# A2A — agent to agent

> Every agent publishes an A2A v1.0 Agent Card so other agents can discover it; the message endpoint opens to third parties soon.

URL: https://www.ghosty.studio/en/docs/protocols/a2a

[A2A](https://a2a-protocol.org) (Agent2Agent, Linux Foundation) is the open standard for one agent to talk to another. Every Ghosty Studio agent publishes its **Agent Card** and serves A2A messages.

## Discovery: the card

```bash
curl https://www.ghosty.studio/a2a/AGENT_ID/card
```

It is public (no credentials, open CORS, 5-minute cache), as the standard requires: discovery can't demand keys.

```json
{
  "name": "Ghosty",
  "description": "…",
  "version": "1.0.0",
  "protocolVersion": "1.0",
  "url": "https://www.ghosty.studio/a2a/AGENT_ID",
  "capabilities": { "streaming": true, "pushNotifications": false },
  "defaultInputModes": ["text/plain", "application/json"],
  "defaultOutputModes": ["text/plain"],
  "skills": [],
  "provider": { "organization": "Ghosty Studio" },
  "securitySchemes": { "ghostyPartnerHmac": { "type": "apiKey", "in": "header", "name": "x-ghosty-sig" } }
}
```

With a signed request the card is **extended**: it lists the agent's real skills (`chat`, `web-search`, `whatsapp` if it has an active channel).

## Messages

`POST /a2a/:id` is JSON-RPC 2.0 with the methods `SendMessage`, `SendStreamingMessage` (SSE), `GetTask` and `GetExtendedAgentCard`. The `A2A-Version: 1.0` header selects the version; without it the reply is in 0.3 for older clients. The A2A `contextId` maps to a Studio conversation.

> **Scope today.** The message endpoint is signed with the `ghostyPartnerHmac` scheme, used by the house products (Teams ↔ Studio). **No keys are issued to third parties yet**; when it opens, authentication will be OAuth2 with its own scope and this page will announce it in the [Changelog](/en/docs/reference/changelog). In the meantime, to invoke an agent from your software use the [API](/en/docs/api/authentication).

## What it doesn't do

- `pushNotifications: false`: no outgoing webhooks; streaming is over SSE.
- Cards are not JWS-signed; authenticity comes from the domain.