Draft 0.1 · Insurance first

An open protocol for AI agents that sell regulated financial products.

OFAP gives every distributor the same tools for licences, documents, questions, offers and evidence. An agent can then quote, apply for and service a policy the same way with any of them, and each step leaves a record that meets the rules of a sale on the distributor's own site.

Read the spec Watch how it works GitHub

What a server declares

{
  "capabilities": {
    "extensions": {
      "org.openfinancialagent/ofap": {
        "version": "0.1",
        "conformance_level": 4,
        "interfaces": ["tools"],
        "sectors": ["insurance"],
        "lines": ["pet"],
        "countries": ["FR"],
        "can_conclude": false
      }
    }
  }
}

In MCP server/discover, and under the same key in PAP poppy.json. Taken from the worked example.

How it works

One pet insurance sale, from discovery to the evidence record. The OFAP data on screen comes from the worked example in the spec.

01Discovery

02PAP Session

03OFAP tools on MCP

04One quote loop

05Approval through PAP

06Evidence

07Three layers

Agentacting for Camille

Please insure Miso, my European shorthair cat. We live in 69003, France, and I want vet bills covered for under 20 EUR a month.

Example Pets is a broker, registered with ORIAS under 00000000. Read these two documents before you choose.

PDFIPID Example Pets Essentiel2026-09
PDFConditions générales2026-09

Four more questions for the quote: Miso's sex, if Miso is neutered, the date of birth, and any insurance today.

Female, neutered, born 1 April 2023. She stays indoors and has no insurance yet.

Example Mutual insures both offers. Which one do you want?

Essentiel 7014.90 EUR a month70% of vet bills, up to 1500.00 EUR a year
Essentiel 9021.40 EUR a month90% of vet bills, up to 2500.00 EUR a year

The first one, please.

Approved revision 1 of op-51c2

Application received. Finish on Example Pets' site, where you give Miso's microchip number.

Continue on Example Petspets.example.com/a/app-3310

Approval requested

Example Pets

op-51c2 · revision 1

Apply for Essentiel 70 cat insurance for Miso with Example Mutual, 14.90 EUR a month from 1 November 2026. You finish on Example Pets' site.

Premium: 14.90 EUR a month
Insurer: Example Mutual
Starts: 1 November 2026
Withdrawal: 14 days

DeclineApproveApproved

PAP Session · signed out

Agentpets.example.com

PAPGET /.well-known/poppy.json

PAPPOST /oauth/tokengrant_type=jwt-bearer

MCPtools/call get_distributorOFAP toolAuthorization: DPoP eyJhbGciOi…

MCPtools/call get_documentsOFAP tool{ "product_id": "pet-fr-essentiel" }

MCPtools/call get_question_setOFAP tool{ "product_id": "pet-fr-essentiel" }

MCPtools/call quoteOFAP tool5 answers

MCPtools/call quoteOFAP tool10 answers

MCPtools/call submit_applicationOFAP tool{ "offer_id": "of-essentiel-70", … }

PAPPOST /poppy/operations/op-51c2/confirm{ "revision": 1, "approved_by": "user" }

poppy.json · OFAP level 4

Session Token · signed out

Example Pets · broker · ORIAS

2 documents · version and hash

Question set 3 · 11 questions

needs_input4 missing

complete2 offers

proposedoperation op-51c2 · revision 1

succeededevidence ev-90aa

Each call and its result show here.

Responsepoppy.json200 OK

{

"apis": [

{ "type": "mcp", "url": "https://pets.example.com/mcp" }

"extensions": {

"operations": {

"version": "1",

"endpoint": "https://pets.example.com/poppy/operations"

"org.openfinancialagent/ofap": {

"version": "0.1",

"conformance_level": 4,

"sectors": ["insurance"],

"lines": ["pet"],

…

}

…

}

ResponseToken response200 OK

{

"access_token": "eyJhbGciOi…",

"token_type": "DPoP",

"expires_in": 3600,

"scope": "",

"session_id": "ses_2Lm0",

"signed_in": false

}

ResultstructuredContentget_distributor

{

"legal_name": "Example Pets SAS",

"roles": ["broker"],

"licences": [

{

"country": "FR",

"regulator": "ACPR",

"register": "ORIAS",

"identifier": "00000000",

"role": "broker",

"sectors": ["insurance"],

…

}

"complaints_url": "https://pets.example.com/complaints",

…

}

ResultstructuredContentget_documents

{

"documents": [

{

"type": "ipid",

"title": "IPID Example Pets Essentiel",

"version": "2026-09",

"sha256": "fcc6278b…",

"required_before_commitment": true,

…

{ "type": "general_conditions", "version": "2026-09", … }

]

}

ResultstructuredContent.question_setget_question_set

{

"question_set_id": "qs-pet-fr-essentiel",

"version": "3",

"profile": "insurance/pet@0.1",

"answers_schema": {

"properties": {

"species": { "enum": ["dog", "cat"], … },

"date_of_birth": { "format": "date", … },

…

"microchip_number": {

"type": "string",

"x-collected-by": "distributor_page"

}

"required": ["country", "postal_code", "species", "pet_name", "breed", "sex", "is_neutered", "date_of_birth", "currently_insured"]

}

ResultstructuredContentquote

{

"status": "needs_input",

"quote_request_id": "qr-7f3a",

"missing_fields": [

{ "field": "sex", "issue": "missing" },

{ "field": "is_neutered", "issue": "missing" },

{

"field": "date_of_birth",

"issue": "missing",

"message": "An approximate date is fine."

{ "field": "currently_insured", "issue": "missing" }

]

}

ResultstructuredContentquote

{

"status": "complete",

"answers_sha256": "3e9c2ddd…",

"offers": [

{

"offer_id": "of-essentiel-70",

"tier": "Essentiel 70",

"provider": { "name": "Example Mutual", "role": "insurer" },

"pricing": {

"premium": {

"amount": { "amount": "14.90", "currency": "EUR" },

"period": "month",

…

}

…

{ "offer_id": "of-essentiel-90", … }

]

}

ResultstructuredContent.operationsubmit_application

{

"operation_id": "op-51c2",

"revision": 1,

"state": "proposed",

"terms": {

"offer_id": "of-essentiel-70",

"parties": [{ "roles": ["subscriber", "insured", "payer"], … }],

"declaration": {

"answers_sha256": "3e9c2ddd…",

"accuracy_confirmed": true,

…

"needs_assessment": { "kind": "demands_and_needs", … },

"documents_delivered": [{ "document_id": "doc-ipid-pet-fr", … }, { "document_id": "doc-cg-pet-fr", … }],

"withdrawal_period_days": 14,

…

"user_approval_required": true,

…

}

ResponseOperation200 OK

{

"operation_id": "op-51c2",

"revision": 1,

"state": "succeeded",

"confirmation": {

"revision": 1,

"approved_by": "user",

"confirmed_at": "2026-10-20T10:05:12+02:00"

"result": {

"summary": "Application received. Camille finishes on Example Pets' site.",

"data": {

"application_id": "app-3310",

"evidence": { "record_id": "ev-90aa", … },

"handoff_url": "https://pets.example.com/a/app-3310"

}

…

}

Kept by Example Petsresult.data.evidenceEvidenceRecord

{

"record_id": "ev-90aa",

"revision": 1,

"approved_by": "user",

"confirmed_at": "2026-10-20T10:05:12+02:00",

"documents_delivered": [

{ "document_id": "doc-ipid-pet-fr", "sha256": "fcc6278b…" },

{ "document_id": "doc-cg-pet-fr", "sha256": "430aaae4…" }

"question_set": {

"question_set_id": "qs-pet-fr-essentiel",

"version": "3"

"answers_sha256": "3e9c2ddd…",

"needs_assessment": { "kind": "demands_and_needs", … },

"contact_consent": { "channels": ["email"], … },

"terms_sha256": "20d1f657…"

}

Example Pets

pets.example.com

poppy.jsonPAP/.well-known/poppy.json
Token endpointPAP/oauth/token
MCP serverMCP/mcp
- OFAP tools · level 4
- get_distributor
- list_products
- get_documents
- get_question_set
- quote
- submit_application
- get_agreement
- amend_agreement
Operations endpointPAP/poppy/operations

Evidence records

ev-90aa

OFAP

The financial terms

Licences, documents, question sets, offers, the application terms and the evidence record.

get_distributor
get_documents
get_question_set
quote
submit_application
EvidenceRecord

PAP

The Session and the approval

Discovery, the Session Token, and the operation that the customer approves.

poppy.json
Session Token
operation op-51c2
confirm revision 1

MCP

Every call

Each OFAP tool is an MCP tool, and its result sits in structuredContent.

tools/call
structuredContent

Camille asks an AI agent to insure Miso, a cat. Example Pets sells pet insurance.

The agent reads Example Pets' poppy.json. It lists the MCP server, the PAP operations endpoint and the OFAP level.

The agent starts a PAP Session, signed out. Every call after this one carries its Session Token.

Each OFAP step is an MCP tool. get_distributor says who sells, and under which licence.

The documents that the law requires come with a version and a hash. The agent gives them to Camille before any commitment.

The questions come as a JSON Schema. The microchip number is for Example Pets' own page, so it never passes through the agent.

The agent quotes with the five answers it has. The server lists the four that are missing.

One more call with all ten answers. The offers come back priced, with the hash of the answers.

Applying commits nothing. The tool returns a PAP operation, and OFAP defines its terms: parties, declaration, needs and documents.

The agent shows Camille the summary and the key terms in its own interface. The approval covers this exact revision.

The agent confirms revision 1 at the PAP operations endpoint, never through an OFAP tool.

Example Pets keeps an evidence record: the documents delivered, the declaration, the needs, the consent, and the hash of the approved terms.

Camille finishes on Example Pets' site. Miso's microchip number never passes through the agent.

MCP carries the calls. PAP carries the Session and the approval. OFAP defines the financial terms on top of both.

Draft 0.1 covers insurance. Credit and investment can follow as modules, with no change to the core.

Transcript

Camille asks an AI agent to insure Miso, a cat. Example Pets sells pet insurance.
The agent reads Example Pets' poppy.json. It lists the MCP server, the PAP operations endpoint and the OFAP level.
The agent starts a PAP Session, signed out. Every call after this one carries its Session Token.
Each OFAP step is an MCP tool. get_distributor says who sells, and under which licence.
The documents that the law requires come with a version and a hash. The agent gives them to Camille before any commitment.
The questions come as a JSON Schema. The microchip number is for Example Pets' own page, so it never passes through the agent.
The agent quotes with the five answers it has. The server lists the four that are missing.
One more call with all ten answers. The offers come back priced, with the hash of the answers.
Applying commits nothing. The tool returns a PAP operation, and OFAP defines its terms: parties, declaration, needs and documents.
The agent shows Camille the summary and the key terms in its own interface. The approval covers this exact revision.
The agent confirms revision 1 at the PAP operations endpoint, never through an OFAP tool.
Example Pets keeps an evidence record: the documents delivered, the declaration, the needs, the consent, and the hash of the approved terms.
Camille finishes on Example Pets' site. Miso's microchip number never passes through the agent.
MCP carries the calls. PAP carries the Session and the approval. OFAP defines the financial terms on top of both.
Draft 0.1 covers insurance. Credit and investment can follow as modules, with no change to the core.

Three layers, one sale

OFAP defines only what is specific to regulated financial products. The two protocols below it carry the rest.

OFAP

The financial terms: licences, pre-contract documents, question sets, offers, the declaration, the needs assessment and the evidence record. Read the spec

PAP

The customer's session, and every action with a business effect. An OFAP application is a PAP operation that the customer approves. PAP operations

MCP

Every call between the agent and the distributor. Each OFAP primitive is an MCP tool, and its result sits in structuredContent. MCP specification

Four levels of conformance

A distributor declares a level and implements every tool up to it. Level 1 is enough to be found, and level 4 lets an agent service a policy after the sale.

Level 1

Inform

get_distributor
list_products
get_documents

Session: None

Level 2

Quote

get_question_set
quote

Session: None; None, or signed out

Level 3

submit_application
conclude

Session: None, or signed out

Level 4

Service

get_agreement
amend_agreement

Session: Signed in, read scope; Signed in, write scope

Level 3 needs only one of submit_application and conclude. Every tool that commits returns a PAP operation, and the customer approves it there.

Insurance first

Draft 0.1 defines one sector module. The core does not depend on the sector, so credit and investment can follow as modules with no change to it.

Draft 0.1

Insurance

IPID and general conditions before commitment
Demands and needs (IDD Art. 20)
Premium, cover, limits and excess
Line profiles for pet and home

Candidate module

Credit

SECCI and ESIS before commitment
Creditworthiness under the CCD and the MCD
APR and total cost of credit

Candidate module

Investment

KID under PRIIPs
Suitability or appropriateness under MiFID II
Fees and risk indicator

Shape the draft

The draft changes with what implementers learn. Each link opens a GitHub issue form.

Spec feedbackA gap, an ambiguity or a risk in the schema or the rules.
Implementation reportWhat you ran into as an agent or a distributor.
Line profile dataThe questions your tariff asks, so that a profile becomes stable.
Sector module or new topicCredit, investment, or something the draft does not cover.

To report a weakness that could harm a live implementation, use private vulnerability reporting.

An open protocol for AI agents that sell regulated financial products.

Inform

Quote

Subscribe

Service

Insurance

Credit

Investment