Designing PIC-X: Exposing Configuration through .well-known/pic-x-configuration

nicola.gallo@nitroagility.com (Nicola Gallo) — Sat, 01 Aug 2026 11:00:00 +0200

Designing PIC-X. Exposing Configuration through .well-known/pic-x-configuration.

When PIC-X starts, it exposes its public configuration at:

http://127.0.0.1:5556/pic-x/.well-known/pic-x-configuration

The document exposes public PIC-X endpoints and supported protocol capabilities. Internal Exchange Profiles are not exposed.

PIC-X and the PIC Token Service

PIC-X is the overall system.

The PIC Token Service, or PTS, is the PIC-X component that implements the PIC profile of OAuth Token Exchange.

PIC-X
|
+-- PIC Token Service (PTS)
| +-- OAuth Token Exchange endpoint
| +-- PCA initialization and continuity propagation
| +-- Execution contract validation and binding
| +-- Continuity validation and aggregation
| +-- Revocation
| +-- PTS signing keys
| `-- Continuity verification
|
+-- Attestation services
+-- Trusted Anchors
`-- Guardrails and other PIC capabilities

The PIC-X discovery document therefore contains both PTS endpoints and other PIC-X capabilities.

Pts on

Designing PIC-X: Exposing Configuration through .well-known/pic-x-configuration

PIC-X and the PIC Token Service