American Express Agentic Commerce Experiences (ACE) vs Universal Commerce Protocol (UCP)

American Express Agentic Commerce Experiences (ACE) 18

Read for what an outside developer can see. An OpenAPI specification exists for approved developers under a confidentiality agreement, and none is public (0 of 25). No llms.txt or Markdown docs for ACE. The portal's general docs load as Markdown, with nothing on ACE among them (0 of 10). The ACE page and the developer kit overview describe the five services, the human-present and autonomous cases and each party's role, and the post of 13 October 2026 sets out the intent data elements, without guidance on when not to use it (8 of 20). That post's three screenshots of the reference show typed fields with required flags, enums such as PRICE and DATE and conditional requirements, but amounts are strings, items and merchants carry free-form metadata maps, and only part of the intent request is shown (6 of 15). No public request examples or error responses for ACE. The OAuth token endpoint documents its errors (2 of 15). The product record carries a version and the overview a last-updated date of 10 April 2026, with no public changelog for ACE (2 of 15). 18.

Universal Commerce Protocol (UCP) 90

OpenAPI for each REST service, OpenRPC for the MCP and embedded bindings and JSON Schema 2020-12 throughout (25). ucp.dev serves llms.txt, and AGENT_IMPLEMENTER.md guides agents implementing the spec (10). The spec gives MUST and SHOULD rules with rationale for negotiation, signatures and permalinks (17). Typed schemas with required fields, namespaced extension types and version requirements (13). Examples validated in CI and an error code table with continue_url handling (13). Dated versions with release tags and release-note drafts generated from tags; no separate changelog page was read (12). 25 + 10 + 17 + 13 + 13 + 12 = 90.

American Express Agentic Commerce Experiences (ACE) 13

Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20, for what an outside developer can reach. No public SDK, reference server or sample. The portal lists a sandbox host for approved partners, and Amex's post of 22 April 2026 says SDKs, Agent Skills, an MCP server and reference implementations will come later (5 of 30). No registered agent, live ACE transaction or active purchase protection is named in a first-hand source. The portal lists production paths on apigwm.americanexpress.com, and the ACE page says the registered-agent list is coming soon (3 of 25). Three of the five specifications have been available to approved developers since 14 April 2026, two are still under development, and the overview says the materials change without notice (5 of 25). No public test vectors or conformance suite (0 of 20). 13.

Universal Commerce Protocol (UCP) 79

Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79.

American Express Agentic Commerce Experiences (ACE) 9

No dated release, version or changelog entry for ACE after the specifications of 14 April 2026, 185 days before this check. The Intent Intelligence post of 13 October 2026 describes the design without announcing a change. We gave it 5 of 30, a judgement call where the checklist would give 0. No three dated releases in 90 days (0). No public changelog or issue tracker. Support is by an email address and the portal's support form, whose response wasn't tested (4 of 15). No official SDK yet (0 of 15). No package to assess (0 of 10). 9.

Universal Commerce Protocol (UCP) 70

The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70.

American Express Agentic Commerce Experiences (ACE) 22

Protocol reading. Amex describes a small surface (enrolment, intent creation, credential retrieval and lifecycle management) and the portal lists six endpoint paths, but an integrator also needs a CA-issued mTLS certificate, a signed JWT client assertion and five-minute tokens, and can't read the reference without an agreement (10 of 25). No paging or filtering documentation is public (0 of 20). Amex's post says error responses are structured. None are published for ACE, though the OAuth token endpoint documents its errors (4 of 20). Credentials bound to an approved intent, single or multi-use Proof of Intent Tokens, a cap on credentials per intent and short-lived signed artefacts with replay protection make reuse safe by design, but no idempotency key or retry guidance is public (8 of 20). No SDK in any language yet (0 of 15). 22.

Universal Commerce Protocol (UCP) 82

Protocol reading. Capability negotiation means an agent sees only what both sides support, though the schemas are large (18 of 25). Catalogue search pages with a cursor and has_next_page (15 of 20). An error model with codes and continue_url to hand a buyer to the business when the agent can't finish (18). The MCP binding requires an idempotency-key UUID on checkout calls for retry safety (18). Official SDKs in Python and JavaScript; every request needs a UCP-Agent profile (13 of 15). 18 + 15 + 18 + 18 + 13 = 82.

American Express Agentic Commerce Experiences (ACE) 20

Protocol reading. ACE lets a registered agent pay with a scoped card token, including purchases without a person present within an intent approved in advance, on Amex's own card network. It is card-only, needs a Card Member's enrolled card, and has no per-call machine payment and no x402 or MPP (15 of 40). No fee for ACE is published, and any terms sit in the partner agreement (0 of 20). An American Express Developers account costs nothing, but ACE sandbox access needs approval and no free tier is stated (5 of 20). Registration needs an application and a signed agreement, so an agent can't get access on its own (0). 20.

Universal Commerce Protocol (UCP) 50

Protocol reading. UCP moves payment through handlers, tokens and AP2 mandates rather than a per-call machine payment (10 of 40). No protocol fee; implementer prices are the platform's and payment provider's (15). The spec, SDKs and samples are free (20). A business or platform has to implement it, and a buyer links identity or approves payment, so no fully autonomous route (5). 10 + 15 + 20 + 5 = 50.

American Express Agentic Commerce Experiences (ACE) 54

Partner calls use OAuth 2.0 client credentials with a JWT client assertion signed with the client secret, scopes assigned by Amex, five-minute access tokens, ten-minute refresh tokens and a revoke endpoint, over mutual TLS with a CA-issued certificate valid for at most two years. Payment credentials are tokenised, scoped for limited use and issued only against an approved intent. The Card Member's revocation of intents is described in the future tense (24 of 30). Passkey sign-off on each intent, an issuer risk check before a credential is issued with an optional final confirmation, spend controls, and portal roles that keep developers to sandbox access (14 of 20). ACE returns credentials and intent records rather than untrusted content, and Amex's post says no request is accepted on client-provided data alone. No prompt-injection guidance for the agent side (10 of 15). Card Members are to see intents linked to transactions in the American Express app, requests carry X-CorrelationID, and intents are kept as signed evidence for disputes. No operator log for partners is described (6 of 15). www.americanexpress.com/.well-known/security.txt redirects to an error page, and no vulnerability disclosure policy, bug bounty or certification for the developer APIs was found in the pages read (0 of 20). 54.

Universal Commerce Protocol (UCP) 67

OAuth 2.0 identity linking, RFC 9421 signatures for signed agents with key IDs bound to JWK thumbprints, and payment handlers with token exchange instead of raw card data (25 of 30). Checkout can hand back to the buyer through continue_url or an embedded checkout, and AP2 mandates record consent, but unattended completion is allowed by design (15 of 20). The permalink spec treats URL inputs as untrusted and requires server-side validation, but we found no guidance on product text reaching an agent (5 of 15). Order events go to business webhooks; we didn't read whether they are signed (8 of 15). SECURITY.md routes reports to Google's intake with a stated response time and GitHub advisories (14 of 20). 25 + 15 + 5 + 8 + 14 = 67.