UCP vs REST: Why AI Agents Need a New Commerce Protocol

The Setup

Every major e-commerce platform has a REST API. Shopify has one. WooCommerce has one. BigCommerce, Magento, Salesforce Commerce Cloud. They all have REST APIs.

So when people ask why AI shopping agents need UCP, the question makes sense. The APIs are already there. Why build a new protocol?

The short answer: REST APIs were built for humans operating software. AI agents are not humans operating software. They are autonomous processes making decisions, and the mismatch between what REST provides and what agents need is significant enough to matter.

What REST Was Built For

REST is a request/response model. A client sends a request, a server responds. That's it.

This works great for:

• A mobile app fetching a user's order history
• A backend service syncing inventory to a fulfillment system
• A developer testing product search via curl

In all of these cases, a human built the integration. They read the documentation. They obtained an API key. They wrote code that handles edge cases. They know what the API does.

REST assumes pre-established trust (API keys, OAuth tokens), human-readable documentation, static integrations that are built once and maintained, and a developer who can interpret errors and fix them.

AI agents don't operate in this model.

What AI Agents Actually Need

When an AI agent is given a task like "buy the cheapest available Patagonia fleece in size medium," it needs to:

1. Discover which merchants sell Patagonia fleeces
2. Determine which of those merchants support agent checkout
3. Query live inventory and pricing across those merchants
4. Compare options and select the best one
5. Complete the transaction using the shopper's pre-authorized payment method
6. Confirm the order and surface a receipt

This sequence has to work across dozens or hundreds of different merchants, none of which the agent has a pre-existing integration with. It has to work at runtime, without a developer in the loop.

REST doesn't support this. Here's why.

The Three Problems REST Can't Solve

Problem 1: Discovery

REST APIs require you to already know they exist. There's no standard way for an AI agent to discover that a merchant has a REST API, let alone figure out what it does, what auth it requires, and how to use it correctly.

You can point an agent at Shopify's developer docs and it can figure out the Shopify API. But there are four million Shopify merchants. Pointing an agent at four million sets of documentation is not a workable discovery mechanism.

UCP solves this with the /.well-known/ucp manifest. Every UCP merchant publishes a machine-readable description of their capabilities at a predictable URL. An agent can discover any UCP merchant with a single HTTP GET. No documentation required. No pre-existing integration required.

Problem 2: Capability Signaling

Knowing a REST API exists doesn't tell you what it can do. An agent can call a product listing endpoint but it doesn't know whether that merchant supports checkout, whether they accept a particular payment method, or whether their inventory data is real-time.

Figuring this out through a REST API requires reading documentation, parsing response schemas, and testing edge cases. Agents can do this with enough time and compute, but it doesn't scale to arbitrary merchants at runtime.

UCP manifests include explicit capability declarations:

{
  "capabilities": ["catalog", "cart", "checkout", "identity"],
  "payment_processors": ["stripe", "shopify_payments"],
  "identity_providers": ["shopify_identity", "google"]
}

An agent reads this in milliseconds and knows exactly what the merchant supports. No inference required.

Problem 3: Auth at Runtime

REST APIs use API keys or OAuth. Getting an API key requires registering a developer account, agreeing to terms, and storing credentials. None of this works for an AI agent trying to buy from a merchant it just discovered.

OAuth is better, but it's designed for user-delegated access with a redirect flow. The user clicking "authorize" doesn't fit an agent session where the user is asleep and the agent is running autonomously.

UCP's payment token exchange solves the payment auth problem. The shopper pre-authorizes a payment token once (through their agent platform), and the token travels with the agent session. The merchant accepts it without needing a direct relationship with the agent platform.

UCP's identity linking handles account auth separately, using a redirect flow that happens once per merchant and is then cached for future sessions.

What UCP Is (and Isn't)

UCP is not a replacement for REST. It's an interoperability layer on top of existing infrastructure.

A Shopify merchant with UCP support is still running Shopify. Their inventory lives in Shopify. Their checkout processes through Shopify Payments or Stripe. UCP adds a discovery endpoint and a standardized protocol for agent interaction.

This is analogous to how HTTP standardized web communication without replacing the content being served. HTTP doesn't tell you what a webpage says. It tells browsers and servers how to exchange it. UCP doesn't replace your commerce stack. It tells agents how to interact with it.

The Composability Advantage

One thing REST APIs don't give you across multiple merchants is composability.

Every REST API has its own authentication model, its own response schema, its own error codes, its own pagination pattern. A developer integrating ten different e-commerce REST APIs writes ten different integration clients.

UCP gives agents a single interaction model that works across all UCP merchants. An agent that can check out on one Shopify store can check out on any Shopify store. An agent that integrates Braintree for payment handling can use that integration everywhere Braintree is accepted.

This composability is what makes agentic commerce at scale possible. Without it, every agent-merchant pair requires a custom integration. With it, the ecosystem grows as a network: each new UCP merchant is immediately accessible to every existing UCP-compatible agent.

When REST Still Wins

REST APIs are still the right choice for:

• Backend-to-backend integrations where you control both sides
• Reporting, analytics, and data sync workflows
• Fulfillment integrations where the integration is built once and maintained
• Any context where a developer can manage the integration lifecycle

UCP is the right choice when the agent needs to operate without a pre-existing integration. At discovery time, at checkout time, against merchants it has never seen before.

The Bottom Line

REST APIs are built for software that knows where it's going. UCP is built for agents that are figuring it out in real time.

The protocol is not a criticism of REST. It's recognition that AI agents are a genuinely different kind of client than what REST was designed to serve.

If you're building an AI shopping agent, you need UCP for the merchant discovery and checkout layer. Your internal architecture can be whatever it needs to be. But the piece that talks to merchants has to be UCP if you want to work across the ecosystem rather than building custom integrations for every store.

You can explore the ecosystem of UCP-ready merchants and tools in the directory.