{
 "acronym": "",
 "adoption": {
  "by": "Multiple libraries and at least one profile in production use (Web Bot Auth / Cloudflare); RFC 9421 is a general-purpose base standard, not agent-specific",
  "level": "observed",
  "probe_run": null
 },
 "aliases": [],
 "analog": "JWS for HTTP components",
 "collisions": [],
 "discovery": {
  "mechanism": "Signature and Signature-Input HTTP fields carried directly on the message; no fixed discovery path of its own",
  "path": "none"
 },
 "dispute": null,
 "evidence": [
  {
   "claim": "RFC 9421 is a Proposed Standard published by the IETF (2024) defining a mechanism for creating, encoding and verifying signatures over HTTP message components, including a means to request that a signature be applied to a subsequent message",
   "date": "2024-02",
   "label": "VERIFIED",
   "url": "https://www.rfc-editor.org/info/rfc9421"
  },
  {
   "claim": "Web Bot Auth's protocol draft explicitly builds its Agent/Origin signature exchange on top of RFC 9421's Signature and Signature-Input fields, adding the Signature-Agent field as an RFC 9421 signature component",
   "date": "2026-06-26",
   "label": "VERIFIED",
   "url": "https://datatracker.ietf.org/doc/html/draft-meunier-webbotauth-httpsig-protocol-00"
  }
 ],
 "form": "http-header",
 "governance": "IETF",
 "group": "Web Bot Auth family",
 "history": [
  {
   "date": "2026-09-05",
   "note": "seeded from Exa Agent research run"
  },
  {
   "date": "2026-09-06",
   "note": "verified against RFC 9421 primary source and confirmed as the base standard profiled by Web Bot Auth"
  }
 ],
 "id": "http-message-signatures",
 "implementation": "multi-implementation",
 "last_verified": "2026-09-06",
 "name": "HTTP Message Signatures",
 "native_status": "Proposed Standard",
 "origin": {
  "date": "2024-02",
  "org": "A. Backman, J. Richer, M. Sporny (IETF httpbis Working Group)"
 },
 "part_of": null,
 "parties": [
  "agent-site"
 ],
 "phase": "stable",
 "probe": {
  "method": "GET",
  "on_absent": "The message carries no RFC 9421 signature; any profile built on it (e.g. Web Bot Auth) cannot be verified",
  "parse": "Presence of Signature and Signature-Input HTTP fields (or their Content-Digest/Signature-related trailers) conforming to RFC 9421's structured-field syntax",
  "path": "n/a — inspect response/request headers on any HTTP exchange"
 },
 "question": "How can HTTP messages carry end-to-end component integrity and proof of possession, independent of transport-layer security?",
 "scope": "general",
 "spec_url": "https://www.rfc-editor.org/info/rfc9421",
 "step": "identify",
 "summary_md": "RFC 9421 (HTTP Message Signatures) is a general-purpose IETF Proposed Standard, not specific to agents. It defines how to create, encode and verify digital signatures or message authentication codes over selected components of an HTTP message (headers, derived components like @authority or @method, and optionally the body), so that a signature survives intermediaries that might otherwise alter or drop parts of the message [1]. It also defines how to request that a future message in an ongoing exchange be signed [1].\n\nIt solves message-level integrity and proof-of-possession for HTTP independent of transport security (TLS terminates at intermediaries; RFC 9421 signatures do not) [1]. It does not define identity discovery, key distribution, or any notion of \"bot\" or \"agent\" — those are added by profiles built on top of it. In this map, it is the base standard that Web Bot Auth (see the `webbotauth` record) profiles: Web Bot Auth adds the Signature-Agent header as a signed component and defines a specific key-discovery mechanism (a well-known JWKS directory), while RFC 9421 itself stays agnostic to what a signature proves or where keys come from [2].\n\nCurrent state: published as a Proposed Standard in February 2024 and stable since; it is not itself under active revision as far as this check found.\n\nWho implements it: general HTTP signing libraries exist across languages (this check did not re-survey the full ecosystem); its most visible agent-relevant use is as the substrate for Web Bot Auth, which Cloudflare verifies at the edge [2].\n\nDisputed or unknown: none specific to the base standard found in this pass. Because RFC 9421 is general and widely referenced, this record exists mainly to anchor the agent-specific profiles (Web Bot Auth, and potentially others) that depend on it; it should not be read as agent-specific adoption evidence on its own.",
 "track": "ietf",
 "version": {
  "date": "2024-02",
  "label": "RFC 9421, February 2024, Proposed Standard"
 },
 "url": "https://agenticweb.wiki/protocols/http-message-signatures/",
 "category": "identify",
 "type": "protocol"
}