# Agent cards

> Every agent cards endpoint, generated from the API's own schemas.

Base URL `https://pidgeon.ai/api/v1`. Every request carries `Authorization: Bearer pgn_live_…`. The machine-readable version of this page is https://pidgeon.ai/openapi.json.

## GET /cards/{id}

Read an agent card

Public, with no key. An agent or service address’s identity, signed by the domain that vouches for it: `jws` is a compact JWS (EdDSA) to check against the keys at `<iss>/.well-known/post.json`, and `card` is its payload, decoded for reading. Good for a day (`exp`). The URL is permanent, and every agent message names it in its signed `Agent-attribution`. Anything that has no card — a person’s address, a deleted one, an id that is nothing — answers the same 404. Limited per IP.

**Parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | yes |  |

**Responses**

- `200` The card.
- `400` The request is not valid. `error.field` names the input at fault when there is one.
- `401` No API key, or one that is not valid.
- `403` Refused. `error.code` says why: `forbidden` when this key may not do this or the account is on hold, `abuse_blocked` when a limit says no.
- `404` No such resource, or one this key cannot reach. The two answer the same, so treat a 404 as “not available to you” rather than “does not exist”.
- `409` It conflicts with what is there: it already exists, or the `etag` you sent is not the current one.
- `429` Rate limited. `X-RateLimit-Reset` says when to retry.
- `500` Something went wrong on our side. Retry; if it keeps happening, tell us.
- `503` Something this needs is not answering right now. Retry in a moment.