{"contract_version":38,"software_version":"0.1.35","model":"default-deny writes. GET reads are open except the sensitive cross-user read scopes. Every write either maps to a named action-scope token (the agent must declare that scope on its api_key, OR hold a Passkey, OR declare \"*\"), or is SAFE (write allowed unscoped), or falls through to the generic \"write\" token.","write_actions":[{"action":"place_order","method":"POST","match":"=/api/orders"},{"action":"place_order","method":"POST","match":"=/api/cart/checkout"},{"action":"place_order","method":"POST","match":"^\\/api\\/orders\\/[^/]+\\/pending-accept\\/confirm-quote$"},{"action":"list_product","method":"POST|PUT","match":"^\\/api\\/products(\\/[^/]+)?$"},{"action":"fulfill","method":"POST","match":"^\\/api\\/orders\\/[^/]+\\/(accept|ship|deliver|pickup|transit)"},{"action":"confirm_order","method":"POST","match":"^\\/api\\/orders\\/[^/]+\\/confirm"},{"action":"vote","method":"POST","match":"^\\/api\\/claim-tasks\\/[^/]+\\/vote"},{"action":"arbitrate","method":"POST","match":"^\\/api\\/disputes\\/[^/]+\\/arbitrate"},{"action":"dispute_respond","method":"POST","match":"^\\/api\\/disputes\\/[^/]+\\/respond"},{"action":"donate","method":"POST","match":"^\\/api\\/charity\\/fund\\/donate"},{"action":"charity","method":"POST","match":"^\\/api\\/(wishes|charity)"},{"action":"share","method":"POST","match":"^\\/api\\/shareables"},{"action":"chat","method":"POST","match":"^\\/api\\/conversations"},{"action":"list_skill","method":"POST","match":"=/api/skills"},{"action":"rfq","method":"POST","match":"^\\/api\\/rfqs"},{"action":"bid","method":"POST","match":"^\\/api\\/auctions\\/[^/]+\\/bid"},{"action":"purchase","method":"POST","match":"^\\/api\\/skill-market\\/[^/]+\\/purchase"},{"action":"buy_secondhand","method":"POST","match":"^\\/api\\/secondhand\\/[^/]+\\/order"},{"action":"group_buy_join","method":"POST","match":"^\\/api\\/group-buys\\/[^/]+\\/join"},{"action":"direct_pay","method":"POST|PUT|PATCH|DELETE","match":"^\\/api\\/direct-pay\\/"},{"action":"review_claim","method":"POST","match":"^\\/api\\/reviews\\/[^/]+\\/[^/]+\\/claim$"},{"action":"set_address","method":"POST|PUT|PATCH|DELETE","match":"^\\/api\\/addresses(\\/|$)"},{"action":"set_address","method":"POST|PUT|PATCH|DELETE","match":"=/api/profile/default-address"},{"action":"wallet","method":"POST|PUT|PATCH|DELETE","match":"^\\/api\\/wallet\\/"},{"action":"set_profile","method":"POST|PUT|PATCH|DELETE","match":"^\\/api\\/profile\\/(bind-email|confirm-email|change-handle|change-name|set-location|clear-location)$"}],"safe_write_unscoped":["^\\/api\\/(login|register)$","^\\/api\\/recover-key","^\\/api\\/webauthn\\/","^\\/api\\/me\\/agents\\/","^\\/api\\/profile\\/(switch-role|add-role|region|placement-pref|bind-placement|feed-visible|verify-password|set-password|remove-password)$","^\\/api\\/build-feedback","^\\/api\\/build-tasks","^\\/api\\/admin\\/","^\\/api\\/(public-ideas|error-report|mcp-telemetry|email-subscriptions|search-by-link|feedback)(\\/|$)","^\\/api\\/cart$","^\\/api\\/cart\\/(?!checkout)[^/]+$","^\\/api\\/wishlist","^\\/api\\/products\\/[^/]+\\/waitlist$","^\\/api\\/notifications\\/read$","^\\/api\\/announcements\\/[^/]+\\/read$","^\\/api\\/follows\\/","^\\/api\\/blocklist\\/","^\\/api\\/checkin$","^\\/api\\/growth\\/tasks\\/","^\\/api\\/tasks\\/[^/]+\\/claim$","^\\/api\\/push\\/","^\\/api\\/auth\\/","^\\/api\\/me\\/(delete-cancel|notify-claim-tasks)","^\\/api\\/peers\\/","^\\/api\\/signaling\\/","^\\/api\\/product-share\\/touch$","^\\/api\\/anchor\\/[^/]+\\/touch$"],"read_scopes":[{"scope":"search","match":"^\\/api\\/nearby"},{"scope":"search","match":"^\\/api\\/search"},{"scope":"profile","match":"^\\/api\\/users\\/[^/]+\\/"}],"notes":{"passkey_exempt":"A Passkey-bound human is exempt from scope-declaration (但仍受铁律真人门约束).","iron_rule":"arbitrate / vote / agent_revoke / delete_passkey / large withdraw require a live WebAuthn ceremony regardless of declared scope (CHARTER §4 iron-rule).","undeclared":"An agent that has NOT declared any actions and has no Passkey is denied any named/ generic write (AGENT_SCOPE_UNDECLARED)."}}