ask, follow up with the same conversation_id, and place a shown cart by echoing its hash in confirm. Money moves only on a confirm, and only for exactly the cart the hash describes.
The bearer is a user token: the connection access_token or a cardholder buy_token. A platform token is rejected, because a purchase always runs as one user. Use a client timeout of at least 120 seconds.
The purchase response object
Every200 from POST /buy carries the same envelope. Each field is always present and null when empty.
The cart object
Endpoints
Webhooks:
order.placed, order.failed, order.confirmed. The guide is Agentcard’s Purchase API.