# Second Fold

> A fake second-hand clothing store for testing shopping agents. Every listing is one of a kind and described as data: brand, size, measurements in inches, condition grade, flaws, price. Nothing ships and no money moves.

## Buying over the Universal Commerce Protocol (2026-08-25)

- Business profile: https://ucp-test-merchant.dev.payryla.com/.well-known/ucp
- REST endpoint: https://ucp-test-merchant.dev.payryla.com/ucp/v1
  - POST /catalog/search  {"query": "denim jacket", "filters": {"price": {"max": 6000}}}
  - POST /catalog/lookup  {"ids": ["var_trucker_jacket"]}
  - POST /checkout-sessions  {"line_items": [{"item": {"id": "var_trucker_jacket"}, "quantity": 1}], "buyer": {"email": "..."}, "fulfillment": {"methods": [{"type": "shipping", "destinations": [{"street_address": "...", "address_locality": "...", "address_region": "...", "postal_code": "...", "address_country": "US"}]}]}}
  - PUT /checkout-sessions/{id}, POST /checkout-sessions/{id}/complete, POST /checkout-sessions/{id}/cancel
  - Carts: POST /carts  {"line_items": [{"item": {"id": "var_trucker_jacket"}, "quantity": 1}]}; GET or PUT /carts/{id}; POST /carts/{id}/cancel. POST /checkout-sessions  {"cart_id": "..."} turns a cart into a checkout
- MCP endpoint (streamable HTTP, JSON-RPC): https://ucp-test-merchant.dev.payryla.com/ucp/mcp
  - tools: search_catalog, lookup_catalog, get_product, create_cart, get_cart, update_cart, cancel_cart, create_checkout, get_checkout, update_checkout, complete_checkout, cancel_checkout
- Payment: the only handler is the store's test handler (test_pay); success_token completes, fail_token declines. Any other handler escalates to continue_url. See https://ucp-test-merchant.dev.payryla.com/docs/test-pay
- Discount codes: AGENT10 (10% off for shopping agents), FREESHIP (Free standard shipping)

## Buying in a browser

- Listings: https://ucp-test-merchant.dev.payryla.com/ (each listing page carries schema.org Product JSON-LD)
- Catalog as JSON: https://ucp-test-merchant.dev.payryla.com/listings.json
- "Buy now" on a listing opens a checkout page that asks for no card. continue_url points at the same page.

## Reading back what an agent did

- https://ucp-test-merchant.dev.payryla.com/log shows every request, with credentials removed and personal details masked; https://ucp-test-merchant.dev.payryla.com/log.json is the same as JSON.