ZCAPs

Protocolo de Identidade

Authorization Capabilities for Linked Data — capability-based authorization specification developed by the W3C Credentials Community Group. Uses cryptographically signed capability documents to delegate fine-grained permissions, providing an alternative to ACL-based authorization that composes with W3C DIDs and Verifiable Credentials. Increasingly relevant in SSI ecosystems and linked-data systems requiring delegatable authorization.

Comunidade
Links
Visitar Website Sugerir uma correção

Detalhes

Licença Open source — reference implementations under various open licenses; @digitalbazaar/zcap (Node.js), ucanto (related capability work), various incremental implementations
Status de Dev 📝 Rascunho
Detalhe do Status de Dev Draft Specification / Community Group Report (W3C CCG draft; reference implementations exist; pre-W3C Recommendation track)
Proprietário W3C Credentials Community Group (CCG); editors include Manu Sporny, Christopher Lemmer Webber, others
Órgão de Governança W3C Community Group (Credentials Community Group)
País International (W3C)
Ano de Início 2018
Stack Specification; reference implementations primarily in JavaScript/Node.js; can be implemented in any language supporting JSON-LD and cryptographic signatures
Financiamento W3C standards process; Digital Bazaar and other CCG participants contribute development
Última Investigação 1 de jul. de 2026

Domínios de Caso de Uso

Identidade e Confiança

Capacidades

Divulgação contextual Atestações portáteis

Protocolo de Identidade Atributos

Origens Capability-based security (E-language, Object Capability Model heritage); developed to provide authorization patterns compatible with W3C DIDs and VCs
Banco de Dados N/A — ZCAPs are signed documents passed between parties; storage is application-level
Linguagem de Consulta N/A (authorization document specification)
Formatos de Dados JSON-LD (capability documents use Linked Data Proofs / Data Integrity for cryptographic signing); verifiable proofs attached to capability invocations
Suporte Móvel Library-level (JavaScript implementations work on mobile via web or native bindings)
Suporte Web Yes (JSON-LD-based; works with browser JavaScript)
Aplicativos Nativos Library-level
Termos Open standard — W3C CCG specification (Community Group output)
Fundos N/A (Community Group output)
Baseado Em Object Capability Model (OCAP); W3C DIDs (signers identified by DIDs); W3C Verifiable Credentials Data Integrity / Linked Data Proofs (signature mechanism); JSON-LD; related to but distinct from UCAN (another capability-based authorization specification)
Permissões Self — ZCAPs ARE a permissions specification (capability-based authorization); fine-grained, delegatable, auditable permissions via signed capability documents
Autenticação e Identidade Capability holders identified by W3C DIDs; capability invocations cryptographically signed by the invoker's key; delegation chains verified by checking signatures along the path from the original capability issuer
Modelo de Armazenamento N/A — capabilities are signed documents passed between parties; storage is application-level
Interoperabilidade High — built on W3C DIDs, Linked Data Proofs, and JSON-LD; composes with W3C VCs; ecosystem-aligned with Solid, ActivityPub, and broader linked-data infrastructure
Portabilidade de Dados N/A — authorization specification, not data storage
Governança e Tomada de Decisão W3C Credentials Community Group (multi-stakeholder W3C process)
Maturidade / Padronização do Protocolo W3C CCG Draft Specification / Community Group Report (not yet on W3C Recommendation track; reference implementations exist; pre-final)
Padrões de Identidade W3C DIDs (Decentralized Identifiers); W3C Data Integrity / Linked Data Proofs
Métodos DID Suportados Any DID method — ZCAPs are method-agnostic; capability invocations work with whatever DIDs the involved parties use
Gestão de Chaves Inherits from associated DID method's key management; ZCAPs themselves do not manage keys
Tipos de Credenciais N/A (ZCAPs are capability documents, not credentials; they compose with W3C VCs)
Método de Verificação Linked Data Proofs / Data Integrity — Ed25519Signature2020, EcdsaSecp256k1Signature2019, and other proof suites; signature verified using verificationMethod from the signing DID's document
Recursos de Privacidade Selective delegation (capabilities can be narrowed when delegating; original holder retains broader capability); minimal disclosure (capability invocations include only the necessary delegation chain)
Métodos de Autenticação Capability invocation — invoker signs the action request with their DID-controlled key, attaching the capability chain that authorizes the action
Mecanismo de Revogação Status list capabilities (revocation lists referenced from capability documents); capability expiry (time-bounded validity); revocation by issuer through publication of revocation status
Tipos de Agentes Suportados Humans, organizations, services, software agents — anything that can hold a DID can hold and invoke ZCAPs
Tipos de Carteira/Cliente Any DID-aware client / wallet (no ZCAP-specific wallet type)
Mecanismos de Recuperação Inherits from associated DID method's recovery mechanisms
Conformidade / Regulamentações Designed to support data sovereignty patterns relevant to GDPR (capability invocations create cryptographically auditable consent trails); not certified for specific regulations
Protocolos de Troca de Credenciais Composes with W3C VC exchange protocols (e.g. VC-API); capabilities can authorize VC issuance, verification, or holder operations
Estrutura de Confiança Capability chain — each delegation in the chain is independently verifiable through DID-based signatures; trust ultimately roots in the original capability issuer
Modelo de Custo Free (open standard; implementation and infrastructure costs are deployment-specific)
Resistência à Censura High — capabilities are cryptographic documents that can be passed through any channel; no centralized infrastructure required for capability validity