{
 "acronym": "",
 "adoption": {
  "by": null,
  "level": "unmeasured",
  "probe_run": null
 },
 "aliases": [
  "Signature Agent Card",
  "Registry and Signature Agent card for Web bot auth"
 ],
 "analog": "OAuth Dynamic Client Registration metadata / client_id document",
 "collisions": [],
 "discovery": {
  "mechanism": "jwks_uri client-metadata field (or a plain client_id JSON document) resolvable at a well-known path",
  "path": "/.well-known/http-message-signatures-directory"
 },
 "dispute": {
  "claims": [
   "Whether this draft will be adopted by the webbotauth WG (as its sibling httpsig-protocol draft was) or superseded is not yet resolved."
  ],
  "summary": "The seed record's name implied this was the identity card format only; the draft text shows it also functions as the IANA registry establishment document for the web_bot_auth metadata namespace, and its examples show operators listing multiple bot/platform cards (crawlers, gateways) at a shared discovery path, not just one card per origin."
 },
 "evidence": [
  {
   "claim": "The draft defines the Signature Agent Card as a JSON metadata document reusing OAuth Dynamic Client Registration Metadata fields extended with a single web_bot_auth object, and registers that object with IANA",
   "date": "2026-06-26",
   "label": "VERIFIED",
   "url": "https://www.ietf.org/archive/id/draft-meunier-webbotauth-registry-03.html"
  },
  {
   "claim": "As of this check the document remains an individual submission (not yet a webbotauth WG document), unlike the sibling httpsig-protocol draft which was WG-adopted on 2026-09-01",
   "date": "2026-09-06",
   "label": "VERIFIED",
   "url": "https://datatracker.ietf.org/doc/draft-meunier-webbotauth-registry/"
  }
 ],
 "form": "document-format",
 "governance": "IETF individual draft, discussed on the web-bot-auth@ietf.org list; not yet adopted by the webbotauth WG (unlike the sibling httpsig-protocol draft)",
 "group": "Web Bot Auth family",
 "history": [
  {
   "date": "2026-09-05",
   "note": "seeded from Exa Agent research run"
  },
  {
   "date": "2026-09-06",
   "note": "verified against draft-meunier-webbotauth-registry-03 primary text and its current datatracker status page"
  }
 ],
 "id": "web-bot-auth-signature-agent-card",
 "implementation": "prototype",
 "last_verified": "2026-09-06",
 "name": "Signature Agent Card (Web Bot Auth registry)",
 "native_status": "Active Internet-Draft (individual), Intended Status: Informational",
 "origin": {
  "date": "2025-09",
  "org": "Maxime Guerreiro (Cloudflare), Ulas Kirazci (Amazon), Thibault Meunier (Cloudflare)"
 },
 "part_of": null,
 "parties": [
  "agent-site"
 ],
 "phase": "draft",
 "probe": {
  "method": "GET",
  "on_absent": "No Signature Agent Card is published; a verifier can still validate the raw signature via the plain key directory but has no machine-readable identity, purpose or rate-limit metadata for the signer",
  "parse": "JSON object with OAuth Dynamic Client Registration fields (client_id, client_name, client_uri, jwks_uri or jwks, contacts) plus a web_bot_auth extension object (e.g. expected-user-agent, rfc9309-product, trigger, purpose)",
  "path": "https://{origin}/.well-known/http-message-signatures-directory"
 },
 "question": "What identity, purpose, rate expectations and cryptographic keys belong to a signed bot?",
 "scope": "general",
 "spec_url": "https://datatracker.ietf.org/doc/draft-meunier-webbotauth-registry/",
 "step": "identify",
 "summary_md": "This draft defines the \"Signature Agent Card\": a JSON metadata document that a Web Bot Auth signer (a crawler, agent, or bot operator) publishes to describe itself — its identity, purpose, expected request rate, and cryptographic keys [1]. Rather than inventing a new schema, it reuses the OAuth Dynamic Client Registration Metadata field set (client_id, client_name, client_uri, logo_uri, contacts, jwks_uri/jwks) and extends it with a single `web_bot_auth` object (fields observed in the spec include expected-user-agent, an RFC 9309 robots.txt product token, a trigger type such as \"fetcher\", and a purpose such as \"tdm\" for text-and-data-mining) [1]. The same document also formally establishes an IANA registry for that `web_bot_auth` object's members, so third parties can register new fields.\n\nIt solves the metadata gap left by the base Web Bot Auth signature protocol: RFC 9421 signatures and the Signature-Agent header prove *that* a request was signed by a given key, but not *who* holds that key, *why* they are crawling, or *how fast* they intend to request — this card supplies that context in a machine-readable form at the same well-known path used for the key directory [1]. It does not itself carry the cryptographic proof (that is RFC 9421 plus the base Web Bot Auth protocol) and does not define enforcement — a site is free to ignore the declared purpose or rate.\n\nCurrent state: an individual Internet-Draft, draft-meunier-webbotauth-registry-03, published 2026-06-26, authored by engineers at Cloudflare and Amazon [1]. As of this check (2026-09-06) it has not been adopted by the newly chartered IETF webbotauth Working Group, unlike its sibling protocol draft, which was adopted as a WG document on 2026-09-01 [2]. Its examples show the same well-known path (/.well-known/http-message-signatures-directory) can list multiple signer cards — individual bots as well as \"platform\" gateways that sign on behalf of several downstream operators.\n\nImplementers: as an Informational registry-and-schema draft rather than a running protocol, no dedicated client/server implementations beyond the base Web Bot Auth signing/verifying stack (Cloudflare's libraries, see the sibling httpsig-protocol record) were found in this pass; none is claimed in the draft itself.\n\nDisputed or unknown: whether this draft will be folded into the WG's adopted protocol document or remain a separate track, and how much of the `web_bot_auth` extension object will change before any WG adoption, are both open.",
 "track": "ietf",
 "version": {
  "date": "2026-06-26",
  "label": "draft-meunier-webbotauth-registry-03, 2026-06-26"
 }
}