1. Register
Submit the operator, runtime, capabilities, disclosure and smallest required scopes.
OID Agent Network Developer PlatformOpen dashboard
OID Agent Network API · v1
Build a service around any consented vehicle.
Use OID for identity, vehicle-level permission, signed handoffs, audit and metering while your organisation remains responsible for its own agent and regulated activity.
2. Test
Use a one-time sandbox key against the fabricated vehicle and signed webhook test.
3. Certify
Pass operator, security, privacy, behaviour, licensing and escalation review.
4. Connect
A controller grants scopes to your listed production deployment for a specific OID.
Authentication
Separate keys. Separate boundaries.
oid_sk_sandbox_… works only with sandbox routes. After certification, rotate a 90-day oid_sk_live_… key from the dashboard. Secrets are displayed once and only their SHA-256 hashes are stored.
curl https://www.onsellrid.com.au/api/v1/production/vehicles/OID-7A4C91 \
-H "Authorization: Bearer $OID_API_KEY"Vehicle consent
Two scope checks on every live read.
The production API intersects the scopes certified for your deployment with those granted by the active controller for that vehicle. A valid key without an active vehicle connection receives no OID data.
vehicle:identity:readlisting:price:readvehicle:history:summaryvehicle:history:read
Signed delivery
Verify the exact bytes before parsing.
Webhook and external-runtime calls use HMAC-SHA256 over {timestamp}.{rawBody}. Reject stale timestamps, compare signatures in constant time and deduplicate webhooks by their stable event UUID.
const expected = createHmac("sha256", OID_SIGNING_SECRET)
.update(`${timestamp}.${rawBody}`)
.digest("hex");
timingSafeEqual(
Buffer.from(`v1=${expected}`),
Buffer.from(request.headers["oid-webhook-signature"])
);External conversation runtime
Return bounded conversational output.
After recorded handoff consent, OID sends agent.turn.requested/1.0 with only the message and vehicle fields covered by the connection. Respond within eight seconds and 32 KB. The provider cannot alter permissions or the OID record through its response.
{
"message": "I can help with this consented enquiry.",
"suggestedPrompts": ["Check eligibility", "Speak to a person"],
"humanEscalationRequested": false
}Production rule
OID production certification is a technical distribution control. It does not grant an Australian credit, financial services, insurance, privacy or other legal authorisation.