Vacation Rental Protocol (VRP)

Public draft v0.1 · updated 2026-06-24

Vacation Rental Protocol

An open protocol for host-domain signed vacation rental offers.

VRP lets agents verify that a stay offer came from the host-owned<br>domain, includes fresh availability, exact pricing, and a direct<br>booking URL before quoting it.

No central issuer. No trusted issuer registry. No accreditation<br>gatekeeper. Verifiers choose their own trust policy.

What VRP Is

An open protocol for vacation rental offer verification.

A host-owned domain model for source identity.

Signed verified stay offers for machine validation.

Ed25519 JWKS for key discovery and signature checks.

Safe-to-quote guardrails for agent behavior.

What VRP Is Not

Not a marketplace.

Not an OTA.

Not a central issuer.

Not a central registry.

Not an accreditation program.

Not a ranking engine.

Not a booking intermediary or trust authority.

Machine-Readable Artifacts

StayIntent open discovery v0.1<br>/spec/stayintent-discovery-v0.1

Transparency Log v0.1<br>/spec/transparency-log-v0.1

Attestation Status (W3C Bitstring) v0.1<br>/spec/attestation-status-bitstring-v0.1

JSON-LD context<br>https://vacationrentalprotocol.com/contexts/v1

Attestations JSON Schema<br>/schemas/attestations-v0.1.schema.json

Portable Attestations v0.1<br>/spec/attestations-v0.1.md

Interop and trust positioning<br>/docs/interop-and-trust-positioning.md

Example attestation bundle<br>/examples/attestations/attestation-bundle.v0.1.json

Offer Verification

Fetch the host discovery document.

Resolve the host-domain JWKS.

Verify the compact JWS over the signed offer.

Check freshness, exact price, availability, and direct booking URL.

Portable Attestations

Portable attestations use W3C Verifiable Credentials Data Model<br>2.0 and VC JOSE/COSE compact JWS to carry privacy-minimized trust<br>history without making HemmaBo, or any other operator, the<br>authority over truth.

Interop, Not Replacement

VRP is the host-domain offer verification layer. It can compose with<br>UCP for checkout and order lifecycle, including lodging flows as the<br>UCP lodging profile matures, AP2 for payment mandates, MCP for future<br>tool exposure, and A2A for future agent-to-agent bindings. VRP v0.1<br>defines documents and verification rules, not runtime tools.

Self-issued host-domain attestations cover facts controlled by the<br>host domain. Guest identity, right-to-let, local license status,<br>insurance, and legal compliance require independent evidence and are<br>future optional credential profiles, not HemmaBo certification.

Read the interop and trust positioning note

Reference Implementation (live)

Reference implementation proof page<br>· Proof node:<br>villaakerlyckan.se<br>· Runtime:<br>HemmaBo

Host discovery<br>villaakerlyckan.se/.well-known/vacation-rental.json

Signed verified stay offer<br>/api/verified-stay-offer

First-mover evidence memo<br>/docs/first-mover-evidence-memo.md

Repository

The public draft source is maintained at<br>HemmaBo-se/vrp-spec.<br>HemmaBo is a reference implementation and standards contributor, not<br>a central issuer, registry, scorer, OTA, marketplace, booking<br>intermediary, or trust authority.

Conformance & Transparency

The draft ships signed, runnable conformance vectors so anyone can<br>test a verifier independently — positive and negative cases for<br>the receipt envelope: offer + transport verified, partial /<br>unverifiable payment, tampered signature, expired window, unsupported<br>version, and malformed input.

Receipt conformance vectors (positive & negative)

Signed verified-stay-offer &middot; JWKS

JSON Schemas (offer, attestations, discovery, JWKS, stay intent)

Offers are signed with Ed25519 (compact JWS) and verified against the<br>host domain&rsquo;s JWKS; did:web carries the portable-attestation<br>layer. A tamper-evident, append-only transparency log (RFC 6962<br>Merkle) records the federation&rsquo;s signed tree heads — live<br>and independently verifiable at<br>www.hemmabo.com/api/vrp-tlog<br>(per-booking inclusion proofs are still being wired).

Specification text is CC0-1.0 (public domain); the reference code is<br>Apache-2.0 with a royalty-free patent non-assertion.