{
  "id": "visa-tap.keys.retrieve",
  "protocol": "visa-tap",
  "layer": "identity-trust",
  "role": "merchant",
  "status": "recommended",
  "title": "Retrieve Visa agent public keys",
  "description": "Visa publishes public keys at https://mcp.visa.com/.well-known/jwks, selected by kid or keyid.",
  "goal": "You need the key to verify a signature.",
  "note": "Cache keys and refresh when an unknown keyid appears.",
  "how_to_implement": {
    "steps": [
      "Fetch https://mcp.visa.com/.well-known/jwks.",
      "Select the key by keyid from Signature-Input."
    ]
  },
  "resources": [
    {
      "label": "Visa TAP specifications",
      "url": "https://developer.visa.com/capabilities/trusted-agent-protocol/trusted-agent-protocol-specifications",
      "type": "spec",
      "publisher": "Visa"
    }
  ],
  "audit": {
    "method": "http_get",
    "automatable": true,
    "url_absolute": "https://mcp.visa.com/.well-known/jwks",
    "expect": {
      "status": 200,
      "json_keys": [
        "keys"
      ]
    },
    "human": "GET https://mcp.visa.com/.well-known/jwks returns a JWKS; your verifier uses it."
  },
  "how_to_verify": "GET https://mcp.visa.com/.well-known/jwks returns a JWKS; your verifier uses it.",
  "artifacts": [
    "JWKS"
  ],
  "depends_on": [],
  "status_note": "Cache keys and refresh when an unknown keyid appears.",
  "verified": true,
  "slug": "visa-tap-keys-retrieve",
  "category": "identity-trust",
  "url": "https://vreeman.ai/commerce/checklist#visa-tap.keys.retrieve",
  "updated": "2026-10-12",
  "sources": [
    {
      "label": "Visa TAP specifications",
      "url": "https://developer.visa.com/capabilities/trusted-agent-protocol/trusted-agent-protocol-specifications",
      "type": "spec",
      "publisher": "Visa"
    }
  ],
  "related_slugs": []
}