UCP Profile Validator

Free plan limit: Free-plan users can receive up to 5 result records per run. Paid-plan and local/unknown runs retain the Actor's existing limits.

Validate a Universal Commerce Protocol (UCP) business or platform profile before AI agents depend on it. The Actor accepts a merchant/profile URL or inline JSON, selects the official schema for the declared UCP date-version, and returns one detailed report.

What it validates

The Actor checks the complete profile document, not checkout, cart, catalog, or order payloads.

Output field	Meaning
valid	No structural, semantic, namespace, or requested remote-resource errors
schemaValid	Profile matches the official versioned UCP business/platform schema
remoteChecksPassed	Advertised schema and specification resources were reachable and usable, or null when disabled
protocolVersion	Date-version declared in ucp.version
errorCount, warningCount	Blocking and advisory finding totals
capabilityCount, serviceCount, paymentHandlerCount	Registry entry totals
checks	Stable finding codes, severity, JSON path, message, URL, and HTTP status when relevant

In addition to JSON Schema validation, the report checks:

• UCP namespace authority binding for every advertised schema URL;
• HTTPS and user-info safety for machine-fetched resources;
• missing extension parents and self-extension;
• duplicate service transport declarations;
• duplicate payment-handler IDs and JWK kid values;
• accidental private JWK members in a public profile;
• remote schema/specification reachability when enabled.

When to use it

Use this Actor in merchant onboarding, CI release checks, agent-commerce readiness reviews, and monitoring of /.well-known/ucp. It is useful to retailers, commerce platforms, payment teams, and developers implementing UCP discovery.

Do not use it to validate checkout/order request or response payloads, execute merchant endpoints, prove domain ownership, verify HTTP message signatures, or perform a security audit. A successful resource fetch proves reachability at validation time, not long-term availability or trust.

Input

Field	Type	Default	Description
sourceType	json or url	json	Select inline profile JSON or a remote profile
profile	object	valid fixture	Complete profile used in JSON mode
profileUrl	HTTPS URL	none	Full profile URL or merchant origin; bare origins gain /.well-known/ucp
profileType	auto, business, platform	auto	Official schema variant; auto detects endpoint-bearing business profiles
checkRemoteResources	boolean	true	Fetch advertised schema and specification resources
maxRemoteResources	integer	25	Unique advertised resources checked, from 1 to 100
requestTimeoutSecs	integer	10	Per-request timeout, from 3 to 30 seconds

URL example

{
  "sourceType": "url",
  "profileUrl": "https://merchant.example",
  "profileType": "business",
  "checkRemoteResources": true,
  "maxRemoteResources": 25,
  "requestTimeoutSecs": 10
}

The Actor resolves the example source to https://merchant.example/.well-known/ucp.

Inline JSON example

{
  "sourceType": "json",
  "profileType": "business",
  "checkRemoteResources": false,
  "profile": {
    "ucp": {
      "version": "2026-08-25",
      "services": {
        "dev.ucp.shopping": [{
          "version": "2026-08-25",
          "transport": "rest",
          "endpoint": "https://merchant.example/ucp",
          "schema": "https://ucp.dev/2026-08-25/services/shopping/rest.openapi.json"
        }]
      },
      "capabilities": {},
      "payment_handlers": {}
    }
  }
}

Output example

{
  "source": "https://merchant.example/.well-known/ucp",
  "profileType": "business",
  "valid": false,
  "schemaValid": true,
  "remoteChecksPassed": false,
  "protocolVersion": "2026-08-25",
  "schemaUrl": "https://ucp.dev/2026-08-25/schemas/profile.json",
  "summary": "Invalid business profile with 1 error and 0 warnings.",
  "errorCount": 1,
  "warningCount": 0,
  "capabilityCount": 1,
  "serviceCount": 1,
  "paymentHandlerCount": 0,
  "checks": [{
    "code": "REMOTE_RESOURCE_HTTP",
    "severity": "error",
    "path": "/ucp/capabilities/dev.ucp.shopping.checkout/0/schema",
    "message": "Remote schema returned HTTP 404.",
    "url": "https://ucp.dev/example.json",
    "statusCode": 404
  }],
  "validatedAt": "2026-08-30T12:00:00.000Z"
}

The same result is saved as the OUTPUT key-value record. Invalid profiles still produce a report because the findings are the delivered value. Input mistakes, unsafe URLs, fetch failures before a profile exists, and non-object JSON are rejected with an actionable OUTPUT diagnostic and no result event.

Pricing

This Actor uses pay-per-event pricing. These are the current Apify Store event prices:

Event	Price (USD)	When it is charged
apify-default-dataset-item	$0.005	UCP profile validation report — One complete structural, semantic, namespace, and requested remote-resource validation report.
apify-actor-start	$0.00005	Actor Start — Charged when the Actor starts running. Number of events charged depends on Actor memory (one event per GB, minimum one event). — Charged once per run.

Apify platform usage for this Actor run is included alongside the event prices above; no separate per-run platform-usage fee is passed to users.

This covers Apify platform usage for this Actor run. Other Apify products or usage outside this Actor run may still follow your account plan.

Reliability and security boundaries

The official profile schema is selected from ucp.version at https://ucp.dev/{version}/schemas/profile.json, so older published date-versions can be validated against their own contract. Remote fetching uses HTTPS only, rejects credentials, IP literals, single-label hosts, and DNS answers in private/link-local ranges, follows at most four revalidated redirects, limits JSON responses to 2 MB, and bounds every request.

Remote checks inspect declared schema and specification URLs. They do not send commerce operations to service endpoints. Disable remote checks for deterministic structural CI, but namespace authority validation always remains active.

UCP evolves through date-versioned schemas. A profile using an unpublished or unavailable version reports OFFICIAL_SCHEMA_UNAVAILABLE; it is not silently validated against a different version.

Legal and privacy

Validate only profiles and domains you are authorized to inspect. UCP profiles are public discovery documents, but inline input may still contain business configuration. Do not paste private keys, bearer tokens, cookies, personal data, or secrets. The Actor flags private JWK material and does not require authentication credentials.

For protocol details, see the official UCP specification and official UCP schema validator.