A2A agent

SendSets publishes an A2A v1.0 agent. Another agent discovers it from the Agent Card, then calls the same service-layer tools the MCP server exposes, with the same credentials and the same send policy.

A self-hosted instance serves both on its own API host (API_PUBLIC_URL), so its card always points at its own endpoint.

Authentication

Send a SendSets API key (ssk_...) or an OAuth 2.1 access token as Authorization: Bearer <credential>. The card declares this as its bearer security scheme and never carries a credential. A missing or invalid credential gets 401 with WWW-Authenticate: Bearer. The credential's API permissions decide which tools it may call, tool by tool, exactly as over MCP.

Sending a message

Each SendMessage runs one tool. Put the call in a data part:

curl https://api.sendsetsapi.com/v1/a2a \
  -H "Authorization: Bearer $SENDSETS_API_KEY" \
  -H "Content-Type: application/json" \
  -H "A2A-Version: 1.0" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "SendMessage",
    "params": {
      "message": {
        "messageId": "5f1c2b1e-0000-4000-8000-000000000001",
        "role": "ROLE_USER",
        "parts": [{ "data": { "tool": "list_campaigns", "arguments": {} } }]
      }
    }
  }'

The call runs synchronously and returns a completed task whose artifact holds the tool's result:

{
  "jsonrpc": "2.0",
  "id": 1,
  "result": {
    "task": {
      "id": "…",
      "contextId": "…",
      "status": { "state": "TASK_STATE_COMPLETED", "timestamp": "2026-09-27T12:00:00.000Z" },
      "artifacts": [{
        "artifactId": "…",
        "name": "list_campaigns",
        "parts": [{ "data": { "campaigns": [] }, "mediaType": "application/json" }]
      }],
      "history": [ … ]
    }
  }
}

A text part holding the same JSON object, or a bare tool name such as list_campaigns, works too. Any other text gets back a message (not a task) listing the tools this credential may call, with each tool's description and input schema. The agent does not interpret prose: it runs exactly the tool you name.

A tool that fails returns a task in TASK_STATE_FAILED with the reason in status.message. Set configuration.acceptedOutputModes to ["text/plain"] to receive the result as text instead of a data part.

Skills

The card groups the tools into seven skills. A tool outside this list is refused with -32602, even when the credential could call it over MCP.

Connecting a new mailbox needs its credentials and is not an A2A skill; do it in the dashboard or with the CLI.

Sends and approvals

start_campaign, compose_email and send_reply go through the credential's send policy. The task still completes, and its artifact carries result: executed, awaiting_approval or blocked. For the last two, status.message says so in text, including the approval link, so a client never reads a completed task as mail that went out.

What is not supported

Tasks finish inside SendMessage and are not retained. The endpoint answers:

The card declares streaming, pushNotifications and extendedAgentCard as false. Only A2A 1.0 is served: an A2A-Version other than 1.x, or a 0.3 method name such as message/send, gets -32009. A request without the header is served as 1.0. A credential that lacks a tool's permission gets -32000 with reason PERMISSION_DENIED.

SendMessage accepts Idempotency-Key, which replays the first response for a retried request.