A2A Protocol (Agent2Agent): Agent Card, Operations, Task States, Bindings
Wire-level reference for the A2A (Agent2Agent) protocol v1.0: the Agent Card at /.well-known/agent-card.json, the 11 operations, the 8 task states, three protocol bindings, security schemes, version negotiation, and what changed from v0.3.
A2A (Agent2Agent) is an open protocol for communication between opaque agentic applications: agents built on different frameworks discover each other through an Agent Card, exchange messages, and track work as tasks. This entry is the wire-level reference; for the MCP-vs-A2A decision see /resources/mcp-vs-a2a.
Key facts
- Released versions per the project releases page: v1.0.0 (2026-03-12), v1.0.1 (2026-05-28, bug fixes, prefers
application/a2a+jsonin the HTTP binding), earlier v0.3.0 (2025-07-30). - Licence Apache 2.0; an open source project under the Linux Foundation, contributed by Google. SDKs listed in the README: Python, Go, JavaScript, Java, .NET, Rust.
- Discovery: an agent MUST publish an Agent Card at
https://{server_domain}/.well-known/agent-card.json(v0.3.0 renamed this fromagent.json). - Three bindings: JSON-RPC 2.0, gRPC, HTTP+JSON/REST (custom bindings are also allowed).
- Clients send an
A2A-Versionheader (formatMajor.Minor, or the same name as a request parameter); servers answer withVersionNotSupportedErrorfor versions they do not support. Patch numbers are not part of negotiation. An empty header value is interpreted as0.3, so a v1.0 client that sends an empty header gets v0.3 semantics. - The a2a-protocol.org specification page labels 1.0.0 as the latest released version; the GitHub releases page also lists the v1.0.1 patch.
What are the A2A operations?
The specification defines eleven operations: Send Message, Send Streaming Message, Get Task, List Tasks, Cancel Task, Subscribe to Task, Create / Get / List / Delete Push Notification Config, and Get Extended Agent Card. List Tasks (filtering and pagination) arrived with v1.0.0.
| Binding | Spelling (spec main branch, at time of fetch) |
|---|---|
| JSON-RPC | PascalCase: SendMessage, SendStreamingMessage, GetTask, ListTasks, CancelTask, SubscribeToTask, GetExtendedAgentCard |
| HTTP+JSON | POST /message:send, POST /message:stream, GET /tasks/{id}, GET /tasks, POST /tasks/{id}:cancel, POST /tasks/{id}:subscribe, GET /extendedAgentCard |
| gRPC | normative A2AService, Protocol Buffers v3 over HTTP/2 with TLS |
Older docs and posts show message/send and message/stream; those are the v0.3-era JSON-RPC spellings, so check the A2A-Version you target. HTTP+JSON bodies use application/a2a+json.
What are the A2A task states?
Eight TaskState values: TASK_STATE_SUBMITTED, TASK_STATE_WORKING, TASK_STATE_COMPLETED, TASK_STATE_FAILED, TASK_STATE_CANCELED, TASK_STATE_REJECTED, TASK_STATE_INPUT_REQUIRED, TASK_STATE_AUTH_REQUIRED. Terminal: completed, failed, canceled, rejected; Subscribe to Task on a terminal task returns UnsupportedOperationError. The two *_REQUIRED states pause the task for the client. Spelling is American ("canceled") as of v1.0.
What is in an Agent Card?
- Identity:
name,description,provider,version,documentationUrl,iconUrl. supportedInterfaces: which protocol bindings and endpoints the agent serves.capabilities:streaming,pushNotifications,extensions,extendedAgentCard.skills: array describing what the agent can do.securitySchemesplus security requirements: API key, HTTP auth, OAuth 2.0, OpenID Connect, mutual TLS. v1.0.0 modernised OAuth 2.0 flows (device code, PKCE).- Signing: a card MAY be signed with JSON Web Signature (RFC 7515) using RFC 8785 canonicalisation. Signing is optional, so an unsigned card proves nothing about who published it.
- If
extendedAgentCardis true, an authenticated client can fetch fuller details; it SHOULD replace its cached public card.
Messages and parts
A message carries Part objects: text, file, or structured data. In v1.0+ parts are discriminated by member name ({"text": "..."}) instead of an explicit kind field, a breaking change for v0.3 clients.
Security note (inference)
Inference, not spec text: an Agent Card is self-published, so treat its skill descriptions as untrusted input to your model, the same way as MCP tool descriptions (see /resources/mcp-tool-poisoning), and prefer verifying a signed card before delegating.
See also: /resources/mcp-vs-a2a, /resources/agent-delegation-chains, /resources/multi-agent-orchestration-patterns, /resources/agent-identity-authentication, /resources/a2ui-protocol
Verified sources
Fetched directly 2026-10-07 and re-verified 2026-10-09:
- A2A specification (rendered, v1.0): https://a2a-protocol.org/latest/specification/
- A2A specification (docs/specification.md, main branch, which may be ahead of v1.0.1): https://raw.githubusercontent.com/a2aproject/A2A/main/docs/specification.md
- A2A README: https://raw.githubusercontent.com/a2aproject/A2A/main/README.md
- A2A releases (versions and dates): https://github.com/a2aproject/A2A/releases
Re-verified 2026-10-09 against the rendered specification: method names, the eight task states, terminal vs interrupted states, and the A2A-Version rules above match it.
Free to read, always. Want this whole reference corpus inside your own agents? €5 unlocks every premium reference for one agent; €25 licenses the full corpus as RAG / fine-tuning data with an AI-use grant (procurement one-pager: /corpus-license); €150 adds redistribution rights.