Fetch external agent card
Proxy-fetch an external agent card from a URL, avoiding CORS issues. The URL is validated against SSRF attacks. With transport: "device", the card is fetched through the paired local listener deviceId, so the URL must be a loopback address on that machine. Pass bearerToken when the card itself requires one.
Authentication
AuthorizationBearer
API key or Clerk session token
Request
This endpoint expects an object.
url
bearerToken
Sent as Authorization: Bearer on the card request. Never stored or echoed.
deviceId
The paired listener to fetch through. Required when transport is "device".
transport
How to reach the card: directly (default) or through a paired local listener
Allowed values:
Response
Agent card JSON
authentication
capabilities
description
iconUrl
name
protocolVersion
provider
skills
url
version
Errors
400
Bad Request Error
401
Unauthorized Error
500
Internal Server Error
502
Bad Gateway Error