{
 "id": "x401",
 "name": "x401: HTTP Proof Requirement Protocol",
 "acronym": "",
 "aliases": [
  "x401"
 ],
 "collisions": [],
 "step": "identify",
 "parties": [
  "agent-site"
 ],
 "form": "http-header",
 "track": "vendor-consortium",
 "scope": "general",
 "question": "How can a resource ask an agent to prove something about the person behind it, such as being a verified human, before serving a request?",
 "analog": "A WWW-Authenticate challenge that asks for a verifiable credential instead of a password",
 "origin": {
  "org": "Proof, with Circle",
  "date": "2026-06-25"
 },
 "governance": "Editors Daniel Buchner (Proof) and Bhushit Agarwal (Circle); Apache-2.0 repository proof/x401; Proof says it plans to submit x401 to the FIDO Alliance agentic authentication workgroup",
 "native_status": "Status: Draft, Version 0.2.0 (version 0.1.0 still published at /spec/0.1.0/); the spec page carries no date",
 "phase": "draft",
 "implementation": "shipping",
 "adoption": {
  "level": "claimed",
  "by": "Proof (Superfluid named as a live implementation, 2026-09-22)",
  "probe_run": null
 },
 "version": {
  "label": "0.2.0 (Draft)",
  "date": null
 },
 "spec_url": "https://x401.proof.com/spec/latest/",
 "discovery": {
  "mechanism": "PROOF-REQUEST response header on a protected resource",
  "path": "none — signalled per request on the protected resource, not at a fixed path"
 },
 "probe": {
  "method": "GET",
  "path": "{origin}/{protected-path}",
  "parse": "A PROOF-REQUEST response header carrying base64url JSON that describes the credential required (OpenID4VP/DCQL)",
  "on_absent": "No PROOF-REQUEST header means this path does not ask for proof via x401; other paths on the same origin may."
 },
 "evidence": [
  {
   "claim": "The x401 spec page reads 'Status: Draft' and 'Version: 0.2.0', names editors Daniel Buchner (Proof) and Bhushit Agarwal (Circle), and defines PROOF-REQUEST, PROOF-RESPONSE and PROOF-RESULT headers carrying base64url JSON; credential requests use OpenID4VP over the Digital Credentials API with DCQL, an optional OAuth token exchange yields a reusable Verification Token, and payment stays in a separate 402 flow.",
   "label": "VERIFIED",
   "url": "https://x401.proof.com/spec/latest/",
   "date": null
  },
  {
   "claim": "The proof/x401 repository is Apache-2.0 licensed, created 2026-05-07 and last pushed 2026-10-18, with no tags.",
   "label": "VERIFIED",
   "url": "https://github.com/proof/x401",
   "date": "2026-10-18"
  },
  {
   "claim": "Proof's launch post announces x401 with Circle as named co-endorser and says Proof plans to submit it to the FIDO Alliance agentic authentication workgroup.",
   "label": "VERIFIED",
   "url": "https://www.proof.com/blog/identity-infrastructure-agentic-internet-x401",
   "date": "2026-06-25"
  },
  {
   "claim": "Proof's post 'Proof and Superfluid: A Verified Human Behind Every Agent Transaction' describes Superfluid's live use of x401.",
   "label": "VERIFIED",
   "url": "https://www.proof.com/blog/proof-and-superfluid-a-verified-human-behind-every-agent-transaction",
   "date": "2026-09-22"
  },
  {
   "claim": "Biometric Update reports Proof and Superfluid testing reusable identity for an AI agent wallet.",
   "label": "REPORTED",
   "url": "https://www.biometricupdate.com/202609/proof-superfluid-test-reusable-identity-for-ai-agent-wallet",
   "date": "2026-09-24"
  }
 ],
 "last_verified": "2026-10-20",
 "dispute": null,
 "summary_md": "x401 is an HTTP challenge-response pattern for proof of identity. A resource sends a PROOF-REQUEST header naming the verifiable credential it needs, and the agent answers with a PROOF-RESPONSE; the verifier sends back its own information, including any proof error, in a PROOF-RESULT header [1]. All three headers carry base64url JSON. The credential request uses OpenID4VP over the browser Digital Credentials API, with DCQL queries. An optional OAuth token exchange turns a successful proof into a reusable Verification Token [1].\n\nThe name echoes x402, and the two are meant to sit side by side. x401 does not use the HTTP status code to carry proof state, and payment stays in a separate 402 flow [1].\n\nThe spec is a Draft at version 0.2.0, edited by Proof and Circle, with the code under Apache-2.0 [1][2]. Proof launched it on 2026-06-25 and says it plans to take it to the FIDO Alliance's agentic authentication workgroup [3]. Proof names Superfluid as a live implementation [4][5]; that claim comes from Proof, not from a count.",
 "history": [
  {
   "date": "2026-10-20",
   "note": "added from gap scout 2026-10-20; verified against x401.proof.com/spec/latest/, github.com/proof/x401 and Proof's launch and Superfluid posts"
  }
 ],
 "part_of": null,
 "group": null,
 "watch": [
  {
   "type": "github",
   "repo": "proof/x401",
   "mode": "release",
   "version": false
  },
  {
   "type": "page",
   "url": "https://x401.proof.com/spec/latest/",
   "selector": "main",
   "cadence": "weekly"
  }
 ],
 "use_cases": [
  "prove-agent-identity",
  "delegate-user-authority"
 ],
 "audience": [
  "site-owner",
  "agent-builder",
  "platform"
 ],
 "pairs_with": [
  "x402",
  "vi",
  "a2wp",
  "webbotauth"
 ],
 "prerequisites": [],
 "freshness": "current",
 "url": "https://agenticweb.wiki/protocols/x401/",
 "category": "identify",
 "type": "protocol"
}