{
  "name": "XGuard Universal Action Rail",
  "version": 1,
  "category": "universal-action-gateway",
  "description": "Hosted execution rail for public HTTPS API actions, agent tools, webhooks, workflows and application transactions. XGuard meters the guarded execution path rather than limiting itself to payment settlement.",
  "execute": "https://www.xguardgate.com/v1/actions/execute",
  "discovery": {
    "machineReadable": true,
    "localInstallRequired": false,
    "serviceDescription": "https://www.xguardgate.com/.well-known/xguard/actions.json",
    "a2aAgentCard": "https://www.xguardgate.com/.well-known/agent-card.json",
    "mcpEndpoint": "https://www.xguardgate.com/mcp"
  },
  "methods": [
    "GET",
    "HEAD",
    "POST",
    "PUT",
    "PATCH",
    "DELETE"
  ],
  "target": {
    "header": "X-XGuard-Upstream-Url",
    "rule": "Public HTTPS hostname on port 443; private, local, IP-literal and credential-bearing URLs are rejected."
  },
  "authentication": {
    "xguard": "Bearer <XGuard merchant API key>",
    "upstreamCredential": "X-XGuard-Upstream-Key",
    "separation": "XGuard credentials are never forwarded to the arbitrary upstream service."
  },
  "billing": {
    "model": "prepaid-per-successful-upstream-action",
    "kind": "TOOL",
    "quote": "https://www.xguardgate.com/v1/gateway/quote",
    "failedUpstreamExecution": "not earned"
  },
  "capabilities": [
    "execute public HTTPS API calls",
    "preserve idempotency-key forwarding",
    "meter successful execution",
    "release the reserved fee when upstream execution fails",
    "reject redirects and unsafe upstream targets",
    "return XGuard request, latency and accounting metadata"
  ],
  "discoveryTags": [
    "api",
    "automation",
    "agent-tool",
    "webhook",
    "workflow",
    "transaction",
    "integration",
    "booking",
    "order",
    "commerce",
    "crm",
    "messaging",
    "fulfillment",
    "security",
    "x402"
  ],
  "automaticInvocation": {
    "supported": "A compatible agent, gateway or application can select this hosted rail from machine-readable discovery metadata and then invoke it without an XGuard-specific SDK.",
    "boundary": "XGuard does not intercept unrelated websites or devices without authorization. A caller or infrastructure layer must route the action through the hosted endpoint.",
    "localInstallRequired": false
  },
  "related": {
    "universalGateway": "https://www.xguardgate.com/v1/gateway/capabilities",
    "protocols": "https://www.xguardgate.com/.well-known/xguard/protocols.json",
    "mcp": "https://www.xguardgate.com/mcp",
    "a2a": "https://www.xguardgate.com/.well-known/agent-card.json",
    "x402": "https://www.xguardgate.com/.well-known/x402/facilitator.json"
  }
}