Quickstart

This guide uses the ATAP sandbox to register an agent entity, obtain an OAuth token, and explore the API. No SDK required — just curl.

1. Register an agent

POST/v1/entitiesNone

curl -s -X POST https://api.sandbox.atap.dev/v1/entities \
  -H 'Content-Type: application/json' \
  -d '{
    "type": "agent",
    "name": "my-first-agent"
  }' | jq .

Response:

{
  "id": "01jqxyz...",
  "did": "did:web:sandbox.atap.dev:agent:01jqxyz...",
  "type": "agent",
  "name": "my-first-agent",
  "client_secret": "atap_...",
  "private_key": "base64..."
}

Warning

Save the client_secret and private_key — they are returned only once. The server stores a hash of the secret and discards the private key.

2. Resolve the DID Document

Every entity gets a did:web DID Document at the standard resolution path:

curl -s https://sandbox.atap.dev/agent/01jqxyz.../did.json | jq .

This returns the entity's public key, DIDComm service endpoint, and ATAP type.

3. Get an OAuth token

Use the client credentials grant with DPoP to obtain an access token:

POST/v1/oauth/tokenDPoP

Exchange client_secret for a DPoP-bound access token.

The token is scoped to atap:inbox atap:send atap:revoke atap:manage and is DPoP-bound — every API request must include a DPoP proof JWT.

4. Discover the server

GET/.well-known/atap.jsonNone

Server discovery document.

curl -s https://sandbox.atap.dev/.well-known/atap.json | jq .

This returns the server's API base URL, DIDComm endpoint, supported credential types, and trust configuration.

Next steps

Approvals — Understand two-party and three-party approval flows.
API Reference — Full endpoint documentation.
SDKs — Use the Go, JavaScript, or Python SDK instead of raw HTTP.