GoDaddy ANS (Agent Name Service)

import asyncio
import os
from dynamic_wallet_sdk import DynamicEvmWalletClient, ThresholdSignatureScheme

async def create_agent_wallet():
    async with DynamicEvmWalletClient(os.environ["DYNAMIC_ENVIRONMENT_ID"]) as client:
        await client.authenticate_api_token(os.environ["DYNAMIC_AUTH_TOKEN"])

        wallet = await client.create_wallet_account(
            threshold_signature_scheme=ThresholdSignatureScheme.TWO_OF_TWO,
            password=os.environ["WALLET_PASSWORD"],
        )
        print(f"Agent wallet: {wallet.account_address} (id: {wallet.wallet_id})")
        return wallet

asyncio.run(create_agent_wallet())

use dynamic_waas_sdk::{
    DynamicWalletClient, DynamicWalletClientOpts, ThresholdSignatureScheme,
};
use dynamic_waas_sdk_evm::DynamicEvmWalletClient;

#[tokio::main]
async fn main() -> dynamic_waas_sdk::Result<()> {
    let mut client = DynamicWalletClient::new(
        DynamicWalletClientOpts::new(&std::env::var("DYNAMIC_ENVIRONMENT_ID").unwrap()),
    )?;
    client
        .authenticate_api_token(&std::env::var("DYNAMIC_AUTH_TOKEN").unwrap())
        .await?;

    let evm = DynamicEvmWalletClient::new(&client);
    let (wallet_properties, external_server_key_shares) = evm
        .create_wallet_account(
            ThresholdSignatureScheme::TwoOfTwo,
            Some(std::env::var("WALLET_PASSWORD").unwrap()),
            /* back_up_to_dynamic */ true,
        )
        .await?;

    println!("Agent wallet: {}", wallet_properties.account_address);
    Ok(())
}

from cryptography import x509
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.x509.oid import NameOID

ans_name = "ans://v1.0.0.my-agent.example.com"
host = "my-agent.example.com"

def make_csr(common_name: str, san: x509.GeneralName):
    key = ec.generate_private_key(ec.SECP256R1())
    csr = (
        x509.CertificateSigningRequestBuilder()
        .subject_name(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, common_name)]))
        .add_extension(x509.SubjectAlternativeName([san]), critical=False)
        .sign(key, hashes.SHA256())
    )
    pem = csr.public_bytes(serialization.Encoding.PEM).decode()
    return pem, key

# Identity CSR: URI SAN must equal the ans:// name.
identity_csr, identity_key = make_csr(ans_name, x509.UniformResourceIdentifier(ans_name))
# Server CSR: DNS SAN = the agent host.
server_csr, server_key = make_csr(host, x509.DNSName(host))

use rcgen::{CertificateParams, DnType, KeyPair, SanType, PKCS_ECDSA_P256_SHA256};

let ans_name = "ans://v1.0.0.my-agent.example.com";
let host = "my-agent.example.com";

fn make_csr(common_name: &str, san: SanType) -> rcgen::Result<(String, KeyPair)> {
    let key_pair = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256)?;
    let mut params = CertificateParams::new(vec![])?;
    params.distinguished_name.push(DnType::CommonName, common_name);
    params.subject_alt_names = vec![san];
    let csr_pem = params.serialize_request(&key_pair)?.pem()?;
    Ok((csr_pem, key_pair))
}

// Identity CSR: URI SAN must equal the ans:// name.
let (identity_csr, identity_key) = make_csr(ans_name, SanType::URI(ans_name.try_into()?))?;
// Server CSR: DNS SAN = the agent host.
let (server_csr, server_key) = make_csr(host, SanType::DnsName(host.try_into()?))?;

import os
import httpx

base = os.environ["ANS_API_BASE"]  # ends in /v2
headers = {"Authorization": f"Bearer {os.environ['ANS_API_TOKEN']}"}

async with httpx.AsyncClient(headers=headers) as http:
    # 1. Register (async — returns 202 PENDING_VALIDATION)
    reg = await http.post(f"{base}/ans/agents", json={
        "agentDisplayName": "my-agent",
        "agentDescription": "Pays for data feeds via x402.",
        "version": "1.0.0",
        "agentHost": host,
        "endpoints": [{
            "agentUrl": f"https://{host}/mcp",
            "protocol": "MCP",            # A2A | MCP | HTTP-API
            "transports": ["SSE"],
            "metaDataUrl": meta_data_url, # the agent card from Step 2
            "metaDataHash": meta_data_hash,
        }],
        "identityCsrPEM": identity_csr,
        "serverCsrPEM": server_csr,       # or BYOC: serverCertificatePEM + chain
    })
    reg.raise_for_status()
    agent = reg.json()
    agent_id = agent["agentId"]
    print("Registered:", agent["ansName"], agent["status"])  # PENDING_VALIDATION

    # 2. verify-acme → issues certs → PENDING_DNS, then 3. verify-dns → ACTIVE
    await http.post(f"{base}/ans/agents/{agent_id}/verify-acme")
    await http.post(f"{base}/ans/agents/{agent_id}/verify-dns")

    detail = (await http.get(f"{base}/ans/agents/{agent_id}")).json()
    print("Status:", detail["agentStatus"])  # ACTIVE

use reqwest::Client;
use serde_json::json;

let base = std::env::var("ANS_API_BASE")?; // ends in /v2
let token = std::env::var("ANS_API_TOKEN")?;
let http = Client::new();

// 1. Register (async — returns 202 PENDING_VALIDATION)
let reg: serde_json::Value = http
    .post(format!("{base}/ans/agents"))
    .bearer_auth(&token)
    .json(&json!({
        "agentDisplayName": "my-agent",
        "agentDescription": "Pays for data feeds via x402.",
        "version": "1.0.0",
        "agentHost": host,
        "endpoints": [{
            "agentUrl": format!("https://{host}/mcp"),
            "protocol": "MCP",                // A2A | MCP | HTTP-API
            "transports": ["SSE"],
            "metaDataUrl": meta_data_url,     // the agent card from Step 2
            "metaDataHash": meta_data_hash,
        }],
        "identityCsrPEM": identity_csr,
        "serverCsrPEM": server_csr,           // or BYOC: serverCertificatePEM + chain
    }))
    .send().await?.error_for_status()?.json().await?;
let agent_id = reg["agentId"].as_str().unwrap().to_string();
println!("Registered: {} {}", reg["ansName"], reg["status"]); // PENDING_VALIDATION

// 2. verify-acme → issues certs → PENDING_DNS, then 3. verify-dns → ACTIVE
for step in ["verify-acme", "verify-dns"] {
    http.post(format!("{base}/ans/agents/{agent_id}/{step}"))
        .bearer_auth(&token).send().await?.error_for_status()?;
}

import hashlib
import json
import re

tl = os.environ["ANS_TL_BASE"]
counterparty = "ans://v1.0.0.vendor.example.com"
host = re.sub(r"^ans://v[0-9.]+\.", "", counterparty)  # vendor.example.com
agent_id = await resolve_agent_id(counterparty)         # via ANS DNS discovery

async with httpx.AsyncClient() as http:
    # Badge: current status + the metaDataHash the log sealed per protocol.
    badge = (await http.get(f"{tl}/v1/agents/{agent_id}")).json()
    assert badge["status"] == "ACTIVE", f"agent is {badge['status']}"
    attested = badge["payload"]["producer"]["event"]["attestations"]["metadataHashes"]

    # SCITT COSE_Sign1 receipt — CBOR tag 18, so the first byte is 0xd2.
    receipt = (await http.get(f"{tl}/v1/agents/{agent_id}/receipt")).content
    assert receipt[:1] == b"\xd2", "not a COSE_Sign1 receipt"

    root_keys = (await http.get(f"{tl}/root-keys")).text
    await verify_receipt(receipt, root_keys)  # your verifier

    # Pin the card to the log: recompute its hash over the exact served
    # bytes and compare to the attested value BEFORE trusting the wallet.
    card_bytes = (await http.get(f"https://{host}/.well-known/agent-card.json")).content
    card_hash = "SHA256:" + hashlib.sha256(card_bytes).hexdigest()
    assert card_hash == attested["MCP"], "agent card does not match the log-attested hash"
    card = json.loads(card_bytes)

print("Verified payee wallet:", card["wallet"]["address"])  # provably bound to the identity

use sha2::{Digest, Sha256};

let tl = std::env::var("ANS_TL_BASE")?;
let agent_id = resolve_agent_id("ans://v1.0.0.vendor.example.com").await?; // ANS DNS discovery
let host = "vendor.example.com";

// Badge: current status + the metaDataHash the log sealed per protocol.
let badge: serde_json::Value = http.get(format!("{tl}/v1/agents/{agent_id}"))
    .send().await?.error_for_status()?.json().await?;
assert_eq!(badge["status"], "ACTIVE");
let attested = &badge["payload"]["producer"]["event"]["attestations"]["metadataHashes"]["MCP"];

// SCITT COSE_Sign1 receipt — CBOR tag 18, so the first byte is 0xd2.
let receipt = http.get(format!("{tl}/v1/agents/{agent_id}/receipt"))
    .send().await?.error_for_status()?.bytes().await?;
assert_eq!(receipt.first(), Some(&0xd2), "not a COSE_Sign1 receipt");

let root_keys = http.get(format!("{tl}/root-keys"))
    .send().await?.error_for_status()?.text().await?;
verify_receipt(&receipt, &root_keys).await?; // ans-sdk-rust verifier

// Pin the card to the log: recompute its hash over the exact served
// bytes and compare to the attested value BEFORE trusting the wallet.
let card_bytes = http.get(format!("https://{host}/.well-known/agent-card.json"))
    .send().await?.error_for_status()?.bytes().await?;
let card_hash = format!("SHA256:{:x}", Sha256::digest(&card_bytes));
assert_eq!(serde_json::Value::String(card_hash), *attested, "card hash != attested hash");

let card: serde_json::Value = serde_json::from_slice(&card_bytes)?;
println!("Verified payee wallet: {}", card["wallet"]["address"]); // provably bound

async with httpx.AsyncClient(headers=headers) as http:
    await http.post(
        f"{base}/ans/agents/{agent_id}/revoke",
        json={"reason": "KEY_COMPROMISE", "comments": "key rotation"},
    )

http.post(format!("{base}/ans/agents/{agent_id}/revoke"))
    .bearer_auth(&token)
    .json(&json!({ "reason": "KEY_COMPROMISE", "comments": "key rotation" }))
    .send().await?.error_for_status()?;