End-to-End Flow

An AI agent buys one “Coldplay World Tour - Floor Standing GA” ticket ($120.00), paying in FDUSD on BSC. Each step shows what the agent sends, what the merchant does behind the scenes, and what Prism returns.

1. Discovery

The agent checks the merchant’s UCP profile. The merchant fetches the handler declaration for its UCP version from Prism and returns it. The merchant caches this declaration. Agent → Merchant

GET /.well-known/ucp
UCP-Agent: profile="https://platform.example/ucp/profile"

Merchant → Prism (background)

GET https://prism-gw.fd.xyz/ucp/2026-08-25/handlers

Agent receives:

{
  "ucp": {
    "version": "2026-08-25",
    "payment_handlers": {
      "xyz.fd.prism_payment": [
        {
          "id": "xyz.fd.prism_payment",
          "version": "2026-10-07",
          "spec": "https://prism-gw.fd.xyz/ucp/prism.md",
          "schema": "https://prism-gw.fd.xyz/ucp/schema.json",
          "available_instruments": [{ "type": "x402" }],
          "config": {}
        }
      ]
    }
  }
}

Discovery needs no credentials. The agent confirms xyz.fd.prism_payment is present and proceeds to checkout. From here on, every request carries UCP-Agent, and a credential when the store requires one: an X-API-Key the merchant issued for the agent’s profile, or an RFC 9421 signature. See Authentication.

2. Checkout Session

The agent sends their cart. The merchant calls Prism to get the raw x402 payment requirements. It builds the handler entry from the cached declaration id and version, with the x402 object as config, and returns it in the session. Agent → Merchant

POST /checkout-sessions
Content-Type: application/json
UCP-Agent: profile="https://platform.example/ucp/profile"
X-API-Key: {KEY_ISSUED_BY_THE_MERCHANT}

{
  "line_items": [
    { "item": { "id": "ticket_floor_ga" }, "quantity": 1 }
  ]
}

Merchant → Prism (background)

POST https://prism-gw.fd.xyz/api/v2/merchant/payment-requirements
X-API-Key: prism_live_...
Content-Type: application/json

{
  "amount": "120.00",
  "currency": "USD",
  "resource": {
    "url": "https://merchant.example/checkout-sessions/sess_abc123",
    "description": "Coldplay World Tour - Floor Standing GA"
  }
}

Agent receives:

{
  "session_id": "sess_abc123",
  "payment_handlers": {
    "xyz.fd.prism_payment": [
      {
        "id": "xyz.fd.prism_payment",
        "version": "2026-10-07",
        "config": {
          "x402Version": 2,
          "resource": {
            "url": "https://merchant.example/checkout-sessions/sess_abc123",
            "description": "Coldplay World Tour - Floor Standing GA"
          },
          "accepts": [
            {
              "scheme": "exact",
              "network": "eip155:56",
              "amount": "120000000000000000000",
              "asset": "0xaB27f55DB008704Ed8098f0dfBCf5e1aA387b9d9",
              "payTo": "0x40a01003f7543a3a3ee64fFB05504173BDb1C4fD",
              "maxTimeoutSeconds": 300,
              "extra": { "name": "First Digital USD", "version": "1" }
            },
            {
              "scheme": "exact",
              "network": "eip155:8453",
              "amount": "120000000",
              "asset": "0x036cbd53842c5426634e7929541ec2318f3dcf7e",
              "payTo": "0x40a01003f7543a3a3ee64fFB05504173BDb1C4fD",
              "maxTimeoutSeconds": 300,
              "extra": { "name": "USDC", "version": "2" }
            }
          ]
        }
      }
    ]
  }
}

The agent extracts config and passes it to the wallet.

3. Payment Authorization

The agent’s wallet receives the config as paymentRequirements. No HTTP request goes out at this step — everything happens locally inside the TEE.

Wallet receives:  config.accepts — two options (BSC FDUSD, Base USDC)
Wallet selects:   eip155:56 (BSC), FDUSD — sufficient balance available
Wallet signs:     ERC-3009 transferWithAuthorization inside the secure enclave
Wallet returns:   complete signed x402 payment object

The private key never leaves the enclave. Only the signed authorization exits.

4. Complete Checkout

The agent submits the signed wallet output as the credential, plus one field: type: "x402". The instrument also has type: "x402" and handler_id: "xyz.fd.prism_payment". Agent → Merchant

POST /checkout-sessions/sess_abc123/complete
Content-Type: application/json
UCP-Agent: profile="https://platform.example/ucp/profile"
X-API-Key: {KEY_ISSUED_BY_THE_MERCHANT}

{
  "payment": {
    "instruments": [
      {
        "id": "wallet_bsc_fdusd",
        "handler_id": "xyz.fd.prism_payment",
        "type": "x402",
        "credential": {
          "type": "x402",
          "x402Version": 2,
          "paymentPayload": {
            "signature": "0x...",
            "authorization": {
              "from":        "0xAgentWalletAddress",
              "to":          "0x40a01003f7543a3a3ee64fFB05504173BDb1C4fD",
              "value":       "120000000000000000000",
              "validAfter":  "0",
              "validBefore": "1760000000",
              "nonce":       "0x..."
            }
          },
          "paymentRequirements": { "...": "config from step 2" }
        }
      }
    ]
  }
}

Merchant → Prism (background)

POST https://prism-gw.fd.xyz/api/v2/payment/settle
X-API-Key: prism_live_...
Content-Type: application/json

{ ...credential object verbatim... }

Prism executes the ERC-3009 transferWithAuthorization on BSC, verifies the transfer, and returns:

{
  "success": true,
  "transaction": "0xe80c...674b",
  "network": "eip155:56"
}

Agent receives:

{
  "order": {
    "id": "wc_order_aB3dE5fG7hJ9kL",
    "status": "confirmed",
    "payment": {
      "handler_id": "xyz.fd.prism_payment",
      "status": "settled",
      "transaction": "0xe80c...674b",
      "network": "eip155:56"
    }
  }
}

The ticket is reserved. 120 FDUSD has settled on-chain to the merchant’s wallet. The order id is opaque. Orders are fetched by this id, and only the platform that created the order can read it. There is no endpoint that lists orders.

5. Payment Held for Review

A merchant can hold a settled payment for manual review. The request still succeeds with HTTP 200. The checkout is not completed, so the agent sends the buyer to continue_url. Agent receives:

{
  "session_id": "sess_abc123",
  "status": "requires_escalation",
  "continue_url": "https://merchant.example/checkout/order-received/...",
  "messages": [
    {
      "type": "error",
      "code": "payment_on_hold",
      "severity": "requires_buyer_review",
      "content": "Payment received but held for merchant review"
    }
  ]
}

The payment has been received and the merchant keeps the order on hold until the review ends. A GET of the same checkout session returns the same status, continue_url, and message. Sending the complete request again answers 409 session_requires_escalation.

Testing

Use the production Prism gateway (https://prism-gw.fd.xyz) with your own account and small amounts to validate the full flow end-to-end against real on-chain settlement.

Merchant Guide

Step-by-step implementation for the merchant server

Agent Guide

Step-by-step implementation for the agent platform

Getting Started

Concepts

Architecture

Integrations

API Reference

Going to Production

AI Tooling

Resources

1. Discovery

2. Checkout Session

3. Payment Authorization

4. Complete Checkout

5. Payment Held for Review

Testing

Merchant Guide

Agent Guide

​1. Discovery

​2. Checkout Session

​3. Payment Authorization

​4. Complete Checkout

​5. Payment Held for Review

​Testing

Merchant Guide

Agent Guide

1. Discovery

2. Checkout Session

3. Payment Authorization

4. Complete Checkout

5. Payment Held for Review

Testing