Supported Access Control Lists (ACLs)

List of supported access control lists (ACLs) of DIDComm Mediator.

Access Control Lists (ACLs) control which DIDs can send and receive messages through your DIDComm Mediator.

Important Note

You can only update DID-level Access Control Lists (ACLs) on self-hosted DIDComm Mediators.

Mediator-level ACLs

ACL Flag	Description
explicit_deny	Open mediator. Any DID may authenticate. Unknown DIDs are auto-registered with the `global_acl_default` policy. What each DID can then do is controlled by the DID-level ACLs.
explicit_allow	Closed mediator. Only pre-registered DIDs may authenticate. Unknown DIDs are rejected at authentication. Only admins may add new accounts.
local_direct_delivery_allowed	If set to `true`, messages may be addressed directly to a local DID without mediator routing. If set to `false`, all messages must be addressed to the mediator, which handles delivery.

To configure the mediator-level ACL, edit conf/mediator.toml and restart the mediator.

DID-level ACLs

DID-level ACLs define what each DID can store, send, or receive. New DIDs receive the global_acl_default policy unless an admin sets custom ACLs.

Send and receive messages

ACL flags provide granular control over whether a DID can send or receive messages.

ACL Flag	Description
ALLOW_ALL	Grants all capabilities, all self-change bits, all self-management rights, and sets the DID’s inbox mode to explicit_deny (open inbox).
DENY_ALL	Denies all capabilities, all self-change bits, and sets the DID’s inbox mode to explicit_allow (closed inbox).
MODE_EXPLICIT_ALLOW	Sets the DID’s inbox to allowlist mode. Messages are only delivered from senders on the DID’s allowlist. An empty allowlist rejects all senders.
MODE_EXPLICIT_DENY	Sets the DID’s inbox to denylist mode. Messages are allowed from all senders unless the sender is on the DID’s denylist.
LOCAL	Grants the DID an inbox for message storage, fetch, and WebSocket access.
SEND_MESSAGES	DID can send messages to others.
RECEIVE_MESSAGES	DID can receive messages from others.
SEND_FORWARDED	DID can send forwarded messages.
RECEIVE_FORWARDED	DID can receive forwarded messages.
ANON_RECEIVE	DID can receive messages from anonymous senders.
CREATE_INVITES	DID can create OOB invites.

Self-change flags

These allow users to update ACLs for their own DID without administrator intervention. Useful in open network modes where users need control over their permissions.

This flag is useful if you want to provide a level of control for the user to update their ACL when needed - for example, in the Public Mediator - Open Network operating mode.

ACL Flag	Description
MODE_SELF_CHANGE	Allows the DID owner to change the ACL Mode for their own DID Access Control List.
ALLOW_ALL_SELF_CHANGE	Allows all *_SELF_CHANGE flags (explicitly set when ALLOW_ALL is set).
DENY_ALL_SELF_CHANGE	Denies all *_SELF_CHANGE flags (explicitly set when DENY_ALL is set).
SEND_MESSAGES_CHANGE	Allows the DID owner to change the send_messages ACL for their own DID.
RECEIVE_MESSAGES_CHANGE	Allows the DID owner to change the receive_messages ACL for their own DID.
SEND_FORWARDED_CHANGE	Allows the DID owner to change the send_forwarded ACL for their own DID.
RECEIVE_FORWARDED_CHANGE	Allows the DID owner to change the receive_forwarded ACL for their own DID.
CREATE_INVITES_CHANGE	Allows the DID owner to change the create_invites ACL for their own DID.
ANON_RECEIVE_CHANGE	Allows the DID owner to change the anon_receive ACL for their own DID.
SELF_MANAGE_LIST	DID can self manage their own ACL list (add/remove).
SELF_MANAGE_SEND_QUEUE_LIMIT	DID can set their send queue limits (between the queued_messages_soft and queued_messages_hard).
SELF_MANAGE_RECEIVE_QUEUE_LIMIT	DID can set their receive queue limits (between the queued_messages_soft and queued_messages_hard).

What’s next

Was this page helpful?

Glad to hear it! Please tell us how we can improve more.

Sorry to hear that. Please tell us how we can improve.

Thank you for sharing your feedback so we can improve your experience.