One file, one endpoint, one sentence.
The specification is a public draft for comment. The discovery path, the hello sentences, and the DTMF frames are frozen from this draft onward.
An open protocol
When your assistant calls a business and an assistant answers, they should not talk English at each other. ATEP lets two AI agents recognize each other on an ordinary phone call, prove whom they act for, and finish the job over HTTPS, with the call as fallback.
The problem
The phone is where the demand is, voice is what it costs, and no one has published a way around it. Every figure here links to where it came from.
44%of calls
Calls to US businesses that are never answered by a person, measured across more than 70 million tracked calls in ten industries. In healthcare it is 46 percent. The caller who hangs up is the demand ATEP is for.
Invoca call conversion benchmarks, July 2026
67×cheaper
A three-minute AI voice call costs about $0.34 on a typical production stack of published rate cards. The same task as a structured exchange costs about $0.005, and most of that is the model that plans it, not the wire.
Assembled from published pricing, read 23 September 2026
0of ~60 domains
Voice-AI platforms and big-tech companies that publish a machine-readable endpoint an inbound caller could find. They publish llms.txt, because it is free. Nobody has offered them a convention for the phone.
Survey of about 60 voice-AI and big-tech domains, 23 September 2026
The third number is the opening. A business can already be reached by a person, by a form, and by an app. It cannot be reached by a machine that started from its phone number. ATEP is one JSON document at a fixed path, one HTTPS endpoint, one spoken sentence, and a few DTMF digits, and it works when only one side has implemented it.
How it works
A business that publishes nothing but a card is already useful to a caller. A caller that speaks nothing but the hello costs a human answerer nothing.
L4
Intents
availability, book, reschedule, cancel, quote, message, handoff
A closed vocabulary of seven. Free text lives only in the fields Section 3 names, 500 characters each.
L3
Session
delegation, mandates, receipts, state machine, attestations
hello, bound, delegated, negotiating, confirmed, receipted. Nothing binds a principal without a receipt both sides sign.
L2
Exchange
HTTPS + JSON, JWS-signed, JCS-canonicalized
One session is one HTTPS resource. The answerer replies within two seconds or sends working with a retry interval.
L1
Handshake
spoken hello, DTMF frames, call binding
Both sides prove control of their own leg by trading four-digit challenges over the call and the session at once.
L0
Discovery
/.well-known/atep.json, DNS, the registry
Resolution starts from an E.164 number, because a number is all a caller has. The path is frozen from this draft on.
The whole of it in nineteen seconds of call time: the answerer speaks its disclosure and sends its pointer, the caller speaks its own hello, both bind their legs to one HTTPS session with four-digit challenges, both hang up, and the booking finishes on the wire. See the worked example.
Scope
Three things people will assume it does. It does not do them, and the spec says why.
Disclosure is protocol, not prompt
Every obligation below is a MUST in the specification, not a setting an operator can switch off and not a sentence a model is asked to remember.
A caller's first utterance names the AI, the principal it calls for, and a callback number where a human can be reached. An answerer speaks the disclosure sentence from its own card, which must name the party and say it is an AI.
A side that records inserts “This call is recorded.” immediately before the word ATEP, so the announcement sits inside the recording. A card declares a no-record mode, and a tone is never treated as consent.
The caller's first message after binding is a signed, scoped, expiring credential from the principal's platform: which intents, what spending cap, which dates, how many bookings, and a revocation URL the answerer must check before any receipt.
A cancellation, a reschedule that carries a fee, and an accepted quote each need a per-transaction mandate, issued after the exact terms were shown to the person, expiring within the hour, good for that one action.
Every state-changing outcome, every message taken, and every handoff ends in a record both sides sign, holding the read-back summary, both hello sentences as spoken, who recorded, and whether a human could have heard the exchange.
With healthcare set true on the card, the answerer must neither confirm nor deny anything without a delegation that matches its own record of the patient, must keep a path to a person open, and the caller must keep clinical detail out of every field.
The rules these track. An artificial-voice call in the United States must already identify the responsible entity and give a callback number under 47 CFR 64.1200(b). Utah SB 226 gives a safe harbour for saying the system is an artificial intelligence assistant. EU AI Act Article 50 has required notification and marking of synthetic audio since 2 August 2026, and exempts output that is provably machine to machine, which is what the human-audible attestation on every ATEP message records. Conformance is not legal advice, and nothing here is a legal opinion.
Conformance
The reference tester dials a candidate number, or accepts a call from a candidate caller, runs the scenarios for the claimed level, and issues a signed statement. A registry should list the level.
| Level | Name | Requirements |
|---|---|---|
| 0 | Card | Publishes a valid, signed card at the well-known path. Any business, even human-answered. |
| 1 | Caller | Speaks the hello, sends the frame, resolves and verifies cards, completes binding, sends a valid delegation, completes availability, book, and message against the reference answerer, honors mandate_required, produces and stores receipts, falls back to voice correctly. |
| 2 | Answerer | Speaks the hello, sends the frame, serves hello, binding, all seven intents, confirmation, receipts, release, no-record mode, do_not_call, revocation checks, and the 2-second latency contract. |
| 3 | Healthcare | Level 2 plus the healthcare profile in Section 9. |
Adoption
Three audiences, three different pieces of work, and only the first one is required for the protocol to be worth anything.
Governance
A protocol one vendor owns forever is a product. The terms for handing it over are written down now, before there is anything worth keeping.
License and home
Apache 2.0, spec and code. The work lives in the GitHub organization atep-protocol. Lydoh is editor for 1.x, and changes are made by issue and pull request in the open.
Foundation clause
Three independent implementations and the specification moves to a neutral foundation. Not a promise to consider it: the count is the trigger.
Compatibility
Semantic versioning, and 1.x never breaks a 1.0 message. Fields may be added; none will be removed or change meaning. Anything deprecated is supported for twelve months after the notice.
Trademark
Saying you implement ATEP is free to anyone. The mark itself is reserved for implementations that pass the conformance test for the level they claim.
The specification is a public draft for comment. The discovery path, the hello sentences, and the DTMF frames are frozen from this draft onward.
Authored by Lydoh. Draft 2, September 2026. Comments to hello@lydoh.com.