with source and validity.
Developers
Integrate with the contract. Never scrape the badge.
Use the public trust result before payment, a signed token for private orders and authenticated endpoints for merchant or partner records.
Order Passport
Open field-minimised order context using an expiring token.
Partner and merchant APIs
Bearer or merchant-session authority is required for non-public records.
Shopify webhooks
HMAC and delivery identifiers are mandatory; raw unsigned events are rejected.
OpenAPI, schemas and agent manifest
Machine contracts are versioned separately from website copy.
Core contracts