A2A agents

An A2A v1.0 agent published behind Flexway is called at the gateway's address, in JSON-RPC or HTTP+JSON.

Product side: Agents: MCP and A2A; operations side: A2A agents.

Finding the agent

curl https://api.example.com/agents/support/.well-known/agent-card.json

The card is public, served with an ETag; its supportedInterfaces give the gateway's addresses. It is not signed yet.

Calling

curl -s https://api.example.com/agents/support -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' -H 'A2A-Version: 1.0' \
  -d '{"jsonrpc":"2.0","id":1,"method":"SendMessage","params":{"message":{"role":"ROLE_USER","messageId":"m-1","parts":[{"text":"Where is my order 42?"}]}}}'

Rule	Detail
Identity	Those the card declares (usually an OIDC token); the called agent receives a token exchanged for it, never yours
Quota	Writing (SendMessage...) counts; reading a task (GetTask) is free
Streams	SendStreamingMessage and SubscribeToTask are capped per caller and last at most the operator's limit: follow a longer task with GetTask
Tasks	Bound to your identity by the agent: another caller gets "task not found"
Push notifications	Only toward the https hosts the operator allows