For agents · Northlight Flowers (stale skill test)

The showcase task. Ask your agent:“Change Friday’s bouquet to the peonies and add a card.”

Endpoints

Discovery: https://flowers-skills-stale.papsandbox.com/.well-known/poppy.json
Issuer: https://flowers-skills-stale.papsandbox.com
Finding the issuer: https://flowers-skills-stale.papsandbox.com/.well-known/oauth-protected-resource
Protected resource metadata for the domain (3.2, RFC 9728): its one authorization server is the issuer.
Issuer metadata: https://flowers-skills-stale.papsandbox.com/.well-known/oauth-authorization-server
Token: POST https://flowers-skills-stale.papsandbox.com/oauth/token
Sign-in: https://flowers-skills-stale.papsandbox.com/oauth/authorize
Direct Sign-In: authorization code with PKCE (S256), iss in the redirect. Scopes: orders:read orders:write.
Device sign-in: POST https://flowers-skills-stale.papsandbox.com/oauth/device
Device Sign-In (4.3): show the User https://flowers-skills-stale.papsandbox.com/device and the code, then poll the token endpoint. Scopes: orders:read orders:write.
Mediated sign-in: POST https://flowers-skills-stale.papsandbox.com/oauth/token
The Mediated Sign-In extension's grant (https://personalagentprotocol.org/grant/mediated-sign-in) with the test logins below, as form parameters with your client assertion; a one-time code comes back as code_required. Scopes: orders:read orders:write.
Sign-out: POST https://flowers-skills-stale.papsandbox.com/oauth/revoke
Session header: Poppy-Session
On every call to the API, the MCP server, conversations, feedback and the browser-session /authorize: a Session JWT you sign for that request with a delegated key, carrying its delegation (5.2). Signed in, also send your access token.
Browser session: GET https://flowers-skills-stale.papsandbox.com/poppy/browser-session
Section 6: load it in your browser, send the form's code to POST https://flowers-skills-stale.papsandbox.com/poppy/browser-session/authorize with your Session header (and access token, signed in), then submit the form.
Excluded tasks: https://flowers-skills-stale.papsandbox.com/poppy/excluded-tasks.json
Tasks this store doesn't offer to agents, with another way to do them (9.1).
Skills: https://flowers-skills-stale.papsandbox.com/.well-known/agent-skills/index.json
How to do this store's tasks (9.4), also in poppy.json as skill_index. They grant no access and no approval. change-flower-delivery, check-flower-order, find-flowers
API: https://flowers-skills-stale.papsandbox.com/poppy/openapi.json
OpenAPI 3.1. The Session header on every call; account calls also an access token, Bearer, or DPoP-bound when your token request carried a DPoP proof.
Company Agent: https://flowers-skills-stale.papsandbox.com/poppy/conversations
Conversations (section 8): messages, events with wait or server-sent events, Direct Conversations, handoff to a person (you play staff at /staff), sign-in mid-conversation.
Feedback: POST https://flowers-skills-stale.papsandbox.com/poppy/feedback
Tell the store about a task it offers no way to do (9.3), with the Session header, signed in or out.
Extensions: operations v2: a change answers approval_required with the operation; send the same request again with the User's approval in Poppy-Approval (API), _meta (MCP) or extensions.operations (conversations). mediated-sign-in v1.

Tools

Tool	Needs	What it does
`search` GET /poppy/products	Signed out is fine	Search the catalogue by name, category or tag. Prices in cents.
`delivery_dates` GET /poppy/delivery-dates	Signed out is fine	The delivery dates open for the next week or two.
`my_orders` GET /poppy/orders	orders:read	The signed-in customer's open orders.
`change_order` POST /poppy/orders/{order_id}/changes	orders:write	Propose a change to an order: move the delivery, add, swap or remove items. Returns HTTP 403 approval_required with the operation (operations extension v2); send the same request again with the User's approval in Poppy-Approval to make the change.

poppy.json

Open

{
    "protocol_version": "0.3",
    "organization": {
        "name": "Northlight Flowers (stale skill test)",
        "domain": "flowers-skills-stale.papsandbox.com",
        "logo_uri": "https://flowers-skills-stale.papsandbox.com/poppy/logo.svg"
    },
    "auth": {
        "issuer": "https://flowers-skills-stale.papsandbox.com",
        "scopes": {
            "orders:read": "See your orders and their deliveries: what you ordered, the delivery date and the card message. Read only.",
            "orders:write": "Change an order: move its delivery date, or add, swap or remove items and the card. A change can add items and charge the difference, which can't be undone. You still approve each change. Doesn't include reading your orders."
        },
        "scope_hints": {
            "orders:read": {
                "changes": "none",
                "personal_data": true
            },
            "orders:write": {
                "changes": "irreversible",
                "personal_data": true
            }
        }
    },
    "agent": {
        "protocols": [
            {
                "type": "poppy",
                "endpoint": "https://flowers-skills-stale.papsandbox.com/poppy/conversations"
            }
        ]
    },
    "apis": [
        {
            "type": "openapi",
            "url": "https://flowers-skills-stale.papsandbox.com/poppy/openapi.json",
            "description": "Product search, delivery dates, the customer's orders, and changes to a delivery"
        }
    ],
    "web": {
        "browser_session_endpoint": "https://flowers-skills-stale.papsandbox.com/poppy/browser-session"
    },
    "feedback": {
        "endpoint": "https://flowers-skills-stale.papsandbox.com/poppy/feedback"
    },
    "excluded_tasks": {
        "url": "https://flowers-skills-stale.papsandbox.com/poppy/excluded-tasks.json"
    },
    "extensions": {
        "operations": {
            "version": "2"
        },
        "mediated-sign-in": {
            "version": "1",
            "fields": [
                {
                    "name": "email",
                    "label": "Email",
                    "secret": false
                },
                {
                    "name": "password",
                    "label": "Password",
                    "secret": true
                }
            ],
            "scopes": [
                "orders:read",
                "orders:write"
            ]
        }
    },
    "skill_index": {
        "$schema": "https://schemas.agentskills.io/discovery/0.2.0/schema.json",
        "skills": [
            {
                "name": "change-flower-delivery",
                "description": "Change a booked flower delivery at Northlight Flowers for the User. Move it to another date, swap, add or remove bouquets, or add or change the card message. Use when the User asks to change, move or reschedule a flower order or its card.",
                "type": "skill-md",
                "url": "https://flowers-skills-stale.papsandbox.com/.well-known/agent-skills/change-flower-delivery/SKILL.md",
                "digest": "sha256:fd87c0f3adfbb9215a54ec323651550a3add2674de3d65bc82a7554f304788ba"
            },
            {
                "name": "check-flower-order",
                "description": "Read the User's flower orders at Northlight Flowers, with what is in each, the delivery date, the card message and the total, and follow a proposed change to its result. Read only. Use when the User asks what they ordered, when it arrives, or whether a change went through.",
                "type": "skill-md",
                "url": "https://flowers-skills-stale.papsandbox.com/.well-known/agent-skills/check-flower-order/SKILL.md",
                "digest": "sha256:8d526e32f7a550ac0f582bcbedb2e399ff958c70b02afbeb83ffd43605a5251a"
            },
            {
                "name": "find-flowers",
                "description": "Search Northlight Flowers for bouquets, plants and arrangements, with prices and variants, and see which delivery dates are open. No sign-in needed. Use when the User asks what the florist has, what something costs, or when it can deliver.",
                "type": "skill-md",
                "url": "https://flowers-skills-stale.papsandbox.com/.well-known/agent-skills/find-flowers/SKILL.md",
                "digest": "sha256:0a9e3ef7b326edf0b618bb2514799f9dcdeb87d54470fb0b9c087143586e3a62"
            }
        ]
    }
}

Issuer metadata

Open

{
    "issuer": "https://flowers-skills-stale.papsandbox.com",
    "token_endpoint": "https://flowers-skills-stale.papsandbox.com/oauth/token",
    "revocation_endpoint": "https://flowers-skills-stale.papsandbox.com/oauth/revoke",
    "authorization_endpoint": "https://flowers-skills-stale.papsandbox.com/oauth/authorize",
    "device_authorization_endpoint": "https://flowers-skills-stale.papsandbox.com/oauth/device",
    "protected_resources": [
        "https://flowers-skills-stale.papsandbox.com"
    ],
    "response_types_supported": [
        "code"
    ],
    "grant_types_supported": [
        "refresh_token",
        "authorization_code",
        "urn:ietf:params:oauth:grant-type:device_code",
        "https://personalagentprotocol.org/grant/mediated-sign-in"
    ],
    "code_challenge_methods_supported": [
        "S256"
    ],
    "token_endpoint_auth_methods_supported": [
        "private_key_jwt"
    ],
    "token_endpoint_auth_signing_alg_values_supported": [
        "ES256",
        "PS384"
    ],
    "revocation_endpoint_auth_methods_supported": [
        "private_key_jwt"
    ],
    "dpop_signing_alg_values_supported": [
        "ES256"
    ],
    "authorization_response_iss_parameter_supported": true,
    "client_id_metadata_document_supported": true,
    "scopes_supported": [
        "orders:read",
        "orders:write"
    ]
}