Skip to content

aauth-postman v0.1.0 Release Notes

Release Date: 2026-10-27

The first release: Postman collections for every AAuth access mode, a sandbox to run them against with one command, and a demo that shows a real run beside the protocol. The collections are generated from the same AAuth document as the AAuth Explorer, so what you send in Postman is what the walkthrough explains, step for step.

Highlights

  • Every AAuth access mode as a Postman folder, generated by pidl from the AAuth (draft-11) document in agent-protocols
  • One Compose file runs the aauth-go sandbox and, as an optional second part, the Petstore as an AAuth resource, with Newman runs of both collections
  • make demo shows a real run beside the AAuth walkthrough, step by step

Collections

Collection Environment What it runs Requests Assertions
aauth sandbox Agent identity, resource-managed access (two-party), person identity, PS authorization (three-party) and federated authorization (four-party), against the sandbox's demo resources 21 98
petstore petstore Browsing the pets with the agent's identity, then placing an order that is challenged for a person token, then an auth token 10 47
aauth-mock mock The walkthrough's example responses, for a Postman mock server

Each request passes the values it needs from earlier responses and checks the response it gets.

Signing

Postman cannot create HTTP message signatures (RFC 9421), so signed requests go to the sandbox's signing helper. The request's Signature-Key header tells the helper what to present: a token saved from an earlier response, identified by its typ; the helper's own agent token; agent provider enrollment; or a header web key. The helper signs the request with the test agent's keys and forwards it. See How Signing Works.

Running

docker compose up -d --build --wait                          # part 1: the sandbox
docker compose --profile test run --rm newman                # the access modes
docker compose --profile petstore up -d --build --wait       # part 2: adds the Petstore
docker compose --profile petstore run --rm newman-petstore   # the Petstore

The sandbox and the Petstore are built from sibling checkouts of aauth-go and petstore (v0.2.0 or later) until their images are published. SIGNER_PORT and SANDBOX_HTTPS_PORT move the host ports when 8099 or 443 are taken. The omniagent service plays the Petstore's agent with omniagent, an AI agent, instead of Postman.

Seeing a Run Beside the Protocol

make demo runs the Petstore order flow against fresh servers, captures the sandbox's trace and writes demo/live.html: the AAuth walkthrough with each scenario the run performed added as an "Observed" entry. A Newman run is found as two scenario instances, agent identity and PS authorization challenged on the API call, with every step matched strongly and every token identified by its type. Raw tokens and signatures are masked. make demo-omniagent does the same with omniagent as the agent, and make demo-page writes the page from a run of your own agent. See The Petstore Demos.

Generating

make generate writes the collections and environments from the documents in pidl/, which extend the AAuth document, and from targets.json. The make targets run pidl v0.10.0 with go run and fetch the AAuth document from the agent-protocols v0.9.0 release, so they need Go and network access but no checkouts. PIDL_VERSION, PIDL, AAUTH_PROTOCOLS_VERSION, AAUTH_DOC and CURL select other versions or local copies; see Regenerating.

Documentation

Compatibility

Component Version
AAuth draft-hardt-oauth-aauth-protocol-11
aauth-go sandbox v0.3.0 or later
petstore v0.2.0 or later
pidl v0.10.0
agent-protocols AAuth document v0.9.0

See the changelog for every change.