ZCAPs

Identity Protocol

Authorization Capabilities for Linked Data — capability-based authorization specification developed by the W3C Credentials Community Group. Uses cryptographically signed capability documents to delegate fine-grained permissions, providing an alternative to ACL-based authorization that composes with W3C DIDs and Verifiable Credentials. Increasingly relevant in SSI ecosystems and linked-data systems requiring delegatable authorization.

Community
Links
Visit Website See this tool in the graph Suggest an edit

Details

License Open source — reference implementations under various open licenses; @digitalbazaar/zcap (Node.js), ucanto (related capability work), various incremental implementations
Dev Status 📝 Draft
Dev Status Detail Draft Specification / Community Group Report (W3C CCG draft; reference implementations exist; pre-W3C Recommendation track)
Owner W3C Credentials Community Group (CCG); editors include Manu Sporny, Christopher Lemmer Webber, others
Governing Body W3C Community Group (Credentials Community Group)
Country International (W3C)
Start Year 2018
Stack Specification; reference implementations primarily in JavaScript/Node.js; can be implemented in any language supporting JSON-LD and cryptographic signatures
Funding W3C standards process; Digital Bazaar and other CCG participants contribute development
Last Investigated Jul 1, 2026

Topology view

This tool in the centre and the things it is directly related to. Each line names the kind of relationship.

Topology view: ZCAPsThis tool in the centre and the things it is directly related to. Each line names the kind of relationship.ZCAPsDIDs (Built on, Conforms to, Identifies via)DIDsJSON-LD (Built on, Conforms to, Speaks protocol)JSON-LDVCs (Composes with, Conforms to)VCsWorld Wide Web Consortium (Hosted at)World WideWeb Consorti…ActivityPub (Speaks protocol)ActivityPubSolid (Speaks protocol)Solid
  • DIDs (Tool): Built on, Conforms to, Identifies via
  • JSON-LD (Tool): Built on, Conforms to, Speaks protocol
  • VCs (Tool): Composes with, Conforms to
  • World Wide Web Consortium (Organization): Hosted at
  • ActivityPub (Tool): Speaks protocol
  • Solid (Tool): Speaks protocol

Open in Graph Explorer

Use Case Domains

Identity & Trust

Affordances

Contextual disclosure Portable attestations

Identity Protocol Attributes

Origins Capability-based security (E-language, Object Capability Model heritage); developed to provide authorization patterns compatible with W3C DIDs and VCs
Database N/A — ZCAPs are signed documents passed between parties; storage is application-level
Query Language N/A (authorization document specification)
Data Formats JSON-LD (capability documents use Linked Data Proofs / Data Integrity for cryptographic signing); verifiable proofs attached to capability invocations
Mobile Support Library-level (JavaScript implementations work on mobile via web or native bindings)
Web Support Yes (JSON-LD-based; works with browser JavaScript)
Native Apps Library-level
Terms Open standard — W3C CCG specification (Community Group output)
Funds N/A (Community Group output)
Based On Object Capability Model (OCAP); W3C DIDs (signers identified by DIDs); W3C Verifiable Credentials Data Integrity / Linked Data Proofs (signature mechanism); JSON-LD; related to but distinct from UCAN (another capability-based authorization specification)
Permissions Self — ZCAPs ARE a permissions specification (capability-based authorization); fine-grained, delegatable, auditable permissions via signed capability documents
Authentication & Identity Capability holders identified by W3C DIDs; capability invocations cryptographically signed by the invoker's key; delegation chains verified by checking signatures along the path from the original capability issuer
Storage Model N/A — capabilities are signed documents passed between parties; storage is application-level
Interoperability High — built on W3C DIDs, Linked Data Proofs, and JSON-LD; composes with W3C VCs; ecosystem-aligned with Solid, ActivityPub, and broader linked-data infrastructure
Data Portability N/A — authorization specification, not data storage
Governance & Decision Making W3C Credentials Community Group (multi-stakeholder W3C process)
Protocol Maturity / Standardization W3C CCG Draft Specification / Community Group Report (not yet on W3C Recommendation track; reference implementations exist; pre-final)
Identity Standards W3C DIDs (Decentralized Identifiers); W3C Data Integrity / Linked Data Proofs
Identity Standards - List
DID Methods Supported Any DID method — ZCAPs are method-agnostic; capability invocations work with whatever DIDs the involved parties use
DID Methods Supported - List
Key Management Inherits from associated DID method's key management; ZCAPs themselves do not manage keys
Credential Types N/A (ZCAPs are capability documents, not credentials; they compose with W3C VCs)
Credential Types - List
Verification Method Linked Data Proofs / Data Integrity — Ed25519Signature2020, EcdsaSecp256k1Signature2019, and other proof suites; signature verified using verificationMethod from the signing DID's document
Privacy Features Selective delegation (capabilities can be narrowed when delegating; original holder retains broader capability); minimal disclosure (capability invocations include only the necessary delegation chain)
Authentication Methods Capability invocation — invoker signs the action request with their DID-controlled key, attaching the capability chain that authorizes the action
Revocation Mechanism Status list capabilities (revocation lists referenced from capability documents); capability expiry (time-bounded validity); revocation by issuer through publication of revocation status
Agent Types Supported Humans, organizations, services, software agents — anything that can hold a DID can hold and invoke ZCAPs
Wallet/Client Types Any DID-aware client / wallet (no ZCAP-specific wallet type)
Recovery Mechanisms Inherits from associated DID method's recovery mechanisms
Compliance / Regulations Designed to support data sovereignty patterns relevant to GDPR (capability invocations create cryptographically auditable consent trails); not certified for specific regulations
Credential Exchange Protocols Composes with W3C VC exchange protocols (e.g. VC-API); capabilities can authorize VC issuance, verification, or holder operations
Credential Exchange Protocols - List
Trust Framework Capability chain — each delegation in the chain is independently verifiable through DID-based signatures; trust ultimately roots in the original capability issuer
Cost Model Free (open standard; implementation and infrastructure costs are deployment-specific)
Censorship Resistance High — capabilities are cryptographic documents that can be passed through any channel; no centralized infrastructure required for capability validity

Relationships

How this tool connects to other tools and organizations, from relationships reviewed by the OpenHaven data steward. They describe how projects connect, not how good they are.

Built on
Conforms to
Hosted at
  • World Wide Web Consortium
Identifies via
Speaks protocol
Composes with