Tecovas · Agentic Access

Tecovas Agentic Access

x-agentic-access generated

Tecovas exposes 17 API operations that an AI agent could call, of which 9 are state-changing ‘acting’ operations. This is a recommended x-agentic-access execution contract — the scope, audience, consequence tier, short-lived token constraints, and escalation each action should carry before it is handed to an autonomous agent.

By consequence: 8 read, 6 write, and 3 physical.

3 operations are classed safety-critical and should require human-in-the-loop approval at runtime.

Contracts are classified heuristically from the provider’s OpenAPI and refresh on every APIs.io network build; audience is bound per deployment. The model follows Curity’s Access Intelligence (apidays Munich 2026). Browse every provider’s agent contracts at agentic-access.apis.io.

CompanyRetailE-CommerceApparelFootwearDirect to ConsumerShopifyAgentic CommerceUniversal Commerce ProtocolProduct Catalog
Operations: 17 Acting: 9 Human-in-the-loop: 3 Method: generated

By consequence

read 8 write 6 physical 3

Source

Agentic Access

tecovas-agentic-access.yml Raw ↑ 
generated: '2026-08-05'
method: generated
source: mcp/tecovas-ucp-tools-list.json + well-known/tecovas-api-catalog.json + https://checkout.tecovas.com/agents.md
note: >-
  A recommended x-agentic-access execution contract per operation, classified with the standard
  pipeline heuristics (read/connected for GET, acting/write for mutations, consequence raised to
  physical on payment and order operations). This is a governance starting point, not a Tecovas
  claim. It is unusual in one respect: Tecovas already publishes a human-in-the-loop invariant of
  its own — both agents.md documents forbid completing checkout or payment without explicit,
  contemporaneous buyer approval — so the human_in_the_loop values on the checkout tools below
  are the provider's stated policy, not our inference. `audience` is left null to bind per
  deployment.
summary:
  operations: 17
  by_action_class: {connected: 4, read: 4, acting: 9}
  by_consequence: {read: 8, write: 6, physical: 3}
  human_in_the_loop_required: 3
  provider_stated_human_approval: true
  provider_source: https://checkout.tecovas.com/agents.md
operations:
- id: GET /api/productdetail/:slug
  surface: storefront-json
  action_class: connected
  consequence: read
  scope: catalog:read
  token_ttl_max: 3600
  audience: null
  audit: optional
- id: GET /api/collection
  surface: storefront-json
  action_class: connected
  consequence: read
  scope: catalog:read
  token_ttl_max: 3600
  audience: null
  audit: optional
- id: GET /api/collection-products
  surface: storefront-json
  action_class: connected
  consequence: read
  scope: catalog:read
  token_ttl_max: 3600
  audience: null
  audit: optional
  note: 'Rate-limit sensitive — the provider asks agents to cap responses with ?limit=.'
- id: GET /api/search-settings
  surface: storefront-json
  action_class: connected
  consequence: read
  scope: catalog:read
  token_ttl_max: 3600
  audience: null
  audit: optional
- id: search_catalog
  surface: ucp-mcp
  action_class: read
  consequence: read
  scope: catalog:read
  token_ttl_max: 3600
  audience: null
  audit: optional
- id: lookup_catalog
  surface: ucp-mcp
  action_class: read
  consequence: read
  scope: catalog:read
  token_ttl_max: 3600
  audience: null
  audit: optional
- id: get_product
  surface: ucp-mcp
  action_class: read
  consequence: read
  scope: catalog:read
  token_ttl_max: 3600
  audience: null
  audit: optional
- id: get_cart
  surface: ucp-mcp
  action_class: read
  consequence: read
  scope: cart:read
  token_ttl_max: 3600
  audience: null
  audit: optional
- id: create_cart
  surface: ucp-mcp
  action_class: acting
  consequence: write
  scope: cart:write
  token_ttl_max: 900
  audience: null
  audit: required
- id: update_cart
  surface: ucp-mcp
  action_class: acting
  consequence: write
  scope: cart:write
  token_ttl_max: 900
  audience: null
  audit: required
- id: cancel_cart
  surface: ucp-mcp
  action_class: acting
  consequence: write
  scope: cart:write
  token_ttl_max: 900
  audience: null
  audit: required
- id: create_checkout
  surface: ucp-mcp
  action_class: acting
  consequence: write
  scope: checkout:write
  token_ttl_max: 900
  audience: null
  audit: required
- id: get_checkout
  surface: ucp-mcp
  action_class: read
  consequence: read
  scope: checkout:read
  token_ttl_max: 3600
  audience: null
  audit: optional
- id: update_checkout
  surface: ucp-mcp
  action_class: acting
  consequence: physical
  scope: checkout:write
  token_ttl_max: 300
  audience: null
  audit: required
  token_exchange: true
  purpose_required: true
  note: Carries shipping address, delivery method and payment instrument selection.
- id: complete_checkout
  surface: ucp-mcp
  action_class: acting
  consequence: physical
  scope: checkout:complete
  token_ttl_max: 300
  audience: null
  audit: required
  token_exchange: true
  purpose_required: true
  human_in_the_loop: required
  human_in_the_loop_source: https://checkout.tecovas.com/agents.md
  note: >-
    Finalizes payment and places a real order for physical goods. The provider explicitly
    forbids completing this without contemporaneous buyer approval.
- id: cancel_checkout
  surface: ucp-mcp
  action_class: acting
  consequence: physical
  scope: checkout:write
  token_ttl_max: 300
  audience: null
  audit: required
  human_in_the_loop: required
  human_in_the_loop_source: https://checkout.tecovas.com/agents.md
  note: Destructive against a buyer-owned checkout.
- id: get_order
  surface: ucp-mcp
  action_class: read
  consequence: read
  scope: customer-account-api:full
  token_ttl_max: 3600
  audience: null
  audit: required
  note: >-
    Returns buyer PII (addresses, purchase history). Requires an authenticated Shopify customer
    account token; the human_in_the_loop decision belongs to the consent flow, not this call.
prohibited_by_provider:
  source: https://www.tecovas.com/agents.md
  rules:
  - Do not complete checkout, payment or order placement automatically.
  - No scripted form fills or browser automation that finalize payment without explicit human approval.
  - 'Do not access robots.txt-disallowed paths: /account, /admin, /cart, /carts, /checkout, /checkouts/, /orders/*.'
  - Honor Crawl-delay directives and back off on 429.
x-evidence:
  fetched: '2026-08-05'
  probes:
  - {url: 'https://checkout.tecovas.com/api/ucp/mcp', status: 200, note: 'POST tools/list — 13 tools classified'}
  - {url: 'https://checkout.tecovas.com/agents.md', status: 200}
  - {url: 'https://www.tecovas.com/agents.md', status: 200}
  - {url: 'https://www.tecovas.com/.well-known/api-catalog', status: 200}

Work with this as data

Every access contract here is available over the APIs.io API and to AI agents over MCP. Agentic Access is not yet its own endpoint on the v1 API. Reach it through catalog search and the tag graph, or the MCP server.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for agentic access

3 MCP tools reach this
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
Search the catalog 
curl "https://apis.io/api/v1/search?q=tecovas-agentic-access&limit=10"
Everything under a tag 
curl "https://apis.io/api/v1/tags/tecovas-agentic-access"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.