Package: aries-cloudagent
Hyperledger Aries Cloud Agent - PythonAn easy to use Aries agent for building SSI services using any language that supports sending/receiving HTTP requests.Full access to an organized set of all of the ACA-Py documents is available athttps://aca-py.org.
Check it out! It's much easier to navigate than finding all the documentation here.OverviewHyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building Verifiable Credential (VC) ecosystems. It operates in the second and third layers of theTrust Over IP framework (PDF)usingDIDComm messagingandHyperledger Ariesprotocols. The "cloud" in the name means that ACA-Py runs on servers (cloud, enterprise, IoT devices, and so forth), and is not designed to run on mobile devices.ACA-Py is built on the Aries concepts and features that make upAries Interop Profile (AIP) 1.0, and most of the features inAIP 2.0.ACA-Py’s supported Aries protocolsinclude, most importantly, protocols for issuing, verifying, and holding verifiable credentials using bothHyperledger AnonCredsverifiable credential format, and theW3C Standard Verifiable Credentialformat using JSON-LD with LD-Signatures and BBS+ Signatures.To use ACA-Py you create a business logic controller that "talks to" ACA-Py (sending HTTP requests and receiving webhook notifications), and ACA-Py handles the Aries and DIDComm functionality. That controller can be built in any language that supports making and receiving HTTP requests; knowledge of Python is not needed. Together, this means you can focus on building VC solutions using familiar web development technologies, instead of having to learn the nuts and bolts of low-level cryptography and Trust over IP-type Aries protocols.Thischecklist-style overview documentprovides a full list of the features in ACA-Py.
The following is a list of some of the core features needed for a production deployment, with a link to detailed information about the capability.Multi-TenantACA-Py supports "multi-tenant" scenarios. In these scenarios, one (scalable) instance of ACA-Py uses one database instance, and are together capable of managing separate secure storage (for private keys, DIDs, credentials, etc.) for many different actors. This enables (for example) an "issuer-as-a-service", where an enterprise may have many VC issuers, each with different identifiers, using the same instance of ACA-Py to interact with VC holders as required. Likewise, an ACA-Py instance could be a "cloud wallet" for many holders (e.g. people or organizations) that, for whatever reason, cannot use a mobile device for a wallet. Learn more about multi-tenant deploymentshere.Mediator ServiceStartup options allow the use of an ACA-Py as an Ariesmediatorusing core Aries protocols to coordinate its mediation role. Such an ACA-Py instance receives, stores and forwards messages to Aries  agents that (for example) lack an addressable endpoint on the Internet such as a mobile wallet. A live instance of a public mediator based on ACA-Py is availableherefrom Indicio Technologies. Learn more about deploying a mediatorhere. See theAries Mediator Servicefor a "best practices" configuration of an Aries mediator.Indy Transaction EndorsingACA-Py supports a Transaction Endorsement protocol, for agents that don't have write access to an Indy ledger.  Endorser support is documentedhere.Scaled DeploymentsACA-Py supports deployments in scaled environments such as in Kubernetes environments where ACA-Py and its storage components can be horizontally scaled as needed to handle the load.Example UsesThe business logic you use with ACA-Py is limited only by your imagination. Possible applications include:An interface to a legacy system to issue verifiable credentialsAn authentication service based on the presentation of verifiable credential proofsAn enterprise wallet to hold and present verifiable credentials about that enterpriseA user interface for a person to use a wallet not stored on a mobile deviceAn application embedded in an IoT device, capable of issuing verifiable credentials about collected dataA persistent connection to other agents that enables secure messaging and notificationsCustom code to implement a new service.Getting StartedFor those new to SSI, Aries and ACA-Py, there are a couple of Linux Foundation edX courses that provide a good starting point.Identity in Hyperledger: Indy, Aries and UrsaBecoming a Hyperledger Aries DeveloperThe latter is the most useful for developers wanting to get a solid basis in using ACA-Py and other Aries Frameworks.Also included here is a much more concise (but less maintained)Getting Started Guidethat will take you from knowing next to nothing about decentralized identity to developing Aries-based business apps and services. You’ll run some Indy apps, ACA-Py apps and developer-oriented demos. The guide has a table of contents so you can skip the parts you already know.Understanding the ArchitectureThere is anarchitectural deep dive webinarpresented by the ACA-Py team, andslides from the webinarare also available. The picture below gives a quick overview of the architecture, showing an instance of ACA-Py, a controller and the interfaces between the controller and ACA-Py, and the external paths to other agents and public ledgers on the Internet.You can extend Aca-Py using plug-ins, which can be loaded at runtime.  Plug-ins are mentioned in thewebinarand aredescribed in more detail here.Installation and UsageAn"install and go" page for developersis available if you are comfortable with Trust over IP and Aries concepts. ACA-Py can be run with Docker without installation (highly recommended), or can be installedfrom PyPi. In the/demo directorythere is a full set of demos for developers to use in getting started, and thedemo read meis a great starting point for developers to use an "in-browser" approach to run a zero-install example. TheRead the Docsoverview is also a way to reference the modules and APIs that make up an ACA-Py instance.If you would like to develop on ACA-Py locally note that we use Poetry for dependency management and packaging, if you are unfamiliar with poetry please see ourcheat sheetAbout the ACA-Py Admin APITheoverview of ACA-Py’s APIis a great starting place for learning about the ACA-Py API when you are starting to build your own controller.An ACA-Py instance puts together an OpenAPI-documented REST interface based on the protocols that are loaded. This is used by a controller application (written in any language) to manage the behaviour of the agent. The controller can initiate actions (e.g. issuing a credential) and can respond to agent events (e.g. sending a presentation request after a connection is accepted). Agent events are delivered to the controller as webhooks to a configured URL.Technical note: the administrative API exposed by the agent for the controller to use must be protected with an API key (using the --admin-api-key command line arg) or deliberately left unsecured using the --admin-insecure-mode command line arg. The latter should not be used other than in development if the API is not otherwise secured.TroubleshootingThere are a number of resources for getting help with ACA-Py and troubleshooting
any problems you might run into. TheTroubleshootingdocument contains some guidance about issues that have been experienced in the
past. Feel free to submit PRs to supplement the troubleshooting document!
Searching theACA-Py GitHub
issueswill
often uncover challenges that others have experienced, often with answers to
solving those challenges. As well, there is the "aries-cloudagent-python"
channel on the Hyperledger Discord chat server (invitation
here).CreditThe initial implementation of ACA-Py was developed by the Government of British Columbia’s Digital Trust Team in Canada. To learn more about what’s happening with decentralized identity and digital trust in British Columbia, checkout theBC Digital Trustwebsite.See theMAINTAINERS.mdfile for a list of the current ACA-Py
maintainers, and the guidelines for becoming a Maintainer. We'd love to have you
join the team if you are willing and able to carry out theduties of a
Maintainer.ContributingPull requests are welcome! Please read ourcontributions guideand submit your PRs. We enforcedeveloper certificate of origin(DCO) commit signing —guidanceon this is available. We also welcome issues submitted about problems you encounter in using ACA-Py.LicenseApache License Version 2.0