ZCAPs

Protocolo de Identidad

Authorization Capabilities for Linked Data — capability-based authorization specification developed by the W3C Credentials Community Group. Uses cryptographically signed capability documents to delegate fine-grained permissions, providing an alternative to ACL-based authorization that composes with W3C DIDs and Verifiable Credentials. Increasingly relevant in SSI ecosystems and linked-data systems requiring delegatable authorization.

Comunidad
Enlaces
Visitar Comunidad

Detalles

Licencia Open source — reference implementations under various open licenses; @digitalbazaar/zcap (Node.js), ucanto (related capability work), various incremental implementations
Estado de Desarrollo 📝 Borrador
Detalle del Estado de Desarrollo Draft Specification / Community Group Report (W3C CCG draft; reference implementations exist; pre-W3C Recommendation track)
Propietario W3C Credentials Community Group (CCG); editors include Manu Sporny, Christopher Lemmer Webber, others
Órgano de Gobierno W3C Community Group (Credentials Community Group)
País International (W3C)
Año de Inicio 2018
Stack Specification; reference implementations primarily in JavaScript/Node.js; can be implemented in any language supporting JSON-LD and cryptographic signatures
Financiamiento W3C standards process; Digital Bazaar and other CCG participants contribute development
Última Investigación 1 jul 2026

Dominios de Caso de Uso

Identidad y Confianza

Protocolo de Identidad Atributos

Orígenes Capability-based security (E-language, Object Capability Model heritage); developed to provide authorization patterns compatible with W3C DIDs and VCs
Base de Datos N/A — ZCAPs are signed documents passed between parties; storage is application-level
Lenguaje de Consulta N/A (authorization document specification)
Formatos de Datos JSON-LD (capability documents use Linked Data Proofs / Data Integrity for cryptographic signing); verifiable proofs attached to capability invocations
Soporte Móvil Library-level (JavaScript implementations work on mobile via web or native bindings)
Soporte Web Yes (JSON-LD-based; works with browser JavaScript)
Aplicaciones Nativas Library-level
Términos Open standard — W3C CCG specification (Community Group output)
Fondos N/A (Community Group output)
Basado En Object Capability Model (OCAP); W3C DIDs (signers identified by DIDs); W3C Verifiable Credentials Data Integrity / Linked Data Proofs (signature mechanism); JSON-LD; related to but distinct from UCAN (another capability-based authorization specification)
Permisos Self — ZCAPs ARE a permissions specification (capability-based authorization); fine-grained, delegatable, auditable permissions via signed capability documents
Autenticación e Identidad Capability holders identified by W3C DIDs; capability invocations cryptographically signed by the invoker's key; delegation chains verified by checking signatures along the path from the original capability issuer
Modelo de Almacenamiento N/A — capabilities are signed documents passed between parties; storage is application-level
Interoperabilidad High — built on W3C DIDs, Linked Data Proofs, and JSON-LD; composes with W3C VCs; ecosystem-aligned with Solid, ActivityPub, and broader linked-data infrastructure
Portabilidad de Datos N/A — authorization specification, not data storage
Gobernanza y Toma de Decisiones W3C Credentials Community Group (multi-stakeholder W3C process)
Madurez del Protocolo / Estandarización W3C CCG Draft Specification / Community Group Report (not yet on W3C Recommendation track; reference implementations exist; pre-final)
Estándares de Identidad W3C DIDs (Decentralized Identifiers); W3C Data Integrity / Linked Data Proofs
Métodos DID Soportados Any DID method — ZCAPs are method-agnostic; capability invocations work with whatever DIDs the involved parties use
Gestión de Claves Inherits from associated DID method's key management; ZCAPs themselves do not manage keys
Tipos de Credenciales N/A (ZCAPs are capability documents, not credentials; they compose with W3C VCs)
Método de Verificación Linked Data Proofs / Data Integrity — Ed25519Signature2020, EcdsaSecp256k1Signature2019, and other proof suites; signature verified using verificationMethod from the signing DID's document
Funciones de Privacidad Selective delegation (capabilities can be narrowed when delegating; original holder retains broader capability); minimal disclosure (capability invocations include only the necessary delegation chain)
Métodos de Autenticación Capability invocation — invoker signs the action request with their DID-controlled key, attaching the capability chain that authorizes the action
Mecanismo de Revocación Status list capabilities (revocation lists referenced from capability documents); capability expiry (time-bounded validity); revocation by issuer through publication of revocation status
Tipos de Agentes Soportados Humans, organizations, services, software agents — anything that can hold a DID can hold and invoke ZCAPs
Tipos de Billetera/Cliente Any DID-aware client / wallet (no ZCAP-specific wallet type)
Mecanismos de Recuperación Inherits from associated DID method's recovery mechanisms
Cumplimiento / Regulaciones Designed to support data sovereignty patterns relevant to GDPR (capability invocations create cryptographically auditable consent trails); not certified for specific regulations
Protocolos de Intercambio de Credenciales Composes with W3C VC exchange protocols (e.g. VC-API); capabilities can authorize VC issuance, verification, or holder operations
Marco de Confianza Capability chain — each delegation in the chain is independently verifiable through DID-based signatures; trust ultimately roots in the original capability issuer
Modelo de Costos Free (open standard; implementation and infrastructure costs are deployment-specific)
Resistencia a la Censura High — capabilities are cryptographic documents that can be passed through any channel; no centralized infrastructure required for capability validity