{"title":"UCP Sandbox changelog","home_page_url":"https:\/\/trade.ucpsandbox.com\/changelog","entries":[{"id":"2026-11-03-order-webhooks-arrive-after-the-order-and-are-retried","version":"0.14.2","date":"2026-11-03","kind":"Fixed","title":"Order webhooks arrive after the order and are retried","detail":"Order webhooks are sent once the request that placed the order has been answered, are retried over several minutes when the platform does not yet know the order or does not answer, and carry event_id and type in the body.","area":"Protocol"},{"id":"2026-11-03-fernway-wholesale-a-b2b-store","version":"0.13.0","date":"2026-11-03","kind":"New","title":"Fernway Wholesale, a B2B store","detail":"trade.ucpsandbox.com is a florist supplier that sells to businesses only, on the released spec: anyone can browse at list prices, carts and checkouts need a business account linked with identity linking, each account sees its own prices, stems come in case packs of 10 or 25 with minimum quantities, approved accounts can pay on Net 30 through the Payment Terms extension, and checkout also runs over A2A.","area":"Stores"},{"id":"2026-11-03-quotes-and-price-on-request-as-drafts","version":"0.13.0","date":"2026-11-03","kind":"New","title":"Quotes and price on request, as drafts","detail":"trade-quote.ucpsandbox.com adds the draft Quote extension (ask for a quote on a cart or checkout, accept it by id) and price on request for a few items. Both follow open proposals and will change with them.","area":"Protocol"},{"id":"2026-11-03-fernway-wholesale-negotiates-capabilities","version":"0.13.0","date":"2026-11-03","kind":"New","title":"Fernway Wholesale negotiates capabilities","detail":"The wholesale store computes the capability intersection with the platform profile on each request: payment terms and the draft quote are active only for a platform that declares them, and each linked account gets its saved delivery address on checkout.","area":"Protocol"},{"id":"2026-11-03-a-wholesale-store-type","version":"0.13.0","date":"2026-11-03","kind":"New","title":"A Wholesale store type","detail":"The hub lists stores as Retail, Stays, Food and now Wholesale.","area":"Docs and site"},{"id":"2026-11-03-docs-the-wholesale-store","version":"0.13.0","date":"2026-11-03","kind":"New","title":"Docs: the wholesale store","detail":"The quickstart shows how to link a business account, choose Net 30 and complete without a card.","area":"Docs and site"},{"id":"2026-11-03-ask-on-the-ask-test-stores","version":"0.12.0","date":"2026-11-03","kind":"New","title":"Ask on the ask test stores","detail":"flowers-ask.ucpsandbox.com and the other ask hosts declare UCP's Ask capability (dev.ucp.common.ask, 2026-08-25): POST \/ucp\/common\/ask and the ask_business tool answer questions from the store's own catalogue and policies, and a signed-in buyer can ask about their own orders.","area":"Protocol"},{"id":"2026-11-03-ask-about-shops-and-about-an-order","version":"0.12.0","date":"2026-11-03","kind":"New","title":"Ask about shops and about an order","detail":"On the ask hosts, Ask answers about each shop (address, hours on a given day, holiday closures, pickup and parking, stock there) and, for an order, whether each item can still be returned, whether it can still be cancelled and where it is.","area":"Protocol"},{"id":"2026-11-02-mcp-tools-work-with-the-official-python-mcp-client","version":"0.11.1","date":"2026-11-02","kind":"Fixed","title":"MCP tools work with the official Python MCP client","detail":"Tool lists now declare each output schema as an inline object. Strict clients could not use the old list, or read replies to it.","area":"Protocol"},{"id":"2026-10-31-store-analytics-who-said-who-they-were-and-who-proved-it","version":"0.11.0","date":"2026-10-31","kind":"New","title":"Store analytics: who said who they were, and who proved it","detail":"Each reference store's \/analytics page now opens with the share of agents that named themselves and the share that proved it, a grid of doors by level of proof, what agents read first, which transports the UCP profile offers against which agents used, and one paid journey from a verified agent.","area":"Stores"},{"id":"2026-10-31-how-the-analytics-page-decides-who-arrived","version":"0.11.0","date":"2026-10-31","kind":"New","title":"How the analytics page decides who arrived","detail":"\/analytics\/method on every reference store explains each level of proof, what the store keeps and what it never stores.","area":"Stores"},{"id":"2026-10-31-console-agents-and-journeys","version":"0.11.0","date":"2026-10-31","kind":"New","title":"Console: Agents and journeys","detail":"A new Analytics tab shows requests by door and level of proof, the busiest agents and what each proved, every journey across doors, and for browser sessions whether each looks like a person or an agent, with the reasons.","area":"Console"},{"id":"2026-10-30-embedded-checkout","version":"0.10.0","date":"2026-10-30","kind":"New","title":"Embedded checkout","detail":"flowers-embedded.ucpsandbox.com adds UCP's Embedded transport (Embedded Checkout Protocol, 2026-08-25) to Northlight Flowers: its profile lists the embedded transport, every checkout carries an embedded binding with the delegations it allows, and its continue_url opened in an iframe with ec_version speaks ECP to the host page. A host can take over the payment credential, address changes, payment method changes and links. White Orchid is redirect-only, and test switches cover an unsupported version and a refused host.","area":"Protocol"},{"id":"2026-10-30-docs-embedded-checkout","version":"0.10.0","date":"2026-10-30","kind":"New","title":"Docs: embedded checkout","detail":"The quickstart shows how to frame a checkout, what each delegation sends and how to test the error paths.","area":"Docs and site"},{"id":"2026-10-30-checkout-over-a2a","version":"0.9.0","date":"2026-10-30","kind":"New","title":"Checkout over A2A","detail":"flowers-a2a.ucpsandbox.com adds UCP's A2A transport to Northlight Flowers: its profile lists an A2A service whose agent card is at \/.well-known\/agent-card.json, and checkout runs at \/ucp\/a2a over A2A 0.3 (message\/send) or A2A 1.0 (SendMessage), with the UCP extension activated. Each reply carries the checkout in a2a.ucp.checkout. The action names (create_checkout, update_checkout, get_checkout, cancel_checkout, complete_checkout) are our interpretation: UCP's A2A binding shows add_to_checkout and complete_checkout only as examples and defines no list. Catalogue search stays on REST and MCP.","area":"Protocol"},{"id":"2026-10-30-docs-checkout-over-a2a","version":"0.9.0","date":"2026-10-30","kind":"New","title":"Docs: checkout over A2A","detail":"The quickstart shows the agent card, the headers for each A2A version and every checkout action.","area":"Docs and site"},{"id":"2026-10-29-a-missing-idempotency-key-over-mcp-is-invalid-params","version":"0.8.3","date":"2026-10-29","kind":"Fixed","title":"A missing idempotency key over MCP is invalid params","detail":"A complete_checkout or cancel_checkout call without meta[\"idempotency-key\"] now answers JSON-RPC -32602 with code idempotency_key_required; -32000 stays for a key reused with a different payload, as the MCP binding's error table has it.","area":"Protocol"},{"id":"2026-10-29-harbour-row-bookings-are-read-and-cancelled-by-their-id","version":"0.8.2","date":"2026-10-29","kind":"Fixed","title":"Harbour Row bookings are read and cancelled by their id","detail":"Confirmation numbers are random, and get_booking and cancel_booking take the booking id from confirmation.booking_id; a confirmation number alone answers not_found.","area":"Stores"},{"id":"2026-10-29-stays-warns-totals-changed-and-waits-for-the-new-price","version":"0.8.2","date":"2026-10-29","kind":"Fixed","title":"Stays warns totals_changed and waits for the new price","detail":"When a rate changes, the booking session warns totals_changed at $.totals as a disclosure, and complete is refused until the platform updates the session to the new totals, as the lodging draft requires.","area":"Protocol"},{"id":"2026-10-29-room-capacity-is-the-real-maximum-occupancy","version":"0.8.2","date":"2026-10-29","kind":"Fixed","title":"Room capacity is the real maximum occupancy","detail":"capacity.total is the most a room sleeps, and a party that does not fit is refused with occupancy_exceeded_capacity.","area":"Stores"},{"id":"2026-10-29-order-webhooks-are-signed-with-es256","version":"0.8.2","date":"2026-10-29","kind":"Improved","title":"Order webhooks are signed with ES256","detail":"Webhooks are signed with a P-256 key, the algorithm every UCP verifier supports; each store's profile publishes it alongside the existing Ed25519 key.","area":"Protocol"},{"id":"2026-10-29-kettle-streets-alcohol-warning-uses-the-policy-type-as-its-code","version":"0.8.2","date":"2026-10-29","kind":"Fixed","title":"Kettle Street's alcohol warning uses the policy type as its code","detail":"The age disclosure's code is com.ucpsandbox.policy.age_restricted, as UCP 2026-08-25 requires of a warning that refers to a policy.","area":"Protocol"},{"id":"2026-10-29-add-ons-point-to-their-dish","version":"0.8.2","date":"2026-10-29","kind":"Improved","title":"Add-ons point to their dish","detail":"At Kettle Street an add-on line carries line_item.parent_id for the dish it belongs to, on the checkout and on the order. A dish with no allergen recorded no longer reads as free of allergens.","area":"Stores"},{"id":"2026-10-26-location-search-refuses-a-filter-it-doesnt-support","version":"0.7.7","date":"2026-10-26","kind":"Fixed","title":"Location search refuses a filter it doesn't support","detail":"A location search or lookup with a filter other than hours, amenities or items is now refused with invalid_request, as the spec requires, instead of the filter being ignored and every shop returned.","area":"Protocol"},{"id":"2026-10-26-return-terms-an-agent-can-read","version":"0.7.6","date":"2026-10-26","kind":"New","title":"Return terms an agent can read","detail":"Every store has a -returns host, such as flowers-returns.ucpsandbox.com, on the draft Return Policy Extension (dev.ucp.shopping.policy.return, merged to the spec's main branch on 23 October, not yet in a release). Catalogue, cart, checkout and order responses carry the return window, refund types, return channels and fees; final-sale items come with a disclosure, and a delivered order states each return deadline. Responses in 2026-04-08 leave it out.","area":"Protocol"},{"id":"2026-10-26-clearer-returns-at-northlight-flowers","version":"0.7.6","date":"2026-10-26","kind":"Improved","title":"Clearer returns at Northlight Flowers","detail":"Fresh flowers and plants: tell us within 48 hours of delivery if they arrive damaged. Vases, accessories and dried flowers: 30 days unused, free in store or $4.95 by mail. Wedding and event pieces are final sale.","area":"Stores"},{"id":"2026-10-26-the-flowers-sign-in-servers-read-the-resource-parameter","version":"0.7.5","date":"2026-10-26","kind":"Improved","title":"The Flowers sign-in servers read the resource parameter","detail":"An authorization or token request may name the store as its resource (RFC 8707). The store's own resource identifier, as its protected resource metadata gives it, is accepted; any other value is refused with invalid_target.","area":"Protocol"},{"id":"2026-10-23-account-linking-with-no-client-registration","version":"0.7.4","date":"2026-10-23","kind":"New","title":"Account linking with no client registration","detail":"flowers-account-noreg.ucpsandbox.com offers identity linking with no registration endpoint, as many sign-in servers do. Use the public client ucpsandbox-test with PKCE S256 and no secret; redirect to https:\/\/ucpplayground.com\/oauth\/callback or a 127.0.0.1 or localhost address.","area":"Protocol"},{"id":"2026-10-23-link-a-buyer-account-at-northlight-flowers","version":"0.7.3","date":"2026-10-23","kind":"New","title":"Link a buyer account at Northlight Flowers","detail":"The store offers UCP identity linking (dev.ucp.common.identity_linking, 2026-08-25): OAuth 2.0 with PKCE, authorization server and protected resource metadata, client registration, a consent page with test buyers, and token revocation. It offers dev.ucp.shopping.order:manage; order reads stay open.","area":"Protocol"},{"id":"2026-10-23-a-store-where-reading-an-order-needs-a-linked-account","version":"0.7.3","date":"2026-10-23","kind":"New","title":"A store where reading an order needs a linked account","detail":"flowers-account.ucpsandbox.com offers dev.ucp.shopping.order:read and dev.ucp.shopping.order:manage: get_order without a linked buyer answers identity_required, and a token without the scope answers insufficient_scope.","area":"Protocol"},{"id":"2026-10-21-a-new-look-for-the-site","version":"0.6.2","date":"2026-10-21","kind":"Improved","title":"A new look for the site","detail":"The home page, docs, changelog, contact and legal pages have a new design. Nothing about the stores changed.","area":"Docs and site"},{"id":"2026-10-08-northlight-flowers-also-speaks-ucp-2026-04-08","version":"0.5.0","date":"2026-10-08","kind":"New","title":"Northlight Flowers also speaks UCP 2026-04-08","detail":"Agents built to the 2026-04-08 release get replies in that release. The store's profile lists it under supported_versions.","area":"Protocol"},{"id":"2026-10-08-carts-say-when-they-expire-and-orders-carry-their-number","version":"0.5.0","date":"2026-10-08","kind":"Improved","title":"Carts say when they expire, and orders carry their number","detail":"Carts include expires_at, and a completed checkout's order includes its label.","area":"Protocol"},{"id":"2026-10-05-sign-in-with-google","version":"0.4.0","date":"2026-10-05","kind":"New","title":"Sign in with Google","detail":"Use your Google account to sign in to the console, alongside GitHub and an emailed link.","area":"Console"},{"id":"2026-10-05-harbour-row-stays-and-kettle-street-noodles-are-previews","version":"0.4.0","date":"2026-10-05","kind":"Improved","title":"Harbour Row Stays and Kettle Street Noodles are previews","detail":"The UCP spec for lodging and food is still settling, so these two stores will change.","area":"Stores"},{"id":"2026-10-03-stores-check-request-signatures","version":"0.3.0","date":"2026-10-03","kind":"New","title":"Stores check request signatures","detail":"Web Bot Auth and UCP request signatures are checked against the keys the agent publishes. Unsigned agents are still answered.","area":"Protocol"},{"id":"2026-10-03-who-shops-here","version":"0.3.0","date":"2026-10-03","kind":"New","title":"Who shops here","detail":"Each store's analytics page shows which agents shop it and how many proved who they are. Only verified agents are named.","area":"Stores"},{"id":"2026-10-02-northlight-flowers-has-five-shops","version":"0.2.0","date":"2026-10-02","kind":"New","title":"Northlight Flowers has five shops","detail":"Find a shop by distance, delivery area, opening hours or stock, and collect an order from it.","area":"Stores"},{"id":"2026-10-02-location-search-and-lookup","version":"0.2.0","date":"2026-10-02","kind":"New","title":"Location search and lookup","detail":"The flowers store answers the UCP location calls over REST, MCP and WebMCP.","area":"Protocol"},{"id":"2026-10-02-analytics-for-your-stores","version":"0.2.0","date":"2026-10-02","kind":"New","title":"Analytics for your stores","detail":"How far agents got, what they searched for, which result they picked and where calls failed.","area":"Console"},{"id":"2026-10-02-each-reference-store-shows-how-agents-use-it","version":"0.2.0","date":"2026-10-02","kind":"New","title":"Each reference store shows how agents use it","detail":"Shares and timings at \/analytics on the store. No agent is named.","area":"Stores"},{"id":"2026-10-02-store-versions","version":"0.2.0","date":"2026-10-02","kind":"New","title":"Store versions","detail":"A reference store gets a version number when it changes, and an experiment records the version it ran on.","area":"Stores"},{"id":"2026-10-02-sign-in-with-github-or-an-emailed-link","version":"0.2.0","date":"2026-10-02","kind":"New","title":"Sign in with GitHub or an emailed link","detail":"No password. Your email is your account.","area":"Console"},{"id":"2026-10-02-account-page","version":"0.2.0","date":"2026-10-02","kind":"New","title":"Account page","detail":"See your details, download your data, sign out, or delete your account and everything in it.","area":"Console"},{"id":"2026-10-02-contact-page","version":"0.2.0","date":"2026-10-02","kind":"New","title":"Contact page","detail":"One form for questions, bugs in a test store and data requests.","area":"Docs and site"},{"id":"2026-10-02-stays-store-is-clearer-about-dates-and-prices","version":"0.2.0","date":"2026-10-02","kind":"Improved","title":"Stays store is clearer about dates and prices","detail":"Stay dates are spelled out, the booking window is stated, and prices can be shown in the traveller's currency as a guide.","area":"Stores"},{"id":"2026-10-02-idle-stores-are-archived","version":"0.2.0","date":"2026-10-02","kind":"Improved","title":"Idle stores are archived","detail":"A store copy nothing has used for 90 days stops answering; you can restore or delete it.","area":"Console"},{"id":"2026-10-01-ucp-sandbox-is-live","version":"0.1.0","date":"2026-10-01","kind":"New","title":"UCP Sandbox is live","detail":"Test stores any agent can shop, and experiments on your own copy of one.","area":"Docs and site"},{"id":"2026-10-01-three-reference-stores","version":"0.1.0","date":"2026-10-01","kind":"New","title":"Three reference stores","detail":"Northlight Flowers (retail), Harbour Row Stays (lodging) and Kettle Street Noodles (takeout).","area":"Stores"},{"id":"2026-10-01-experiments-a-against-b-one-change","version":"0.1.0","date":"2026-10-01","kind":"New","title":"Experiments: A against B, one change","detail":"Pick a change, point agents at both stores, read the result from the stores' own records.","area":"Console"},{"id":"2026-10-01-stores-speak-ucp-release-2026-08-25","version":"0.1.0","date":"2026-10-01","kind":"New","title":"Stores speak UCP release 2026-08-25","detail":"Over REST and MCP, with WebMCP tools in the storefront pages.","area":"Protocol"}]}