POST task updates to it as
the task progresses.
The agent card advertises this on its capabilities object:
Registering a target
Four methods manage push configs on a task. All arePOST to the gateway root,
with the method name in the JSON-RPC envelope.
authentication.scheme accepts bearer or basic. Any other scheme is
refused rather than guessed at, so a credential is never sent under a scheme the
gateway did not recognize.
URL rules
The callback URL is validated before anything is sent to it:- HTTPS only.
- No credentials in the URL — no
user:password@userinfo section. - Public hosts only. Private-range and cloud metadata addresses are refused.
What arrives at your endpoint
The gateway sends aPOST whose body is the full task snapshot, wrapped as
an A2A stream response:
GetTask returns for the same task, so an A2A
SDK deserializes a callback body with the same type it uses for a task read.
Your handler does not need a separate parser.
Two headers matter:
Verify the token before acting on a callback. Because the body is a full
snapshot rather than a delta, a handler that processes callbacks out of order
still converges — take the latest snapshot and discard the older one.
Delivery contract
Not every update is equally durable, and the difference is deliberate. Notifications are sorted into two lanes by the task state they carry.
The reasoning is that the notifications you build on are “the task finished” and
“the task needs something from you.” Those get a lane that heavy progress
traffic cannot starve. Progress chatter is useful when it arrives and safe to
lose when the system is busy.
Delivery is best-effort overall, not transactional: a callback endpoint that is
down for the duration of a task’s final notification will miss it even in the
reserved lane. For work where missing a completion is unacceptable, treat push
as the fast path and reconcile with
GetTask on a slower timer.
Choosing between push and streaming
Related
- Tasks —
GetTask,CancelTask,SubscribeToTask - SendStreamingMessage
- A2A Protocol