Step 8 · HTTP inbox experimental
Offer the relationship and stay inside it
Creation. The agent asks in the Device Authorization (RFC 8628) with an authorization_details of type https://vxpprotocol.org/rar/relationship. Its actions are a subset of your company_initiated_actions, and you cap the limits to your own ceilings (draft 0.1: 10 per day and 90 days). The agent declares its inbox in its Client ID Metadata Document, same origin as its client_id; without it, answer invalid_authorization_details. The consent screen shows the relationship in business language with its own checkbox: unchecked, no relationship is created.
Agreement. The token response carries relationships[] with relationship_id, state, actions, limits, expires_at and the signed agreement (typ: vxp-relationship+jwt; iss, aud, sub, rel, actions, limits, iat, exp, jti).
Initiating. Check everything before signing or sending anything:
| Condition that fails | Error |
|---|
| The relationship does not exist | relationship_not_found |
| The relationship or its delegation was revoked | relationship_revoked |
| The relationship expired | relationship_expired |
| The action is outside the relationship | action_not_authorized |
| Daily limit reached | relationship_limit_exceeded |
| The resource belongs to another customer | target_not_found |
Then sign a vxp-company-request+jwt (iss, aud, sub, rel, action, content, iat, exp of 1 h in draft 0.1, jti), deliver it with POST {inbox_uri} and body {"message": "<jws>"}, and record the delivery and its HTTP result. A proposed change creates a normal operation, with signed terms, user_approval_required: true and its proof chain; proposing never executes. Accepting re-checks the relationship and the delegation: revoked in between, the answer is 403 relationship_revoked with no effect. Revoking the delegation revokes the relationship.
Agents without an inbox. A Poppy agent receives the relationship inside its Poppy conversation, as messages with data["vxpprotocol.org/relationship"]: relationship_offer, then relationship_agreement, then company_request events with role: company, and a signed reply_receipt (vxp-reply-receipt+jwt) for its one answer. The approval page sits on your own domain and reveals the agreement only after a code sent through a channel you have linked to the person. A live personal agent ran this path once, through the Poppy adapter, on 21 October 2026.
Device authorization request · authorization_detailscaptured
[
{
"type": "https://vxpprotocol.org/rar/capability",
"actions": [
"pedido.reprogramar_despacho"
],
"identifier": "P-1042"
},
{
"type": "https://vxpprotocol.org/rar/relationship",
"actions": [
"despacho.proponer_cambio"
],
"identifier": "relationship",
"limits": {
"max_per_day": 2,
"duration_seconds": 3600
}
}
]Token response · relationships[]captured
"relationships": [
{
"relationship_id": "rel_JFmlHKqmlCA7",
"state": "active",
"actions": [
"despacho.proponer_cambio"
],
"limits": {
"max_per_day": 2
},
"expires_at": "2026-10-22T07:09:18.000Z",
"agreement": "eyJhbGciOi…"
}
]Outgoing record of a company-initiated proposalcaptured
{
"outbox_id": "out_fQu1FIVuaYQN",
"delivery": "entregado",
"http": 202,
"content": {
"request_id": "req_lXXONI2mL8vd",
"request_url": "https://store.example/e/ferreteria-demo/v1/requests/req_lXXONI2mL8vd",
"proposal_id": "prop_op_NBbN47CrhrtM_r1",
"operation_id": "op_NBbN47CrhrtM",
"summary": "Cambiar el despacho del pedido P-1043 (Escalera de aluminio 6 peldaños) del 2026-10-27 al 2026-10-30, a Calle Ejemplo 100, Santiago, sin costo.",
"terms_digest": "sha-256:oduNxopNIIA-Iv1iqMDfnh_6QOQXtz0Zg6h34VN2z0g"
}
}Poppy conversation path · data membersfrom the specification
// offer (R12)
{ "type": "relationship_offer", "approval_url": "...", "actions": [...], "limits": {...} }
// creation (R14)
{ "type": "relationship_agreement", "relationship_id": "...", "actions": [...],
"limits": {...}, "expires_at": "...", "agreement": "<vxp-relationship+jwt>" }
// request (R15), on a message event with role: company
{ "type": "company_request", "relationship_id": "...", "action": "...", ...content,
"message": "<vxp-company-request+jwt>" }
// receipt of the agent's answer (R16)
{ "type": "reply_receipt", "alert_id": "...", "decision": "...",
"receipt": "<vxp-reply-receipt+jwt>" }