The x428 Precondition Attestation Protocol — machine-readable precondition attestation for the agentic web. Terms of service. Age requirements. Identity. Built natively on HTTP. A companion to x402.
Agents attest that the operator has acknowledged a specific Terms of Service document, identified by URL and SHA-256 hash. Self-attested or VC-backed. Legally equivalent to clickwrap acceptance.
Servers declare a minimum age threshold. Attestations use threshold claims only — no birthdates, no exact ages transmitted. Tiered from self-attestation to government-issued VC.
Operator identity anchored to a resolvable DID. v0.1 defines self-attestation. VC-backed and government tiers are reserved pending identity provider engagement.
Agents acting on behalf of operators routinely access services with legal prerequisites — terms of service, age gates, identity requirements. No standard mechanism exists. The agent has access, so it acts. There is no record, no attribution, no consent.
x428 defines a minimal challenge-response handshake over HTTP.
The server issues a precondition challenge. The client responds with a
signed AttestationPayload — operator identity via did:web,
cryptographic signature via Ed25519, canonical form via JCS.
Companion to x402
and aligned with DIF TAAG.
A cryptographically attributable record that an operator's agent acknowledged a precondition — signed by the operator's DID, timestamped, bound to a specific resource and challenge nonce. This record is suitable for legal reliance under clickwrap doctrine. It is the agent equivalent of an "I agree" action.
x428 does not verify that an age claim is true. It does not confirm that an identity is real. Self-attestation establishes operator acknowledgment, not verified fact. Relying parties requiring verified identity or age should require VC-backed attestation from a trusted issuer, which x428 also supports. For agent delegation and authorization chains, see MCP-I.