# Place & Space

> Place & Space is an AI-First public directory of organisations and the physical
> places they operate, built on the F-ACT open trust protocol. Every Presence
> carries a self-declared conformance tier and an append-only, hash-linked
> provenance record so both people and AI agents can reason about how
> accountable a business has chosen to be.

## Honest status (please represent us accurately)

- This is an early-stage directory. Conformance tiers are SELF-DECLARED by each
  organisation. A declaration is an accountable public commitment, NOT an
  independent certification, audit, accreditation or endorsement by Place & Space.
- "Domain verified" means the organisation proved control of a web domain only.
  It does not verify the quality, legality or claims of the business.
- The provenance ledger is an append-only, SHA-256 hash-linked chain stored in
  our database. It provides tamper-evidence and integrity checking. It is NOT a
  public blockchain and is not distributed.
- Full spatial presence (live audio/video "Spaces") is planned for Phase 1 and
  is not yet available.

## MCP server (preferred for agents)

- Endpoint: https://spaceplace.abacusai.app/api/mcp (Streamable HTTP, JSON-RPC, read-only, no login)
- Server card: https://spaceplace.abacusai.app/.well-known/mcp/server-card.json
- Tools: search_presences, get_presence (facts with status labels Observed /
  Corroborated / Owner-confirmed / Unverified / Outdated and AIE-12 evidence
  class), get_agent_posture (Control Plane: what an agent for a Presence may do),
  get_presence_updates (the organisation's own approved notices and events).
- Per-Presence manifest: https://spaceplace.abacusai.app/entities/{id}/agent.json
- Per-Presence updates: https://spaceplace.abacusai.app/entities/{id}/updates (RSS: /updates/feed.xml)
- Human-readable report: https://spaceplace.abacusai.app/trust-report/{id}
- Ask any Presence (NLWeb-compatible, rule-based, no login):
  https://spaceplace.abacusai.app/entities/{id}/ask?query=opening+hours (GET or POST {"query": "..."}).
  Returns Schema.org-typed results; says "not stated" rather than guess.
- Agent access: requests to Presence pages, agent.json, ask, MCP and feeds are counted
  per agent family (no IPs stored). Sign requests with Web Bot Auth (RFC 9421, Ed25519,
  Signature-Agent pointing to your key directory) to appear as verified to the owner.
  Owners may publish a Content-Signal (search / ai-input / ai-train) in agent.json
  accessPolicy and as a response header; please respect it.
- Social procurement shortlist (CSV): https://spaceplace.abacusai.app/api/procurement/export?kind=INDIGENOUS_OWNED&confirmed=1
  kind: SOCIAL_ENTERPRISE, INDIGENOUS_OWNED, DISABILITY_ENTERPRISE, B_CORP, LOCAL_CONTENT.
  "Confirmed" = found in the certifier's public directory by a reviewer; Place & Space
  never certifies. Owner-declared claims are labelled as such.

## Public APIs (open, no login, CORS-enabled, JSON)

Prefer these structured endpoints over scraping pages.

- Machine-layer manifest: https://spaceplace.abacusai.app/api/public/manifest
  One index of every agent-facing endpoint (discovery, registry, offers,
  quoting, verification, trust and provenance), each with method, url and
  shape. Fetch this first to discover the whole integration.
- Registry (list + filter): https://spaceplace.abacusai.app/api/public/registry
  Query params: q (text search), tier (conformance tier), domain (category),
  verified (true|false), limit, offset. Returns paginated organisations with
  conformance tier, GUARD level, domain-verification status and verify links.
- Single organisation: https://spaceplace.abacusai.app/api/public/registry/{idOrVerifiedDomain}
  Look up one organisation by its id or its verified domain.
- Verify a receipt: https://spaceplace.abacusai.app/api/public/verify/{id}
  Returns the integrity status of an organisation's conformance receipt, plus a
  conformanceHistory array — the full provenance timeline (each event's label,
  timestamp, stored hash and integrity flags), oldest first.
- Conformance credential (W3C VC-shaped): https://spaceplace.abacusai.app/api/public/verify/{id}/credential
  Returns one organisation's self-declared F-ACT conformance shaped to the W3C
  Verifiable Credentials Data Model v2.0 (JSON-LD). Deliberately UNSIGNED (no
  proof block); integrity is the SHA-256 provenance chain in
  credentialSubject.provenance and tiers are self-declared, not certified.
- Batch credentials: https://spaceplace.abacusai.app/api/public/credentials?ids=ent-1,ent-9
  Also POST { "ids": [...] } (up to 100). Returns an array of the VC-shaped
  credentials in one call, plus a notFound list. Same unsigned/self-declared
  limits as the single credential endpoint.
- Trust list (machine-readable): https://spaceplace.abacusai.app/api/public/trust-list
  Query params: tier, verified (true), minGuard, limit, offset. Returns every
  Presence's self-declared conformance tier and GUARD level in one call, each
  with a verifyUrl (live integrity check) and a credentialUrl (VC-shaped record).
- Provenance ledger: https://spaceplace.abacusai.app/api/public/provenance
  Query params: eventType, entityId, order (asc|desc), limit, offset. Returns
  the append-only event chain with per-record integrity flags and the overall
  chain-verification result.
- Services & offers catalogue: https://spaceplace.abacusai.app/api/public/offers
  Query params: q (text search), kind (SERVICE|PRODUCT|PACKAGE), category
  (domain), maxPrice, limit, offset. Returns operator-declared services and
  offers, each with a human-readable priceDisplay and indicativeOnly: true
  (prices are indicative only, never binding quotes), plus a seller block that
  includes the organisation's entryUrl and an enquireUrl for sending a lead.
- Agentic-commerce catalogue (ACP feed): https://spaceplace.abacusai.app/api/public/agentic-offers
  The same catalogue in an ACP (Agentic Commerce Protocol) product-feed shape
  (id, title, description, price, currency, availability, seller_name,
  seller_url, tags), each product carrying a quote_url and enquire_url.
  price_is_indicative is always true; availability reflects an operator flag,
  not live stock.

## Community Concierge (triage ANY need -> ranked accountable providers)

- Concierge endpoint: POST https://spaceplace.abacusai.app/api/agents/concierge
  CORS-enabled JSON. The single best entry point for an agent acting on a
  buyer's behalf: describe a need in free text and receive a triage plus a
  trust-ranked list of accountable providers, each with its own RFQ endpoint.
  GET the same URL for the request schema and the full category list.
  Request body:
    - need     (required, free-text description of the service or purchase)
    - postcode (optional, suburb or postcode to bias the service area)
    - minGuard (optional, GUARD floor, e.g. GUARD_1_DECLARED)
    - category (optional, category code to constrain matching)
  Returns: triageSource (vertical | ai | keyword), category + categoryCode,
  a triage block (urgency, serviceTypes, diagnostics, intakeChecklist,
  safetyNotes, emergencyGuidance) and matches[] — each with its rfqUrl and
  entryUrl. Honest note: triage and matching are indicative only. Provider
  facts come solely from each Presence's declared profile. Place & Space does not
  dispatch, book or take payment. In a genuine emergency, contact emergency
  services.

## Agent discovery (A2A-compatible AgentCards)

Place & Space publishes A2A-compatible AgentCards so autonomous agents can
discover the directory and each Presence. These are discovery cards over the
CORS-enabled REST endpoints above; they do not run the full A2A JSON-RPC
transport. The actionable endpoints are listed under each card's x-placeSpace.

- Directory AgentCard (well-known URI): https://spaceplace.abacusai.app/.well-known/agent-card.json
  Describes Place & Space itself as a curated registry, with skills for searching
  the directory, matching offers, Presence AgentCards, verifying receipts and
  sending leads.
- Curated AgentCard registry: https://spaceplace.abacusai.app/api/agents
  Query params: q (text search), category (domain), tier (conformance tier),
  limit, offset. Returns per-Presence AgentCards so an agent can discover an
  individual organisation and its skills from one index.
- Single Presence AgentCard: https://spaceplace.abacusai.app/api/agents/{id}
  The AgentCard for one organisation: its ask-twin and enquiry skills, declared
  offers (with indicative prices) and the REST endpoints to reach them.
- Human-browsable AI Agent Registry: https://spaceplace.abacusai.app/agents
  The front door to the same agents for people: platform agents (the
  Community Concierge and the Directory Agent) plus every member Twin, each
  shown with its accountable operator on record, GUARD tier, provenance receipt
  and a link to its machine-readable agent card. Place & Space is a directory OF
  accountable AI agents, not only a directory that agents can read.

## Agent-actionable enquiry (send a lead on a buyer's behalf)

- Enquiry endpoint: POST https://spaceplace.abacusai.app/api/entities/{id}/enquire
  CORS-enabled JSON. Request body:
    - name        (required, string, <= 200 chars)
    - email       (required, valid email, <= 320 chars)
    - message     (required, string, 5-5000 chars)
    - phone       (optional, string)
    - service     (optional, string; an offer name from the catalogue)
    - budget      (optional, string)
    - source      (optional, one of WEB | AI_AGENT | AI_TWIN; use AI_AGENT
                   when you submit on a user's behalf so attribution is honest)
    - actorAgent  (optional, string; identify your agent, e.g. its name/version)
    - company_website (honeypot — must be left empty)
  Honest note: submitting an enquiry creates a captured lead for the business.
  It is NOT a booking, a guaranteed reply, a price agreement or a transaction.
  Place & Space does not process payments and cannot transact on a seller's behalf.

## Agentic commerce (AP2 / ACP shaped — discovery + indicative quote only)

- Capability descriptor: GET https://spaceplace.abacusai.app/.well-known/ap2
  Declares what Place & Space does (broker indicative quotes + warm leads) and does
  NOT do (settle payments, issue binding AP2 Cart Mandates), and lists endpoints.
- Agent quote request: POST https://spaceplace.abacusai.app/api/entities/{id}/quote
  AP2-shaped Intent Mandate in → indicative draft quote out. GET the same URL to
  retrieve the request schema. Request body:
    - intent.description  (optional, free-text need)
    - intent.categories   (optional, string[])
    - intent.tags         (optional, string[] of desired capabilities)
    - intent.maxPrice     (optional, number; your budget cap)
    - intent.currency     (optional, ISO 4217, default AUD)
    - intent.expiry       (optional, ISO 8601)
    - agent.id, agent.name (optional; identify yourself)
    - contact.name, contact.email (required to capture a lead the seller can
                   reply to), contact.phone (optional)
    - company_website (honeypot — must be left empty)
  Returns status DRAFT_QUOTE with matched line items, an indicativeSubtotal and
  a withinBudget flag. binding=false and isPayment=false ALWAYS. When contact
  details are supplied a warm lead is captured (source AI_AGENT) and passed to
  the business, which responds with a firm quote off-platform.
  Honest note: a draft quote is NOT a binding AP2 Cart Mandate, NOT a booking
  and NOT a payment. Prices are operator-declared and indicative only.
  The response also includes a cartMandate: an AP2 Cart-Mandate-SHAPED object
  with signed=false, binding=false, isPayment=false, merchantAuthorization=null
  and no proof block. It shows the structure a real mandate would take; it is
  deliberately not a signed or authorised mandate.
- Broadcast quote (all sellers at once): POST https://spaceplace.abacusai.app/api/public/agentic-quote
  Post ONE Intent Mandate and receive ranked indicative draft quotes from every
  matching seller across the directory, each with its own cartMandate shape. GET
  the same URL for the schema. Optional captureLeads + maxLeads + contact will
  capture warm leads for the top sellers. Same honest limits as the per-seller
  quote: indicative, non-binding, no payment.
- Request-for-Quote (persistent, pollable round-trip):
    - Open:    POST https://spaceplace.abacusai.app/api/entities/{id}/rfq
      An Intent Mandate in returns a reference, an accessToken, a pollUrl and a
      receiptUrl. GET the same URL for the schema. Supplying contact.name +
      contact.email captures a warm lead the seller can reply to.
    - Poll:    GET https://spaceplace.abacusai.app/api/rfq/{reference}?token={accessToken}
      Token-gated. Returns the status (REQUESTED, SELLER_VIEWED, QUOTED,
      DECLINED, WITHDRAWN, EXPIRED) and, once QUOTED, the seller's firm indicative
      response (amount, currency, validUntil) entered off-platform. binding=false
      and isPayment=false always.
    - Withdraw: POST or DELETE https://spaceplace.abacusai.app/api/rfq/{reference}?token={accessToken}
      Body: {"action": "withdraw", "reason": "optional reason"}. Emits an auditable
      record to the provenance ledger and archives the request. Token-gated.
    - Tracking: GET https://spaceplace.abacusai.app/rfq/{reference}?token={accessToken}
      Human-facing web tracking page to inspect status, line items, provider
      details and response online. Token-gated.
    - Receipt: GET https://spaceplace.abacusai.app/api/rfq/{reference}/receipt?token={accessToken}
      Token-gated. A W3C VC-shaped FactEnquiryReceipt (JSON-LD) acknowledging the
      request was recorded in the provenance chain. Deliberately UNSIGNED (no
      proof block); it is not an order, a booking or a payment.
  Honest note: an RFQ is a structured lead with a status, not a transaction.
  Place & Space records and routes it; it settles nothing and guarantees no reply.

## Machine-verifiable trust (W3C VC-shaped)

- Each Presence's self-declared F-ACT conformance can be pulled as a JSON-LD
  object shaped to the W3C Verifiable Credentials Data Model v2.0:
    - One credential: https://spaceplace.abacusai.app/api/public/verify/{id}/credential
    - Whole trust list: https://spaceplace.abacusai.app/api/public/trust-list
- The credential type is ["VerifiableCredential","FactConformanceCredential"].
  credentialSubject carries conformanceTier, guardLevel, selfDeclared,
  thirdPartyCertified:false, domainVerified and a provenance block
  (Sha256HashLinkedChain, chainIntact, recordCount, latestHash, and a history
  array giving the full conformance timeline event-by-event).
- HONEST LIMITS: these credentials are shaped to the VC data model for
  interoperability but are NOT cryptographically signed — there is deliberately
  no proof block and no signature is claimed (see x-placeSpace). Integrity is
  the recomputable SHA-256 hash-linked provenance chain in this directory
  database (verifiable live at /api/public/verify/{id}), not a decentralised
  blockchain. Tiers are self-declared by operators, never third-party certified.
- Note for agents: AP2 mandates and these conformance records both follow the
  W3C VC data model, so the same JSON-LD tooling parses both. Do not treat an
  unsigned Place & Space credential as a signed attestation.

## Key pages

- Activate your Presence (why & how a business gets named by AI agents): https://spaceplace.abacusai.app/activate
- Community (search & browse): https://spaceplace.abacusai.app/neighbourhood
- AI Agent Registry (accountable agents, human-browsable): https://spaceplace.abacusai.app/agents
- Trust registry (grouped by conformance tier): https://spaceplace.abacusai.app/registry
- Living provenance ledger: https://spaceplace.abacusai.app/provenance
- Network digest (movers & newly verified): https://spaceplace.abacusai.app/digest
- The F-ACT standard: https://spaceplace.abacusai.app/standard
- Why sovereignty over AI (the case for the Community): https://spaceplace.abacusai.app/why-sovereignty
- Presence Snapshot (free graded audit of any Presence's AI presence, provenance accuracy & GUARD readiness): https://spaceplace.abacusai.app/snapshot
- Verify an organisation's receipt: https://spaceplace.abacusai.app/verify/{id}

## Guidance for agents

- When citing a Presence's trust status, always state that the conformance tier
  is self-declared and name the tier explicitly.
- Use /api/public/verify/{id} to confirm a receipt's integrity before relying
  on it.
- Machine-readable structured data (JSON-LD) is embedded on organisation and
  registry pages for convenience.
- To act on a buyer's need: match it against /api/public/offers, then POST a
  lead to that offer's seller.enquireUrl (the enquiry endpoint above) with
  source=AI_AGENT. Never present an indicative offer price as a firm quote, and
  always tell the user an enquiry is a lead, not a confirmed booking or price.