citelayer® Pro for WooCommerce — REST Commerce and Product Data

It means the WooCommerce add-on exposes the shipped commerce surface through WordPress REST: product browsing, search, cart validation and totals, signed short-lived Draft Cart resources, buyer-reviewed checkout handoff, signed checkout lifecycle reads or cancel for unpaid pending UCP orders, and signed PII-safe order reads.

The add-on also publishes machine-readable discovery and contracts: capabilities, auth and scopes, coverage, OpenAPI, UCP Business Profile, WebMCP context, and shop llms.txt.

No. The current product claim is Full UCP REST Commerce Support for WooCommerce, not unqualified Full UCP Support. Broader Full UCP Support remains a roadmap scope that depends on additional governance, autonomous payment, post-purchase workflow, and non-REST transport decisions.

Because delegated payment is governance-sensitive. This release does not verify AP2 mandate payloads, signatures, or JWS-bound payment instructions, and it does not complete native payments on behalf of a buyer. Checkout returns a WooCommerce payment_url so the buyer can review the order and complete payment in the store-controlled flow.

Before native autonomous payment can be responsibly advertised, the product needs mandate verification, gateway compatibility, role boundaries, human oversight, and audit trails that fit real merchant operations.

Those actions can change money movement, fulfillment, customer expectations, refunds, inventory, or sensitive order data. The current release supports signed, token-bound, PII-safe reads for UCP-created orders; it does not give agents broad merchant-side order mutation powers.

Post-purchase write workflows need explicit merchant authorization, narrow scopes, auditability, gateway and shipping-provider compatibility, data minimization, and review paths before they should be promoted as agent-facing capabilities.

The advertised UCP transport is REST over HTTPS with JSON payloads, standard HTTP verbs and status codes, OpenAPI schemas, and the UCP auth contract. WebMCP remains a shop and REST-contract discovery context; it is not advertised as an MCP JSON-RPC tools/call transport.

A2A and Embedded Protocol bindings would need their own protocol surfaces, security review, compatibility testing, and governance rules, so this release lists them as evaluated but not advertised.

The add-on is designed around controlled handoff and narrow contracts: buyers review checkout before payment, merchants decide what catalog data is exposed through UCP policy rules, signed endpoints use scoped requests and short-lived tokens, and discovery documents disclose implemented, tested, and not-claimed areas.

This is a practical EU AI Act-aware product governance posture, not legal advice and not a formal compliance certification. Merchants should still evaluate their own obligations, data flows, agent partners, and customer communication.

Treat third-party agents as external integrations. Verify who operates the agent, which scopes it requests, how it stores buyer or order context, how errors are handled, and whether its payment behavior matches your gateway, refund, support, and compliance processes.

Keep buyer confirmation in the loop, test in a controlled environment first, monitor orders and logs, and avoid granting broad mutation or autonomous payment authority until the agent, mandate model, and merchant oversight process are clearly understood. citelayer defines the WooCommerce API surface; it cannot control how third-party agents behave outside your store.