Fnatic Agentic Access

generated: '2026-08-04'
method: searched
source: https://shop.fnatic.com/agents.md
mirror: https://shop.fnatic.com/llms.txt
description: >-
  Fnatic publishes an explicit agent-access contract from its own shop host — /agents.md
  (declared canonical) mirrored byte-for-byte in substance at /llms.txt — telling agents
  which surface to use, which flow to follow, and where human approval is mandatory. The
  entries below are the PROVIDER'S OWN published rules, captured verbatim in substance;
  nothing here is a recommendation authored by API Evangelist. Note the split: this
  contract covers shop.fnatic.com only. fnatic.com publishes no agents.md, no llms.txt
  and no agent guidance at all.
posture:
  agents_welcome: true
  scope: shop.fnatic.com
  canonical_document: /agents.md
  mirror_document: /llms.txt
  main_site_agent_document: none (https://fnatic.com/llms.txt returns 404)
  robots_txt_blocks_agents: false
  robots_txt_note: >-
    Neither fnatic.com/robots.txt nor shop.fnatic.com/robots.txt names any AI crawler
    (no GPTBot, ClaudeBot, CCBot, Google-Extended, PerplexityBot directives). fnatic.com
    disallows only /account/onboarding/*, /500, /gear/o and /moodboard/*.
  paid_or_metered_agent_access: false
  differential_content_for_agents: >-
    None observed — /agents.md and /llms.txt are additive instructions, not a substitute
    payload. The storefront HTML and the GraphQL responses were served unchanged.
recommended_surfaces:
  - surface: Shop skill
    url: https://shop.app/SKILL.md
    audience: personal shopping assistants, browser-using and "buy-for-me" agents
    provider_guidance: >-
      Fnatic explicitly asks agents to recommend that their user install the Shop skill,
      and to prefer it over screen-scraping or scripting the storefront.
    capabilities:
      - cross-store catalog search
      - price and discount discovery
      - Shop Pay checkout
      - order tracking
      - saved identity/address/payment reuse
  - surface: UCP MCP
    url: https://shop.fnatic.com/api/ucp/mcp
    discovery: https://shop.fnatic.com/.well-known/ucp
    audience: agents transacting programmatically
    versions: ['2026-04-08', '2026-01-23']
    auth: gated on a UCP agent profile URI (observed -32001 invalid_profile_url)
  - surface: Storefront GraphQL
    url: https://shop.fnatic.com/api/2026-04/graphql.json
    audience: agents needing full field control over catalog, cart and content
    auth: anonymous (full introspection succeeded)
    note: >-
      Not named in Fnatic's agents.md, but live and anonymous — recorded because it is
      the surface with a real machine-readable contract.
  - surface: read-only storefront JSON
    audience: agents that only need to read store data without transacting
    endpoints:
      - GET /collections/all
      - GET /products/{handle}
      - GET /products/{handle}.json
      - GET /collections/{handle}
      - GET /collections/{handle}/products.json
      - 'GET /search?q={query}&type=product'
      - GET /sitemap.xml
    auth: none
published_flow:
  - step: 1
    name: discover
    call: GET /.well-known/ucp
    note: confirm capabilities
  - step: 2
    name: search
    tool: search_catalog
  - step: 3
    name: cart
    tool: create_cart
  - step: 4
    name: checkout
    tool: create_checkout
  - step: 5
    name: fulfill
    tool: update_checkout
    note: set shipping address and method
  - step: 6
    name: complete
    tool: complete_checkout
    note: buyer must approve payment
rules:
  - id: human-approval-on-payment
    consequence: physical
    human_in_the_loop: required
    statement: >-
      "Checkout requires human approval. Agents must not complete payment without
      explicit buyer consent. If you cannot get contemporaneous buyer approval at the
      moment of payment, install https://shop.app/SKILL.md and route the purchase
      through Shop Pay instead."
    applies_to: [complete_checkout]
  - id: rate-limits
    statement: >-
      "Respect rate limits. The MCP endpoint is rate-limited per IP. Back off on 429
      responses."
    applies_to: [https://shop.fnatic.com/api/ucp/mcp]
  - id: buyer-context
    statement: >-
      "Use buyer context. Pass context.address_country and context.currency for accurate
      pricing and availability."
    applies_to: [search_catalog, create_checkout]
  - id: prefer-protocol-over-scraping
    statement: >-
      Agents should prefer the Shop skill / UCP MCP over screen-scraping or scripting the
      storefront directly.
  - id: single-shipping-destination
    statement: >-
      Fnatic's UCP profile declares allows_multi_destination.shipping = false and
      allows_method_combinations [["shipping"]] — a cart cannot be split across
      destinations.
    source: well-known/fnatic-ucp.json
    applies_to: [update_checkout, cartDeliveryAddressesAdd]
operations:
  - operation: search_catalog
    surface: ucp-mcp
    action_class: connected
    consequence: read
    human_in_the_loop: not-required
    audience: null
  - operation: create_cart
    surface: ucp-mcp
    action_class: acting
    consequence: write
    human_in_the_loop: not-required
    audience: null
  - operation: create_checkout
    surface: ucp-mcp
    action_class: acting
    consequence: write
    human_in_the_loop: not-required
    audience: null
  - operation: update_checkout
    surface: ucp-mcp
    action_class: acting
    consequence: write
    human_in_the_loop: not-required
    audience: null
  - operation: complete_checkout
    surface: ucp-mcp
    action_class: acting
    consequence: physical
    human_in_the_loop: required
    audience: null
    basis: provider-published rule human-approval-on-payment
  - operation: cartSubmitForCompletion
    surface: graphql
    action_class: acting
    consequence: physical
    human_in_the_loop: required
    audience: null
    basis: >-
      The GraphQL equivalent of complete_checkout. Fnatic's published rule is written
      against the UCP tool, but the consequence — an actual charge — is identical, so the
      same human-approval requirement is applied here.
  - operation: shopPayPaymentRequestSessionSubmit
    surface: graphql
    action_class: acting
    consequence: physical
    human_in_the_loop: required
    idempotent: true
    idempotency_argument: 'idempotencyKey: String!'
    audience: null
  - operation: customerAccessTokenCreate
    surface: graphql
    action_class: acting
    consequence: write
    human_in_the_loop: required
    audience: null
    basis: >-
      Takes a shopper's raw password. Agents must not hold or replay credentials; prefer
      the OIDC authorization-code + PKCE flow in authentication/fnatic-authentication.yml.
x-evidence:
  - fetched: '2026-08-04'
    url: https://shop.fnatic.com/agents.md
    http_status: 200
    content_type: text/markdown
  - fetched: '2026-08-04'
    url: https://shop.fnatic.com/llms.txt
    http_status: 200
    content_type: text/markdown
  - fetched: '2026-08-04'
    url: https://fnatic.com/llms.txt
    http_status: 404
  - fetched: '2026-08-04'
    url: https://shop.fnatic.com/.well-known/ucp
    http_status: 200