--- type: Article name: What a checkout API call looks like from the other side. id: "https://selfe.ai/insights/protocols-and-agent-checkout/what-a-checkout-api-call-looks-like-from-the-other-side" url: "https://selfe.ai/insights/protocols-and-agent-checkout/what-a-checkout-api-call-looks-like-from-the-other-side" publisher: "did:web:selfe.ai" description: "Strip away the protocol names and an AI agent completing a purchase is, from a business's own system, just another API request arriving with a specific, checkable shape. Here's roughly what lands, and what a business's system has to do with it." datePublished: "2026-09-15T10:32:57.331Z" author: The Selfe team --- # What a checkout API call looks like from the other side. > Strip away the protocol names and an AI agent completing a purchase is, from a business's own system, just another API request arriving with a specific, checkable shape. Here's roughly what lands, and what a business's system has to do with it. ## In short - A checkout call carries the order, the confirmed price, a credential reference, a mandate reference and an idempotency key. - A business's system checks credential validity, mandate coverage, current price and duplicate requests, in that order. - The idempotency key is what stops a retried request from becoming a double booking or a double charge. None of what arrives in this request is exotic. The part worth paying attention to is the order these checks have to happen in, and what goes wrong when a business skips straight to the last one. ## The request that arrives Pull back the protocol names and what lands on a business's server is a single, structured request, worth looking at directly. A checkout call carries a handful of things together: the item or booking being confirmed, the price agreed at the moment it was quoted, a credential reference proving which agent is making the request, a mandate reference proving the spend was authorised, and an idempotency key, a unique tag for this exact attempt. None of it looks unfamiliar to a system that already processes online orders. It's just arriving with an agent's credentials attached instead of a person's session. ## What a business's system has to check, in order Whether the credential is valid and hasn't expired, first. Whether the mandate covers this amount, the same check AP2 defines, second. Whether the price quoted still matches what's live, third, since availability and rates can shift between an agent's first look and its final request. And whether the idempotency key has already been seen, to catch a duplicate before it becomes a duplicate booking or a duplicate charge. ## What it sends back A confirmed reference: a booking number, an order ID, whatever the business's system already generates for a normal transaction. Plus anything the agent needs to relay back to the person it's acting for, a check-in time, a contact number, cancellation terms, so the confirmation is useful once it reaches them. ## Why the idempotency key matters more than it looks An agent can retry a request that appears to have failed, a timeout, a dropped connection, without knowing whether the first attempt succeeded. Without an idempotency key, a business's system has no way to tell a genuine second request from a retry of the first, and ends up double-booking or double-charging on exactly the requests that were already technically fine. ## What a business's own system never has to do Selfe runs this whole sequence, credential, mandate, price, idempotency, for every checkout it processes, so a business's own system only ever sees the result: a confirmed order, not four separate protocol checks it has to implement and maintain itself. ## Do we need to build all these checks ourselves? Not with Selfe. The sequence runs automatically, and a business's system only sees the confirmed result. ## What if the price has changed since the agent last checked? The request is refused rather than silently honoured at the old price, so the business never completes a sale at a rate it no longer offers. ## Act on this - [Check whether an agent can buy from you](https://selfe.ai/agentic-commerce/buyability-check) — the free readiness scan. - [Discover venues](https://selfe.ai/api/registry/discover) — `POST`, semantic browse across the registry. - [Match a bookable answer](https://selfe.ai/api/registry/match) — `POST` with dates and party size. - [Verify Selfe's identity](https://selfe.ai/.well-known/did.json) — `did:web:selfe.ai`. - [Agent card](https://selfe.ai/.well-known/agent-card.json) — how to connect over A2A or MCP.