# UCP Profile Validator for Agent Commerce (`muhammadafzal/ucp-profile-validator`) Actor

Validate UCP business or platform profiles against official schemas, namespace rules, extension graphs, JWK safety, and remote resources.

- **URL**: https://apify.com/muhammadafzal/ucp-profile-validator.md
- **Developed by:** [Muhammad Afzal](https://apify.com/muhammadafzal) (community)
- **Categories:** Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $5.00 / 1,000 ucp profile validation reports

This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## UCP Profile Validator

Validate a Universal Commerce Protocol (UCP) business or platform profile before AI agents depend on it. The Actor accepts a merchant/profile URL or inline JSON, selects the official schema for the declared UCP date-version, and returns one detailed report.

### What it validates

The Actor checks the complete profile document, not checkout, cart, catalog, or order payloads.

| Output field | Meaning |
|---|---|
| `valid` | No structural, semantic, namespace, or requested remote-resource errors |
| `schemaValid` | Profile matches the official versioned UCP business/platform schema |
| `remoteChecksPassed` | Advertised schema and specification resources were reachable and usable, or `null` when disabled |
| `protocolVersion` | Date-version declared in `ucp.version` |
| `errorCount`, `warningCount` | Blocking and advisory finding totals |
| `capabilityCount`, `serviceCount`, `paymentHandlerCount` | Registry entry totals |
| `checks` | Stable finding codes, severity, JSON path, message, URL, and HTTP status when relevant |

In addition to JSON Schema validation, the report checks:

- UCP namespace authority binding for every advertised `schema` URL;
- HTTPS and user-info safety for machine-fetched resources;
- missing extension parents and self-extension;
- duplicate service transport declarations;
- duplicate payment-handler IDs and JWK `kid` values;
- accidental private JWK members in a public profile;
- remote schema/specification reachability when enabled.

### When to use it

Use this Actor in merchant onboarding, CI release checks, agent-commerce readiness reviews, and monitoring of `/.well-known/ucp`. It is useful to retailers, commerce platforms, payment teams, and developers implementing UCP discovery.

Do not use it to validate checkout/order request or response payloads, execute merchant endpoints, prove domain ownership, verify HTTP message signatures, or perform a security audit. A successful resource fetch proves reachability at validation time, not long-term availability or trust.

### Input

| Field | Type | Default | Description |
|---|---|---|---|
| `sourceType` | `json` or `url` | `json` | Select inline profile JSON or a remote profile |
| `profile` | object | valid fixture | Complete profile used in JSON mode |
| `profileUrl` | HTTPS URL | none | Full profile URL or merchant origin; bare origins gain `/.well-known/ucp` |
| `profileType` | `auto`, `business`, `platform` | `auto` | Official schema variant; auto detects endpoint-bearing business profiles |
| `checkRemoteResources` | boolean | `true` | Fetch advertised schema and specification resources |
| `maxRemoteResources` | integer | `25` | Unique advertised resources checked, from 1 to 100 |
| `requestTimeoutSecs` | integer | `10` | Per-request timeout, from 3 to 30 seconds |

#### URL example

```json
{
  "sourceType": "url",
  "profileUrl": "https://merchant.example",
  "profileType": "business",
  "checkRemoteResources": true,
  "maxRemoteResources": 25,
  "requestTimeoutSecs": 10
}
```

The Actor resolves the example source to `https://merchant.example/.well-known/ucp`.

#### Inline JSON example

```json
{
  "sourceType": "json",
  "profileType": "business",
  "checkRemoteResources": false,
  "profile": {
    "ucp": {
      "version": "2026-08-25",
      "services": {
        "dev.ucp.shopping": [{
          "version": "2026-08-25",
          "transport": "rest",
          "endpoint": "https://merchant.example/ucp",
          "schema": "https://ucp.dev/2026-08-25/services/shopping/rest.openapi.json"
        }]
      },
      "capabilities": {},
      "payment_handlers": {}
    }
  }
}
```

### Output example

```json
{
  "source": "https://merchant.example/.well-known/ucp",
  "profileType": "business",
  "valid": false,
  "schemaValid": true,
  "remoteChecksPassed": false,
  "protocolVersion": "2026-08-25",
  "schemaUrl": "https://ucp.dev/2026-08-25/schemas/profile.json",
  "summary": "Invalid business profile with 1 error and 0 warnings.",
  "errorCount": 1,
  "warningCount": 0,
  "capabilityCount": 1,
  "serviceCount": 1,
  "paymentHandlerCount": 0,
  "checks": [{
    "code": "REMOTE_RESOURCE_HTTP",
    "severity": "error",
    "path": "/ucp/capabilities/dev.ucp.shopping.checkout/0/schema",
    "message": "Remote schema returned HTTP 404.",
    "url": "https://ucp.dev/example.json",
    "statusCode": 404
  }],
  "validatedAt": "2026-08-30T12:00:00.000Z"
}
```

The same result is saved as the `OUTPUT` key-value record. Invalid profiles still produce a report because the findings are the delivered value. Input mistakes, unsafe URLs, fetch failures before a profile exists, and non-object JSON are rejected with an actionable `OUTPUT` diagnostic and no result event.

### Pricing

This Actor uses pay per event.

| Event | Price |
|---|---:|
| Actor start | $0.00005 |
| One UCP profile validation report | $0.005 |

A normal run delivers one report, so its event price is **$0.00505**. The Actor writes the report before the automatic dataset-item event is counted and never manually charges synthetic events. Platform pricing displayed by Apify remains authoritative.

### Reliability and security boundaries

The official profile schema is selected from `ucp.version` at `https://ucp.dev/{version}/schemas/profile.json`, so older published date-versions can be validated against their own contract. Remote fetching uses HTTPS only, rejects credentials, IP literals, single-label hosts, and DNS answers in private/link-local ranges, follows at most four revalidated redirects, limits JSON responses to 2 MB, and bounds every request.

Remote checks inspect declared schema and specification URLs. They do not send commerce operations to service endpoints. Disable remote checks for deterministic structural CI, but namespace authority validation always remains active.

UCP evolves through date-versioned schemas. A profile using an unpublished or unavailable version reports `OFFICIAL_SCHEMA_UNAVAILABLE`; it is not silently validated against a different version.

### Legal and privacy

Validate only profiles and domains you are authorized to inspect. UCP profiles are public discovery documents, but inline input may still contain business configuration. Do not paste private keys, bearer tokens, cookies, personal data, or secrets. The Actor flags private JWK material and does not require authentication credentials.

For protocol details, see the [official UCP specification](https://ucp.dev/) and [official UCP schema validator](https://github.com/Universal-Commerce-Protocol/ucp-schema).

# Actor input Schema

## `sourceType` (type: `string`):

Use this to choose where the profile comes from. Select JSON for an inline profile or URL for a merchant origin/profile URL. Default is JSON; this is not a payload-validation mode.

## `profileUrl` (type: `string`):

Use this when Profile source is URL. Enter an HTTPS profile URL or merchant origin, for example https://merchant.example/.well-known/ucp; a bare origin gets /.well-known/ucp automatically. Private-network and authenticated URLs are rejected.

## `profile` (type: `object`):

Use this when Profile source is Inline JSON. Paste one complete UCP profile object with a top-level ucp member; the default is a valid business-profile fixture, not a checkout or order payload.

## `profileType` (type: `string`):

Use this to select the official schema variant. Auto detects business profiles from service endpoints; choose Business or Platform only when detection is ambiguous. Default is Auto.

## `checkRemoteResources` (type: `boolean`):

Use this to verify advertised schema and specification URLs over HTTPS. Enabled by default; disable for structural-only checks, not to bypass namespace validation.

## `maxRemoteResources` (type: `integer`):

Use this to cap unique advertised schema/spec URLs checked per run. Accepts 1-100; default 25. This does not limit core schema references required for validation.

## `requestTimeoutSecs` (type: `integer`):

Use this to bound each HTTPS fetch. Accepts 3-30 seconds; default 10. This is per resource, not the entire Actor timeout.

## Actor input object example

```json
{
  "sourceType": "json",
  "profileUrl": "https://merchant.example/.well-known/ucp",
  "profile": {
    "ucp": {
      "version": "2026-08-25",
      "services": {
        "dev.ucp.shopping": [
          {
            "version": "2026-08-25",
            "transport": "rest",
            "endpoint": "https://ucp.dev",
            "schema": "https://ucp.dev/2026-08-25/services/shopping/rest.openapi.json"
          }
        ]
      },
      "capabilities": {
        "dev.ucp.shopping.checkout": [
          {
            "version": "2026-08-25",
            "schema": "https://ucp.dev/2026-08-25/schemas/shopping/checkout.json"
          }
        ]
      },
      "payment_handlers": {}
    }
  },
  "profileType": "auto",
  "checkRemoteResources": true,
  "maxRemoteResources": 25,
  "requestTimeoutSecs": 10
}
```

# Actor output Schema

## `reports` (type: `string`):

Schema-validated UCP profile reports in the default dataset.

## `output` (type: `string`):

The report or actionable input rejection diagnostic.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "profileUrl": "https://merchant.example/.well-known/ucp"
};

// Run the Actor and wait for it to finish
const run = await client.actor("muhammadafzal/ucp-profile-validator").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "profileUrl": "https://merchant.example/.well-known/ucp" }

# Run the Actor and wait for it to finish
run = client.actor("muhammadafzal/ucp-profile-validator").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "profileUrl": "https://merchant.example/.well-known/ucp"
}' |
apify call muhammadafzal/ucp-profile-validator --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,muhammadafzal/ucp-profile-validator"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/Tzl9xoQTTIDqxqZEq/builds/ZTncytKvhTwVW7Zem/openapi.json