Connect a partner agent

A step-by-step guide to A2A from the console — try it with the Veefore sample partner, connect a real partner, send a test call, and call it from code.

A2A (agent-to-agent) lets one of your agents call an agent that someone else runs — a supplier's shipping agent, a partner's booking agent. Veefore sits in the middle: it checks the partner is who it says it is, checks your rules, and records every call.

This guide does everything from the console. You do not need the API or a terminal until you call the partner from your own code.

Words used on this page:

Your agent — the agent in Veefore that makes the calls.
Partner — the other organisation's agent.
Passport — a signed ID card for an agent. Veefore checks the partner's passport against a public key you were given, so a partner cannot just claim to be someone.
Capability — one thing you may ask the partner to do, such as shipment.query.

#Try it with the sample partner

The quickest way to see A2A work. The Veefore sample partner is a practice agent Veefore runs for you: it answers shipment.query, refuses shipment.cancel the way a real partner might, and advertises a "read-only" records.delete that Veefore rates critical. Its passport is checked like any other.

Open the A2A page

Sign in at console.veefore.com and set the Environment switcher at the top to the environment you want — for example Development. Open A2A in the left menu (under Connect) and click Connect a partner.

Choose your agent

If you already have an agent, pick it under Your agent. If it was not set up for A2A, the list says A2A will be switched on — Veefore does that for you.
If you have none, type a name under New agent name (for example Partner caller) and click Create agent. It is selected for you.

Click Next.

Choose the sample partner

Veefore sample partner is selected by default. There is nothing to type. Click Connect. If Veefore asks for your password, enter it — this is a security check before connecting to someone outside your organisation.

Veefore registers the connection, checks the sample partner's passport, and reads what it offers. You see Passport verified.

Choose what it may be asked to do

Veefore lists the partner's capabilities with its own risk rating:

Capability	Rated	Ticked for you
`shipment.query`	Medium	Yes — it only reads
`shipment.cancel`	High	No — it changes things
`records.delete`	Critical	No — it claims to be read-only; Veefore does not believe it

Leave shipment.query ticked and click Enable 1 capability. Veefore creates the capability, gives it to your agent, and sets up the tool your rules check, so a call works straight away.

Send a test call

Click Open the connection. Under Send a test call:

Capability: shipment.query.
Payload: already filled in from the partner's description, for example { "trackingId": "TEST-1" }. Change the id if you like.
Click Send test call.

You see Sent and answered (or Sent (Observe mode) in a new account) with the partner's answer, such as "status": "in_transit" and an eta.

Check it worked

On the connection, Interaction log lists the call.
Open Actions in the left menu: the call is there with your agent, the tool a2a_shipment_query and the decision. Click it to see every check.

See the protection

Try each of these and watch what happens:

A capability you did not enable. Under Capabilities, the partner's shipment.cancel is not enabled, so it is not offered in the test call. Enable it, send a test call with it, and the partner itself refuses: "Cancellations go through support."
Switch a capability off. Click Disable next to shipment.query. It can no longer be called — by the test or by your agent's code.
Block the partner. Click Block this connection at the bottom and give a reason. Every call is refused at once, and the partner is never contacted. Allow again lets it back in.

#Connect a real partner

Click A2A → Connect a partner, choose your agent, then the kind of partner:

The partner also uses Veefore. Ask them to:

Open Agents, then their agent, then the Passport tab.
Click Copy for a partner and send you the text, through a channel you both already trust (not the same place you are about to connect to).

Then, in your Connect a partner:

Choose A partner on Veefore.
Paste their text into Their passport export. Their agent id appears.
Their A2A endpoint URL: the address they give you, starting with https://.
Click Connect, then choose capabilities as above.

For a partner that is not on Veefore.

Choose Any A2A agent.
Their A2A endpoint URL: the address they give you, starting with https://. Click Read their Agent Card — Veefore reads their public description and fills in their agent id and name.
Their public key: ask the partner for it directly. Do not copy it from the same address you are about to trust: whoever controls that address could put any key there.
Their passport: paste it if they gave you one. If not, leave it empty — the connection waits as Pending and you verify it later on the connection page under Verify the remote passport.
Click Connect, then choose capabilities.

Veefore only calls partners on a public https:// address. A private, localhost or plain http:// address is refused.

#Let a partner connect to your agent

To be someone else's partner, send them your agent's passport:

Agents → your agent → Passport tab.
Copy for a partner, and send them the text.

It contains no secret: your agent's id, its signed passport, and the key that verifies it.

#Call the partner from your agent's code

The connection page shows the code under Call it from your agent's code, with your connection id filled in. Your agent needs its private key: either run npx veefore in its project, or create the agent with Agents → Create agent, which shows the four .env.local lines once.

ts
import { VeeforeClient } from '@veefore/sdk';

const client = new VeeforeClient({
  gatewayUrl: process.env.VEEFORE_GATEWAY_URL!,
  agentId: process.env.VEEFORE_AGENT_ID!,
  keyId: process.env.VEEFORE_AGENT_KEY_ID!,
  privateKey: process.env.VEEFORE_AGENT_PRIVATE_KEY!,
});

const decision = await client.a2aInvoke({
  connection: 'a2a_…',
  capability: 'shipment.query',
  action: 'query',
  payload: { trackingId: 'TRK-1' },
});
console.log(decision.result); // the partner's answer

Install it with npm install @veefore/sdk@1.8.0.

python
from veefore import guard_client

decision = guard_client().a2a_invoke(
    connection="a2a_…",
    capability="shipment.query",
    action="query",
    payload={"trackingId": "TRK-1"},
)
print(decision.result)  # the partner's answer

Install it with pip install veefore-py==1.7.0. guard_client() reads .env.local from the current directory upwards.

#Turn on protection

A new account starts every environment in Observe mode: calls run and are recorded, but your rules do not block anything. The connection's own checks — the passport, the enabled capabilities, a block — work in every mode.

To have your rules decide:

Policies → New policy, choose Starter — safe defaults, click Create draft, then Add binding to your workspace and Activate v1.
Admin → Settings → Gateway enforcement, choose Enforce.

With the starter policy, capabilities rated HIGH or CRITICAL wait for a person to approve them under Approvals. You can write your own rules for A2A calls; see A2A.