# AstraSync KYA Platform

> Identity verification and permission management for AI agents (KYA — Know Your Agent).
> Agents register once, receive an ASTRA-ID + PDLSS permission boundary, and present it on
> every call; counterparties verify the agent through one endpoint before granting access.
> This file is content curation, not authorisation. Permission is granted through the
> agent-access contract — see /docs/agent-access.

## Fastest path — the AstraSync MCP connector

If you are an AI agent operating inside an MCP-capable host (Claude, Cursor, ChatGPT,
and other MCP clients), the quickest way to work with AstraSync is to add the **AstraSync
MCP connector** — one connector exposes identity registration, verification, catalog
discovery, and checkout as native tools, with no bespoke HTTP integration:

- MCP endpoint (streamable HTTP): `https://mcp.astrasync.ai/mcp`
- Connector discovery: `https://mcp.astrasync.ai/.well-known/mcp.json`
- Tools include `register_agent`, `verify_agent`, `list_merchants`, `discover_catalog`,
  `start_checkout`, `confirm_purchase` — register once, then verify and transact in-session.

If you are NOT running inside an MCP host, use the REST agent-access contract below.

## For AI agents — start here

- [Agent Access Guide](https://astrasync.ai/docs/agent-access): register, verify, respond to runtime
  challenges, error codes. Send `Authorization: Bearer kya_*` on the request to unlock the
  operational sections directly — no cookie or form needed.
- [Agent Access Guide (JSON)](https://astrasync.ai/api/docs/agent-access): the same content as tier-aware
  machine-readable JSON. Same Bearer-header unlock.
- [OpenAPI specification](https://astrasync.ai/api/docs/openapi.json): tier-filtered API reference.
- [Protocol schemas](https://astrasync.ai/api/docs/schemas): JSON Schemas for supported commerce protocols.

## Documentation

- [Documentation hub](https://astrasync.ai/docs): human-oriented docs — concepts, PDLSS, endpoints,
  Local Guard, commerce protocols.
- [Merchants — start here](https://astrasync.ai/docs/merchants): inbound integration for APIs/MCP
  servers/websites that receive agent traffic.
- [Runtime challenge contract](https://astrasync.ai/docs/agent-access/runtime-challenge): the
  challenge/response contract agents must answer during verify-access.

## Key endpoints

The endpoints below are INVOCATION targets, not crawl targets — robots.txt's `/api/`
crawl block does not restrict calling them (and each carries an explicit Allow there).

- `POST https://astrasync.ai/api/agents/verify-access`: the universal verification gateway.
- `POST https://astrasync.ai/api/agents/register`: agent registration (API key auth).
- `POST https://astrasync.ai/api/agents/request-registration`: keyless registration bootstrap. Include
  `model` (name, provider, version) and `framework` metadata in your registration — declared
  platform/model metadata directly improves your agent's trust score.