For secure agent communication and the agent economy.
Every API call signed. Every response verified. No insecure mode.
ATTP is a synchronous request-response protocol for AI agents calling web APIs. It runs over HTTP with mandatory cryptographic signing, agent identity passports, trust-gated access control, and tamper-evident audit trails. No insecure mode exists.
HTTP was built for humans (1991). ATTP is built for agents (2026). Secure by default.
HTTP has no built-in agent identity, no message signing, no trust levels, and no audit trail. When AI agents call APIs over HTTP, there is no way to verify who is calling, whether the message was tampered with, or what trust level the caller has. TLS encrypts the transport but does not sign the content.
ATTP runs over HTTP and adds five mandatory security headers to every request. The agent signs every request body with ECDSA P-256. The server verifies the signature, checks the agent's trust level, and signs the response. Both sides have cryptographic proof of what happened.