zcap-spec examples

example-1: Resource with delegation keys

application/jsonc · View in the spec

An object that names, via capabilityDelegation, the keys allowed to delegate authority over it: the source of authority for a root capability.

Id: https://whatacar.example/a-fancy-car
Delegation keys: https://example.com/i/alyssa/keys/1

Source

{
  "@context": [
    "https://w3id.org/zcap/v1",
    "https://w3id.org/security/data-integrity/v2"
  ],

  "id": "https://whatacar.example/a-fancy-car",

  // The initial source of authority on any chain rooted at this car.
  // Alyssa bought the car, so the car's manufacturer provisioned it to
  // recognize one of Alyssa's keys as its delegating key.
  "capabilityDelegation": [
    "https://example.com/i/alyssa/keys/1"
  ]
}

Parsed, comments removed

{
  "@context": [
    "https://w3id.org/zcap/v1",
    "https://w3id.org/security/data-integrity/v2"
  ],
  "id": "https://whatacar.example/a-fancy-car",
  "capabilityDelegation": [
    "https://example.com/i/alyssa/keys/1"
  ]
}

example-2: Delegated capability

application/jsonc · View in the spec

A capability derived from a parent, granting authority to a new controller and signed with a capabilityDelegation proof.

Id: https://whatacar.example/a-fancy-car/proc/7a397d7b
Parent capability: urn:zcap:root:https%3A%2F%2Fwhatacar.example%2Fa-fancy-car
Controller: https://social.example/alyssa#key-for-car
Delegated by: https://example.com/i/alyssa/keys/1
Capability chain length: 1

Source

{
  "@context": [
    "https://w3id.org/zcap/v1",
    "https://w3id.org/security/data-integrity/v2",
    "https://autopower.example/"
  ],

  "id": "https://whatacar.example/a-fancy-car/proc/7a397d7b",

  // Since this is the first delegated capability, the parentCapability
  // is the root zcap of the target this capability will operate against
  // (in this case, Alyssa's Car)
  "parentCapability": "urn:zcap:root:https%3A%2F%2Fwhatacar.example%2Fa-fancy-car",

  // We are granting authority specifically to one of Alyssa's
  // cryptographic keys (not to be confused with the car
  // key metaphor!)
  "controller": "https://social.example/alyssa#key-for-car",

  // Finally we sign this object with cryptographic material from
  // Alyssa's Car's capabilityDelegation field, and using the
  // capabilityDelegation proofPurpose.
  "proof": {
    "type": "DataIntegrityProof",
    "created": "2018-02-13T21:26:08Z",
    "cryptosuite": "eddsa-jcs-2022",
    "capabilityChain": [
      "urn:zcap:root:https%3A%2F%2Fwhatacar.example%2Fa-fancy-car"
    ],
    "proofPurpose": "capabilityDelegation",
    "proofValue": "z2YwC8z3ap7yx1nZYCg4L3j3ApHsF8kgPdSb5xoS1VR7vPG3F561B52hYnQF9iseabecm3ijx4K1FBTQsCZahKZme",
    "verificationMethod": "https://example.com/i/alyssa/keys/1"
  }
}

Parsed, comments removed

{
  "@context": [
    "https://w3id.org/zcap/v1",
    "https://w3id.org/security/data-integrity/v2",
    "https://autopower.example/"
  ],
  "id": "https://whatacar.example/a-fancy-car/proc/7a397d7b",
  "parentCapability": "urn:zcap:root:https%3A%2F%2Fwhatacar.example%2Fa-fancy-car",
  "controller": "https://social.example/alyssa#key-for-car",
  "proof": {
    "type": "DataIntegrityProof",
    "created": "2018-02-13T21:26:08Z",
    "cryptosuite": "eddsa-jcs-2022",
    "capabilityChain": [
      "urn:zcap:root:https%3A%2F%2Fwhatacar.example%2Fa-fancy-car"
    ],
    "proofPurpose": "capabilityDelegation",
    "proofValue": "z2YwC8z3ap7yx1nZYCg4L3j3ApHsF8kgPdSb5xoS1VR7vPG3F561B52hYnQF9iseabecm3ijx4K1FBTQsCZahKZme",
    "verificationMethod": "https://example.com/i/alyssa/keys/1"
  }
}

example-3: Capability invocation

application/jsonc · View in the spec

A request to exercise a capability, proven with a capabilityInvocation proof that references the capability being used.

Invocation id: urn:uuid:ad86cb2c-e9db-434a-beae-71b82120a8a4
Action: Drive
Capability invoked: urn:uuid:d2c83c43-878a-4c01-984f-b2f57932ce5f
Signed by: https://social.example/alyssa/#key-for-car
Cryptosuite: eddsa-jcs-2022

Source

{
  "@context": [
    "https://w3id.org/zcap/v1",
    "https://w3id.org/security/data-integrity/v2",
    "https://autopower.example/"
  ],
  "id": "urn:uuid:ad86cb2c-e9db-434a-beae-71b82120a8a4",
  "action": "Drive",
  "proof": {
    "type": "DataIntegrityProof",
    "cryptosuite": "eddsa-jcs-2022",
    // A linked data document can be an invocation if it has a
    // proofPurpose of capabilityInvocation and links to the capability
    // chain it is invoking
    "proofPurpose": "capabilityInvocation",
    "capability": {
      "@context": "https://w3id.org/zcap/v1",
      "id": "urn:uuid:d2c83c43-878a-4c01-984f-b2f57932ce5f",
      "parentCapability": "urn:uuid:f7412b9a-854b-47ab-806b-3ac736cc7cda",
      "controller": "did:key:dummy",
      "expires": "2026-01-31T00:00:00Z",
      "allowedAction": [
        "https://example.com/storage/method/UploadFile"
      ],
      "proof": [
        {
          "type": "DataIntegrityProof",
          "cryptosuite": "eddsa-jcs-2022",
          "created": "2026-01-01T00:00:00Z",
          "verificationMethod": "did:key:bob#bob",
          "proofPurpose": "capabilityDelegation",
          "proofValue": "zQeVbY4oey5q2M3XKaxup3tmzN4DRFTLVqpLMweBrSxMY2xHX5XTYV8nQApmEcqaqA3Q1gVHMrXFkXJeV6doDwLWx"
        }
      ]
    },
    "created": "2016-02-08T17:13:48Z",
    "verificationMethod": "https://social.example/alyssa/#key-for-car",
    "proofValue": "..."
  }
}

Parsed, comments removed

{
  "@context": [
    "https://w3id.org/zcap/v1",
    "https://w3id.org/security/data-integrity/v2",
    "https://autopower.example/"
  ],
  "id": "urn:uuid:ad86cb2c-e9db-434a-beae-71b82120a8a4",
  "action": "Drive",
  "proof": {
    "type": "DataIntegrityProof",
    "cryptosuite": "eddsa-jcs-2022",
    "proofPurpose": "capabilityInvocation",
    "capability": {
      "@context": "https://w3id.org/zcap/v1",
      "id": "urn:uuid:d2c83c43-878a-4c01-984f-b2f57932ce5f",
      "parentCapability": "urn:uuid:f7412b9a-854b-47ab-806b-3ac736cc7cda",
      "controller": "did:key:dummy",
      "expires": "2026-01-31T00:00:00Z",
      "allowedAction": [
        "https://example.com/storage/method/UploadFile"
      ],
      "proof": [
        {
          "type": "DataIntegrityProof",
          "cryptosuite": "eddsa-jcs-2022",
          "created": "2026-01-01T00:00:00Z",
          "verificationMethod": "did:key:bob#bob",
          "proofPurpose": "capabilityDelegation",
          "proofValue": "zQeVbY4oey5q2M3XKaxup3tmzN4DRFTLVqpLMweBrSxMY2xHX5XTYV8nQApmEcqaqA3Q1gVHMrXFkXJeV6doDwLWx"
        }
      ]
    },
    "created": "2016-02-08T17:13:48Z",
    "verificationMethod": "https://social.example/alyssa/#key-for-car",
    "proofValue": "..."
  }
}

example-4: Delegated capability

application/jsonc · View in the spec

A capability derived from a parent, granting authority to a new controller and signed with a capabilityDelegation proof.

Id: https://social.example/alyssa/caps#79795d78
Parent capability: https://whatacar.example/a-fancy-car/proc/7a397d7b
Controller: https://chatty.example/ben/#key-33
Caveats: ValidWhileTrue
Delegated by: https://social.example/alyssa/#key-for-car
Capability chain length: 2

Source

{
  "@context": [
    "https://w3id.org/zcap/v1",
    "https://w3id.org/security/data-integrity/v2",
    "https://autopower.example/"
  ],
  "id": "https://social.example/alyssa/caps#79795d78",

  // Pointing up the chain at the capability from which Alyssa was
  // initially gained authority
  "parentCapability": "https://whatacar.example/a-fancy-car/proc/7a397d7b",

  // Alyssa grants authority specifically to one of Ben's
  // cryptographic keys
  "controller": "https://chatty.example/ben/#key-33",

  // Alyssa adds a caveat: Ben can drive her car, unless she flips
  // the bit at this url
  "caveat": [
    {
      "type": "ValidWhileTrue",
      "uri": "https://social.example/alyssa/ben-can-still-drive"
    }
  ],

  // Finally Alyssa signs this object with the key she was granted
  // authority with
  "proof": {
    "type": "DataIntegrityProof",
    "cryptosuite": "eddsa-jcs-2022",
    "proofPurpose": "capabilityDelegation",
    "created": "2017-03-28T06:01:25Z",
    "verificationMethod": "https://social.example/alyssa/#key-for-car",
    "proofValue": "...",
    "capabilityChain": [
      "urn:zcap:root:https%3A%2F%2Fwhatacar.example%2Fa-fancy-car",
      // This should be the full expression of the parentCapability (i.e. Example 1)
      {
        "@context": [
          "https://w3id.org/zcap/v1",
          "https://w3id.org/security/data-integrity/v2",
          "https://autopower.example/"
        ],
        "id": "https://whatacar.example/a-fancy-car/proc/7a397d7b",
        "parentCapability": "urn:zcap:root:https%3A%2F%2Fwhatacar.example%2Fa-fancy-car",
        "controller": "https://social.example/alyssa#key-for-car",
        "proof": {
          "type": "DataIntegrityProof",
          "cryptosuite": "eddsa-jcs-2022",
          "created": "2018-02-13T21:26:08Z",
          "capabilityChain": [
            "urn:zcap:root:https%3A%2F%2Fwhatacar.example%2Fa-fancy-car"
          ],
          "proofValue": "eyJhbGciOiJFZERTQSIsImI2NCI6ZmFsc2UsImNyaXQiOlsiYjY0Il19lfAFjrWE-4RxhL0gtzSMRX72NR9SRDgaMmkjPA4if0ERbw4R2bnts5sAs8OyhAlbFzBAKOqrFk57AYqwSR2vCw",
          "proofPurpose": "capabilityDelegation",
          "verificationMethod": "https://example.com/i/alyssa/keys/1"
        }
      }
    ]
  }
}

Parsed, comments removed

{
  "@context": [
    "https://w3id.org/zcap/v1",
    "https://w3id.org/security/data-integrity/v2",
    "https://autopower.example/"
  ],
  "id": "https://social.example/alyssa/caps#79795d78",
  "parentCapability": "https://whatacar.example/a-fancy-car/proc/7a397d7b",
  "controller": "https://chatty.example/ben/#key-33",
  "caveat": [
    {
      "type": "ValidWhileTrue",
      "uri": "https://social.example/alyssa/ben-can-still-drive"
    }
  ],
  "proof": {
    "type": "DataIntegrityProof",
    "cryptosuite": "eddsa-jcs-2022",
    "proofPurpose": "capabilityDelegation",
    "created": "2017-03-28T06:01:25Z",
    "verificationMethod": "https://social.example/alyssa/#key-for-car",
    "proofValue": "...",
    "capabilityChain": [
      "urn:zcap:root:https%3A%2F%2Fwhatacar.example%2Fa-fancy-car",
      {
        "@context": [
          "https://w3id.org/zcap/v1",
          "https://w3id.org/security/data-integrity/v2",
          "https://autopower.example/"
        ],
        "id": "https://whatacar.example/a-fancy-car/proc/7a397d7b",
        "parentCapability": "urn:zcap:root:https%3A%2F%2Fwhatacar.example%2Fa-fancy-car",
        "controller": "https://social.example/alyssa#key-for-car",
        "proof": {
          "type": "DataIntegrityProof",
          "cryptosuite": "eddsa-jcs-2022",
          "created": "2018-02-13T21:26:08Z",
          "capabilityChain": [
            "urn:zcap:root:https%3A%2F%2Fwhatacar.example%2Fa-fancy-car"
          ],
          "proofValue": "eyJhbGciOiJFZERTQSIsImI2NCI6ZmFsc2UsImNyaXQiOlsiYjY0Il19lfAFjrWE-4RxhL0gtzSMRX72NR9SRDgaMmkjPA4if0ERbw4R2bnts5sAs8OyhAlbFzBAKOqrFk57AYqwSR2vCw",
          "proofPurpose": "capabilityDelegation",
          "verificationMethod": "https://example.com/i/alyssa/keys/1"
        }
      }
    ]
  }
}

example-5: Delegated capability

application/jsonc · View in the spec

A capability derived from a parent, granting authority to a new controller and signed with a capabilityDelegation proof.

Id: https://chatty.example/ben/caps#2cdea8c1
Parent capability: https://social.example/alyssa/caps#79795d78
Controller: https://lem.example/#key-bf36
Caveats: DriveNoMoreThan
Delegated by: https://chatty.example/ben/#key-33
Capability chain length: 3

Source

{
  "@context": [
    "https://w3id.org/zcap/v1",
    "https://w3id.org/security/data-integrity/v2",
    "https://autopower.example/"
  ],
  "id": "https://chatty.example/ben/caps#2cdea8c1",
  "parentCapability": "https://social.example/alyssa/caps#79795d78",
  "controller": "https://lem.example/#key-bf36",

  // Ben adds this caveat: this capability can be used to drive the
  // car, but not for more than 5 kilometers
  "caveat": [
    {
      "type": "DriveNoMoreThan",
      // Alyssa's gauge currently says 123854 kilometers driven,
      // so this is only 5 km more than the current value
      "kilometers": 123859
    }
  ],

  // Finally Ben signs this object with the key he was granted
  // authority with
  "proof": {
    "type": "DataIntegrityProof",
    "cryptosuite": "eddsa-jcs-2022",
    "proofPurpose": "capabilityDelegation",
    "created": "2017-06-13T19:15:03Z",
    "verificationMethod": "https://chatty.example/ben/#key-33",
    "proofValue": "...",
    "capabilityChain": [
      "urn:zcap:root:https%3A%2F%2Fwhatacar.example%2Fa-fancy-car",
      "https://whatacar.example/a-fancy-car/proc/7a397d7b",
      // This is the full expression of the parentCapability (i.e. Example 3)
      {
        "@context": [
          "https://w3id.org/zcap/v1",
          "https://autopower.example/"
        ],
        "id": "https://social.example/alyssa/caps#79795d78",
        "parentCapability": "https://whatacar.example/a-fancy-car/proc/7a397d7b",
        "controller": "https://chatty.example/ben/#key-33",
        "caveat": [
          {
            "type": "ValidWhileTrue",
            "uri": "https://social.example/alyssa/ben-can-still-drive"
          }
        ],
        "proof": {
          "type": "DataIntegrityProof",
          "cryptosuite": "eddsa-jcs-2022",
          "proofPurpose": "capabilityDelegation",
          "created": "2017-03-28T06:01:25Z",
          "verificationMethod": "https://social.example/alyssa/#key-for-car",
          "proofValue": "...",
          "capabilityChain": [
            "urn:zcap:root:https%3A%2F%2Fwhatacar.example%2Fa-fancy-car",
            // This is the full expression of the parentCapability (i.e. Example 1)
            {
              "@context": [
                "https://w3id.org/zcap/v1",
                "https://w3id.org/security/suites/ed25519-2020/v1",
                "https://autopower.example/"
              ],
              "id": "https://whatacar.example/a-fancy-car/proc/7a397d7b",
              "parentCapability": "urn:zcap:root:https%3A%2F%2Fwhatacar.example%2Fa-fancy-car",
              "controller": "https://social.example/alyssa#key-for-car",
              "proof": {
                "type": "DataIntegrityProof",
                "cryptosuite": "eddsa-jcs-2022",
                "created": "2018-02-13T21:26:08Z",
                "capabilityChain": [
                  "urn:zcap:root:https%3A%2F%2Fwhatacar.example%2Fa-fancy-car"
                ],
                "proofPurpose": "capabilityDelegation",
                "proofValue": "z4oey5q2M3XKaxup3tmzN4DRFTLVqpLMweBrSxMY2xHX5XTYVQeVbY8nQAVHMrXFkXJpmEcqdoDwLWxaqA3Q1geV6",
                "verificationMethod": "https://example.com/i/alyssa/keys/1"
              }
            }
          ]
        }
      }
    ]
  }
}

Parsed, comments removed

{
  "@context": [
    "https://w3id.org/zcap/v1",
    "https://w3id.org/security/data-integrity/v2",
    "https://autopower.example/"
  ],
  "id": "https://chatty.example/ben/caps#2cdea8c1",
  "parentCapability": "https://social.example/alyssa/caps#79795d78",
  "controller": "https://lem.example/#key-bf36",
  "caveat": [
    {
      "type": "DriveNoMoreThan",
      "kilometers": 123859
    }
  ],
  "proof": {
    "type": "DataIntegrityProof",
    "cryptosuite": "eddsa-jcs-2022",
    "proofPurpose": "capabilityDelegation",
    "created": "2017-06-13T19:15:03Z",
    "verificationMethod": "https://chatty.example/ben/#key-33",
    "proofValue": "...",
    "capabilityChain": [
      "urn:zcap:root:https%3A%2F%2Fwhatacar.example%2Fa-fancy-car",
      "https://whatacar.example/a-fancy-car/proc/7a397d7b",
      {
        "@context": [
          "https://w3id.org/zcap/v1",
          "https://autopower.example/"
        ],
        "id": "https://social.example/alyssa/caps#79795d78",
        "parentCapability": "https://whatacar.example/a-fancy-car/proc/7a397d7b",
        "controller": "https://chatty.example/ben/#key-33",
        "caveat": [
          {
            "type": "ValidWhileTrue",
            "uri": "https://social.example/alyssa/ben-can-still-drive"
          }
        ],
        "proof": {
          "type": "DataIntegrityProof",
          "cryptosuite": "eddsa-jcs-2022",
          "proofPurpose": "capabilityDelegation",
          "created": "2017-03-28T06:01:25Z",
          "verificationMethod": "https://social.example/alyssa/#key-for-car",
          "proofValue": "...",
          "capabilityChain": [
            "urn:zcap:root:https%3A%2F%2Fwhatacar.example%2Fa-fancy-car",
            {
              "@context": [
                "https://w3id.org/zcap/v1",
                "https://w3id.org/security/suites/ed25519-2020/v1",
                "https://autopower.example/"
              ],
              "id": "https://whatacar.example/a-fancy-car/proc/7a397d7b",
              "parentCapability": "urn:zcap:root:https%3A%2F%2Fwhatacar.example%2Fa-fancy-car",
              "controller": "https://social.example/alyssa#key-for-car",
              "proof": {
                "type": "DataIntegrityProof",
                "cryptosuite": "eddsa-jcs-2022",
                "created": "2018-02-13T21:26:08Z",
                "capabilityChain": [
                  "urn:zcap:root:https%3A%2F%2Fwhatacar.example%2Fa-fancy-car"
                ],
                "proofPurpose": "capabilityDelegation",
                "proofValue": "z4oey5q2M3XKaxup3tmzN4DRFTLVqpLMweBrSxMY2xHX5XTYVQeVbY8nQAVHMrXFkXJpmEcqdoDwLWxaqA3Q1geV6",
                "verificationMethod": "https://example.com/i/alyssa/keys/1"
              }
            }
          ]
        }
      }
    ]
  }
}

example-6: Root capability

application/json · View in the spec

The start of a capability chain. It carries no proof: its authority comes from the invocation target recognizing the controller.

Id: urn:zcap:root:https%3A%2F%2Fexample.com%2Ffoo
Invocation target: https://example.com/foo
Controller: did:key:example

Source

{
  "@context": "https://w3id.org/zcap/v1",
  "id": "urn:zcap:root:https%3A%2F%2Fexample.com%2Ffoo",
  "controller": "did:key:example",
  "invocationTarget": "https://example.com/foo"
}

example-7: Root capability

application/jsonc · View in the spec

The start of a capability chain. It carries no proof: its authority comes from the invocation target recognizing the controller.

Id: urn:zcap:root:https%3A%2F%2Ffoo.example%2Fcollections%2F123
Invocation target: https://foo.example/collections/123
Controller: did:key:example

Source

{
  "@context": "https://w3id.org/zcap/v1",
  "id": "urn:zcap:root:https%3A%2F%2Ffoo.example%2Fcollections%2F123",
  // populated via a database or external system call
  "controller": "did:key:example",
  "invocationTarget": "https://foo.example/collections/123"
}

Parsed, comments removed

{
  "@context": "https://w3id.org/zcap/v1",
  "id": "urn:zcap:root:https%3A%2F%2Ffoo.example%2Fcollections%2F123",
  "controller": "did:key:example",
  "invocationTarget": "https://foo.example/collections/123"
}

example-8: Delegated capability

application/json · View in the spec

A capability derived from a parent, granting authority to a new controller and signed with a capabilityDelegation proof.

Id: urn:uuid:cdc77118-6bfa-11ec-aceb-10bf48838a41
Parent capability: urn:zcap:root:https%3A%2F%2Fexample.com%2Ffoo
Controller: did:key:example
Invocation target: https://example.com/foo
Allowed actions: write, read
Expires: 2021-11-03T18:33:51Z
Delegated by: did:key:z6MkfWKcvBiKCfNgz5UUGseNt37t4dguEvFgJ9XvX2UV6zB9#z6MkfWKcvBiKCfNgz5UUGseNt37t4dguEvFgJ9XvX2UV6zB9
Capability chain length: 1

Source

{
  "@context": [
    "https://w3id.org/zcap/v1",
    "https://w3id.org/security/data-integrity/v2"
  ],
  "id": "urn:uuid:cdc77118-6bfa-11ec-aceb-10bf48838a41",
  "parentCapability": "urn:zcap:root:https%3A%2F%2Fexample.com%2Ffoo",
  "controller": "did:key:example",
  "invocationTarget": "https://example.com/foo",
  "expires": "2021-11-03T18:33:51Z",
  "allowedAction": [
    "write",
    "read"
  ],
  "proof": {
    "type": "DataIntegrityProof",
    "cryptosuite": "eddsa-jcs-2022",
    "created": "2021-10-27T18:33:51Z",
    "capabilityChain": [
      "urn:zcap:root:https%3A%2F%2Fexample.com%2Ffoo"
    ],
    "proofPurpose": "capabilityDelegation",
    "proofValue": "z3t9BCQyF21MDVYmLKc9zbLreqx4wBtQnUsd5aqyoWS5FfhapRz7QjPNLcgKAornUVmJR4ZjbGpuxRFnffxX1ZjtF",
    "verificationMethod": "did:key:z6MkfWKcvBiKCfNgz5UUGseNt37t4dguEvFgJ9XvX2UV6zB9#z6MkfWKcvBiKCfNgz5UUGseNt37t4dguEvFgJ9XvX2UV6zB9"
  }
}

example-9: HTTP capability invocation

message/http · View in the spec

An HTTP request that invokes a capability via the Capability-Invocation header and an HTTP Message Signature.

Request line: POST /api/v1/example HTTP/1.1
Headers: Host, Date, Content-Type, Capability-Invocation, Content-Digest, Signature-Input, Signature

Source

POST /api/v1/example HTTP/1.1
Host: example.com
Date: Tue, 25 Aug 2026 00:00:00 GMT
Content-Type: application/json
Capability-Invocation: zcap capability={base64url(gzip(json(capability)))}
Content-Digest: sha-256=:y6p4T1s616oH+n04bZ9NzPzqB2qR+B/T3V7V9XN6b4Y=:
Signature-Input: zcap=("@method" "@path" "capability-invocation" "content-digest" "content-type");alg="ed25519";created=1798294620;keyid="did:example:alice#key-1"
Signature: zcap=:m28+dfHk1Pq6VvKxFxX9Q9zNz98bX5cKldP1M0zNzM3NzUzNzdXNzr1PzM3NzUzNzUzNzr1PzM3NzUzNzUzNzM3NzA==:

{"type":"ExampleApiAction"}

example-10: HTTP capability invocation

message/http · View in the spec

An HTTP request that invokes a capability via the Capability-Invocation header and an HTTP Message Signature, sent as trailers after a chunked body.

Request line: POST /api/v1/example HTTP/1.1
Headers: Host, Date, Content-Type, TE, Trailer, Transfer-Encoding
Trailers: Capability-Invocation, Content-Digest, Signature-Input, Signature

Source

POST /api/v1/example HTTP/1.1
Host: example.com
Date: Tue, 25 Aug 2026 00:00:00 GMT
Content-Type: application/json
TE: trailers
Trailer: Capability-Invocation, Content-Digest, Signature-Input, Signature
Transfer-Encoding: chunked

1B
{"type":"ExampleApiAction"}
0
Capability-Invocation: zcap capability={base64url(gzip(json(capability)))}
Content-Digest: sha-256=:y6p4T1s616oH+n04bZ9NzPzqB2qR+B/T3V7V9XN6b4Y=:
Signature-Input: zcap=("@method" "@path" "capability-invocation" "content-digest" "content-type");alg="ed25519";created=1798294620;keyid="did:example:alice#key-1"
Signature: zcap=:m28+dfHk1Pq6VvKxFxX9Q9zNz98bX5cKldP1M0zNzM3NzUzNzdXNzr1PzM3NzUzNzUzNzr1PzM3NzUzNzUzNzM3NzA==:

example-11: Capability invocation

application/json · View in the spec

A request to exercise a capability, proven with a capabilityInvocation proof that references the capability being used.

Invocation id: urn:uuid:394a2467-bd2e-4d39-9e42-d1881737f82e
Action: Drive
Invocation target: https://whatacar.example/a-fancy-car
Capability invoked: https://whatacar.example/a-fancy-car/proc/7a397d7b
Signed by: https://social.example/alyssa/#key-for-car
Cryptosuite: eddsa-jcs-2022

Source

{
  "id": "urn:uuid:394a2467-bd2e-4d39-9e42-d1881737f82e",
  "proof": {
    "type": "DataIntegrityProof",
    "proofPurpose": "capabilityInvocation",
    "cryptosuite": "eddsa-jcs-2022",
    "invocationTarget": "https://whatacar.example/a-fancy-car",
    "capabilityAction": "Drive",
    "capability": {
      "id": "https://whatacar.example/a-fancy-car/proc/7a397d7b",
      "parentCapability": "urn:zcap:root:https%3A%2F%2Fwhatacar.example%2Fa-fancy-car",
      "controller": "https://social.example/alyssa#key-for-car",
      "invocationTarget": "https://whatacar.example/a-fancy-car",
      "proof": {
        "type": "DataIntegrityProof",
        "created": "2018-02-13T21:26:08Z",
        "cryptosuite": "eddsa-jcs-2022",
        "capabilityChain": [
          "urn:zcap:root:https%3A%2F%2Fwhatacar.example%2Fa-fancy-car"
        ],
        "proofPurpose": "capabilityDelegation",
        "proofValue": "z2YwC8z3ap7yx1nZYCg4L3j3ApHsF8kgPdSb5xoS1VR7vPG3F561B52hYnQF9iseabecm3ijx4K1FBTQsCZahKZme",
        "verificationMethod": "https://example.com/i/alice/keys/1"
      },
      "@context": [
        "https://w3id.org/zcap/v1",
        "https://w3id.org/security/data-integrity/v2",
        "https://autopower.example/"
      ]
    },
    "created": "2016-02-08T17:13:48Z",
    "verificationMethod": "https://social.example/alyssa/#key-for-car",
    "proofValue": "..."
  },
  "@context": [
    "https://w3id.org/zcap/v1",
    "https://w3id.org/security/data-integrity/v2",
    "https://autopower.example/"
  ]
}