API Index (APIX): A Global Discovery Infrastructure for Autonomous Agent Services

Introduction This document is superseded. The APIX specification originally developed in the draft-rehfeld-bot-service-index series has been restructured into three separate Internet-Drafts to improve implementor focus and allow each profile to evolve independently. The three successor documents are:

(draft-rehfeld-apix-core-00) Defines the core APIX infrastructure: the organisation and service trust model (O-0–O-5 and S-0–S-4), the APIX Manifest (APM) base fields, the Index API, the HATEOAS navigation model, the Spider verification framework, and the operator governance and security obligations.
(draft-rehfeld-apix-services-00) Defines the APM extension fields for web API and bot service registration, notification channel types, GraphQL introspection behaviour, capability taxonomy governance, accredited verifier requirements, and the free registration tier.
(draft-rehfeld-apix-iot-00) Defines the APM extension fields for IoT device class and device instance registration, the presence signalling protocol, the fleet circuit breaker, the Law Enforcement Request (LER) interface, and the agent delegation model.

All normative content from draft-rehfeld-bot-service-index-07 has been transferred to those three documents. This revision adds no new normative requirements.

Trust Model Updates Two changes to the trust model have been made in the successor drafts that differ from draft-rehfeld-bot-service-index-07:

O-3 Renamed to "Hygiene Verified" Organisation trust level O-3 was previously described as "Basic Compliance Verified". In the successor drafts, O-3 is designated "Hygiene Verified" to better reflect its character: automated checks (domain ownership confirmed, basic sanctions screening passed, service liveness verified) without human review or audit. This is a label change only; the verification requirements at O-3 are unchanged.

O-5 Reachable Without O-4 Prerequisite In draft-rehfeld-bot-service-index-07, reaching trust level O-5 (Audited) required prior attainment of O-4 (Accredited Verifier Assessment). In the successor drafts, this prerequisite is removed. An organisation may proceed directly from O-3 to O-5 by engaging an Accredited Verifier and meeting the O-5 criteria, without first completing a separate O-4 assessment. The substantive requirements for O-5 are unchanged; only the path constraint is lifted.

Security Considerations This document is a supersession notice only. It introduces no protocol mechanisms, no new data formats, and no operational requirements. All security considerations applicable to the APIX specification are addressed in the successor documents: Section 12, , and Section 9.

IANA Considerations This document has no IANA actions.