What Happens When an AI Agent Visits Your Store

The Whole Flow in Plain English

Merchants hear "AI agents can buy from your store" and the reaction is usually one of two things. Either "that sounds made up" or "okay but how does it actually work." This post is for the second group.

Here is the exact technical flow, step by step, from the moment an agent starts looking for a product to the moment the order is placed. No hand-waving.

Step 1: The Consumer Makes a Request

A person tells their AI assistant something like: "Find me a waterproof hiking backpack under $150 with good reviews. I need it by next Friday."

The agent now has a task: find products matching these criteria, compare options, and facilitate a purchase. It needs to talk to merchants. That is where UCP comes in.

Step 2: The Agent Discovers Merchants

The agent needs to find stores that sell hiking backpacks and support UCP checkout. There are two main discovery paths.

Path A: Directory lookup. The agent queries a UCP directory like UCPList to find merchants in the relevant category. The directory returns a list of UCP-enabled outdoor gear merchants with their endpoint URLs.

Path B: Direct endpoint check. If the agent already knows about specific outdoor retailers, it checks their /.well-known/ucp endpoint directly. This is the UCP equivalent of checking if a website has an RSS feed. It is a standardized URL that either exists or does not.

In practice, agents use both paths. Directories for broad discovery, direct checks for known merchants.

Step 3: The Agent Reads Product Catalogs

For each discovered merchant, the agent sends a GET request to the UCP endpoint. The merchant's server responds with structured JSON containing the product catalog. Here is a simplified example of what that looks like:

{
  "merchant": {
    "name": "TrailGear Co",
    "url": "https://trailgear.co"
  },
  "products": [
    {
      "productId": "bp-waterproof-40l",
      "title": "Summit 40L Waterproof Pack",
      "description": "40-liter waterproof hiking backpack...",
      "price": 129.99,
      "currency": "USD",
      "availability": true,
      "checkoutUrl": "https://trailgear.co/checkout/bp-waterproof-40l",
      "attributes": {
        "waterproof": true,
        "volume": "40L",
        "weight": "2.1 lbs",
        "rating": 4.6,
        "reviewCount": 342
      }
    }
  ]
}

The agent parses this data, filters by the consumer's criteria (waterproof, under $150), and ranks the results. It does this across multiple merchants simultaneously. A typical agent might query 10 to 20 merchants in parallel and have comparison results in under a second.

Step 4: The Agent Presents Options

The agent takes the filtered and ranked results and presents them to the consumer. Something like:

"I found 3 waterproof hiking backpacks under $150. The best rated is the Summit 40L from TrailGear Co at $129.99 with 4.6 stars from 342 reviews. It ships in 2 days. Want me to order it?"

The consumer sees a clean summary. They do not see JSON or API calls. The UCP infrastructure is invisible to them, just like HTTP is invisible to someone browsing a website.

Step 5: The Consumer Confirms

The consumer says "yes, order the TrailGear one." Now the agent needs to initiate the actual purchase.

Step 6: The Agent Initiates Checkout

The agent sends a POST request to the merchant's checkout initiation endpoint (derived from the checkoutUrl in the product data). This request includes:

• The product ID
• Quantity
• Consumer's shipping information (from their saved profile)
• Preferred payment method identifier

The merchant's server validates the request, checks inventory, calculates shipping and tax, and returns a checkout session object:

{
  "sessionId": "cs_abc123",
  "items": [{"productId": "bp-waterproof-40l", "quantity": 1}],
  "subtotal": 129.99,
  "shipping": 7.99,
  "tax": 11.04,
  "total": 149.02,
  "paymentToken": "tok_xyz789",
  "expiresAt": "2026-04-15T15:30:00Z"
}

The payment token is the key piece. It is a one-time token that authorizes the specific transaction amount. The agent never sees credit card numbers or payment credentials.

Step 7: Payment Settlement

The agent passes the payment token to the payment handler (Stripe, Adyen, or whichever processor the merchant uses). The payment handler:

1. Validates the token
2. Confirms the amount matches the authorized transaction
3. Charges the consumer's payment method (which the consumer has on file with the payment handler)
4. Returns a payment confirmation to both the agent and the merchant

This is the token exchange model. The merchant gets paid. The consumer's payment details stay with their payment provider. The agent never handles sensitive financial data.

Step 8: Order Confirmation

The merchant creates the order and returns a confirmation:

{
  "orderId": "ORD-20260415-7823",
  "status": "confirmed",
  "estimatedDelivery": "2026-04-17",
  "trackingUrl": "https://trailgear.co/orders/ORD-20260415-7823/track"
}

The agent relays this to the consumer: "Ordered. Your TrailGear Summit 40L will arrive by April 17. Here is your tracking link."

Done. The entire flow, from the consumer's initial request to order confirmation, typically takes under 30 seconds.

Why This Matters for Merchants

If you are a merchant, the important thing to understand is that your role in this flow is passive. You do not need to build an agent. You do not need to integrate with every AI assistant on the market. You just need to:

1. Expose your product catalog via a UCP endpoint
2. Accept checkout requests in the standard format
3. Return valid responses with payment tokens

Once your UCP endpoint is live, every agent that supports UCP can find you, read your catalog, and send you customers. You get orders through a new channel without building or maintaining the channel yourself.

That is the value proposition. Not "AI is cool." It is: here is a new source of orders that requires a one-time integration and then works automatically with every UCP-compatible agent, forever.

Check if your platform supports UCP in the platform directory. If you are already live, verify your implementation with the validator.