/.well-known/ucp is now in the IANA registry

On 26 October 2026, ucp was added to IANA's registry of well-known URIs. The path every UCP store already uses for its profile, /.well-known/ucp, is now formally reserved for the Universal Commerce Protocol, next to entries like security.txt, openid-configuration and A2A's agent-card.json.

Nothing changes for a store that already serves a profile. What changes is the standing of the address: no other protocol can register the same suffix, and anyone who wonders whether /.well-known/ucp is a convention or a reserved name can now look it up.

#What is the IANA Well-Known URIs registry?

It is the official list of names that may appear after /.well-known/ on a website. RFC 8615 defines the /.well-known/ prefix as the place for site-wide metadata, so that a client can find a service's description without guessing where a site keeps it. The registry, run by IANA, records each name with a change controller, a specification and a status, so that two protocols don't end up claiming the same path.

The registry holds 107 entries today. Some are decades old (host-meta, webfinger); others are recent and agent-related:

#What the ucp entry says

The registry record for ucp, dated 26 October 2026, lists:

• URI suffix: ucp
• Change controller: Ilya Grigorik
• Specification: the Profile Structure section of the UCP overview
• Status: provisional

The specification it points to says: "Businesses publish their profile at /.well-known/ucp; platforms publish their profile at the URI advertised in UCP-Agent." So the reserved path is the store side. An agent platform's own profile can live at any HTTPS URL it advertises in the UCP-Agent header, which can be /.well-known/ucp on its own domain but doesn't have to be.

#How it got there

Ilya Grigorik (Shopify), one of UCP's maintainers, filed the registration request on 6 June 2026, on behalf of the UCP project. It pointed the registry at UCP's own specification and profile schema, the same documents every store and agent already builds against.

The expert review, led by Mark Nottingham, the author of RFC 8615, accepted the name and the specification as filed. IANA published the entry on 26 October.

It's a quiet step, but an important one. Registering the path is how a protocol becomes part of the web's shared plumbing rather than a convention one company uses. UCP now sits in the same registry as the addresses behind OAuth, OpenID and A2A, and any developer, store or standards body can look it up.

#Provisional, not permanent: what's the difference?

RFC 8615 gives every entry one of two statuses:

• Permanent is the default for values defined by Standards Track RFCs and other open standards. A2A's agent-card.json is permanent; so are the OAuth entries.
• Provisional is for everything else. 39 of the 107 entries are provisional today, including openid-federation; 63 are permanent, and the rest are deprecated or obsoleted.

The difference matters in two directions. The RFC lets the experts remove a provisional entry they find isn't in use, after consulting the community, and lets them move one to permanent, in which case they "should consider how widely used a value is and consult the community beforehand." Use is the test both ways.

On use, there isn't much doubt. In October we read about 4 million ecommerce sites with measurable shopper traffic, well beyond the stores we already check. Over a quarter of them publish a valid UCP profile at /.well-known/ucp: more than a million sites answering at the registered path, most of them put there by their commerce platform. Whether and when UCP asks for permanent status is for the change controller to decide; nothing in the request or the record says it has been asked.

#What it means for stores

For a store, the entry is a reason to treat /.well-known/ucp like /.well-known/security.txt: a public, standard address that should answer every client, not only the agents you've heard of.

• Don't block it. A bot rule or a robots.txt line that keeps agents away from /.well-known/ hides the profile from every agent. A registered path is an easy case to make to whoever owns those rules. A check shows whether the path is open, robots.txt included.
• Serve it directly, with no redirect. The path is resolved against the store's own domain, and UCP's hosting rules are strict about it: profile endpoints must not redirect, and agents must not follow a redirect when they fetch one. A store that forwards its bare domain to www (or the other way) needs /.well-known/ucp to answer on the domain agents ask, not bounce them to another. A check flags a redirect that hides a published profile.
• Keep it JSON. The profile is application/json with a top-level ucp member. Our reference page on /.well-known/ucp covers the fields and the common mistakes, and the UCP Validator checks a live profile against the schema.

#What it means for agent builders

Discovery doesn't change: fetch https://{store}/.well-known/ucp, read ucp.version and supported_versions, pick a version and negotiate. Two things are now easier to say in writing:

• An agent that requests /.well-known/ucp is asking for a registered, documented resource, which helps when a store's security team asks why an agent fetches that path.
• The name is reserved for UCP alone, so a client that finds JSON at /.well-known/ucp can expect it to be a UCP profile.

#What we'll watch

• A pointer from the spec. The overview defines the path but doesn't yet cite the registry entry. A one-line reference next to the path would make the registration visible to implementers.
• Permanent status. If UCP asks, the experts will look at how widely the path is used. That record exists in public crawls.

#FAQ

#Is /.well-known/ucp an official, registered path?

Yes. Since 26 October 2026, ucp is in the IANA Well-Known URIs registry with status provisional, pointing at the Profile Structure section of the UCP specification.

#Does my store need to do anything because of the registration?

No. If your store already serves a valid UCP profile at /.well-known/ucp, nothing changes. If it doesn't, the registration doesn't add any new requirement; it confirms the address agents already use.

#What does "provisional" mean for a well-known URI?

It is the status RFC 8615 gives to values not defined by a Standards Track RFC or another open standard. Experts can move a provisional entry to permanent after considering how widely it is used, or remove one that isn't in use. It doesn't make the path any less usable today.

#Who controls the /.well-known/ucp entry?

The registry lists Ilya Grigorik as change controller. He filed the request on behalf of the UCP project, naming the UCP GitHub organisation.

#Is the agent's profile also at /.well-known/ucp?

Not necessarily. The specification reserves /.well-known/ucp for a business's profile. An agent platform publishes its profile at whatever HTTPS URL it advertises in the UCP-Agent header.

#How is this different from A2A's agent-card.json?

They describe different things. agent-card.json describes an agent and how to talk to it; /.well-known/ucp describes a store's commerce services, capabilities and payment handlers. A2A's entry is permanent; UCP's is provisional.

#About UCP Checker

UCP Checker is the independent validation and observability layer for the Universal Commerce Protocol. We crawl, validate and grade every public UCP manifest we can find, run the merchant directory, the UCP Score, live adoption stats, the vertical guides and the authority-bound vendor map, and track the spec as it evolves so you don't have to — measured from two vantages (what a business declares, and what actually happens when an agent transacts), the same way for everyone, without picking winners.

#Sources

• Well-Known URIs registry, IANA, ucp record dated 26 October 2026
• Registration request #92: /.well-known/ucp, protocol-registries on GitHub, 6 June to 27 October 2026
• RFC 8615: Well-Known Uniform Resource Identifiers, IETF, May 2019, section 3.1
• UCP overview: Profile Structure, UCP specification
• UCP overview: Hosting, UCP specification
• UCP adoption stats: Market read, October 2026, UCP Checker, read 27 October 2026

Related coverage: What is /.well-known/ucp? · UCP v2026-08-25 spec update · How UCP works: a real agent buys flowers · UCP agent profiles and verifiable identity