Identity element
The Identity element extracts an agent DID from the pipeline at the edge where identity evidence is available. Drop it on the edge that corresponds to the identity slot you want to populate. One surface can hold multiple Identity elements at different edges.
Placement slots
| Edge | Identity slot | What it resolves |
|---|---|---|
| Caller → Access Point (request) | Inbound caller identity | DID of the incoming caller. |
| Access Point → Caller (response) | Protected agent identity | DID of the managed agent responding to the caller. |
| External Target → Managed Agent (response) | External agent identity | DID of the external upstream the managed agent calls out to. |
| Managed Agent → Transit Point (request) | Outbound managed-agent identity | DID of the managed agent for a specific transit point. Used by Workload Binding flows. |
When placed on a Managed Agent → Transit Point edge, only the From Payload (identity metadata) extraction type is available.
Identity Extraction Type
Select the type using the Identity Extraction Type dropdown. Type-specific fields appear below once a type is selected.
| Type | Description |
|---|---|
| From Payload (identity metadata) | Reads identity claims from a named field in the payload body. |
| From API Key | Derives the agent DID from the configured API key. |
| From JWT Claims | Extracts the agent DID from a named claim in the JWT Bearer token. |
| Static DID | Uses a fixed, pre-known DID for all requests. Not currently available: visible but disabled. |
| From mTLS certificate | Derives the agent DID from the client certificate presented during the request. Not currently available: visible but disabled. |
Type: From Payload (identity metadata)
The sidebar panel shows a Configure Fields… button that opens the fullscreen editor. Configure dot-notation field paths and the JSON schema there. The sidebar also shows the current field count.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| Strip raw identity metadata after injection | toggle | No | Off | When on, removes the raw _meta.[field] from the request once the VP credential is injected. Not shown on A2A and AP2 surfaces. |
Type: From API Key
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| API Key | select | Yes | — | Active API key to derive the agent DID from. Populated from the gateway’s configured API keys. |
Type: From JWT Claims
Requires JWT Bearer caller authentication on this surface.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| JWT Claim | string | No | oid | JWT claim from which the DID is derived. |
| Namespace Claims | string, comma-separated | No | — | Additional claims that namespace the derived DID to ensure uniqueness, for example iss, tid. |
Type: Static DID
Static DID is visible in the type dropdown but is disabled and cannot be selected.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| Static DID | string | Yes | — | The pre-known DID to use as the agent identity for all requests. For example: did:web:example.com:agent:my-agent. |
Type: From mTLS certificate
From mTLS certificate is visible in the type dropdown but is disabled and cannot be selected.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| Client Certificate | select | Yes | — | Active client-leaf certificate to derive the agent DID from. Populated from the gateway’s configured certificates. |
Related
- Managed Agent reference: Send signed identity VP to target setting that uses the resolved identity.
- Transit Points reference: Identity on a Managed Agent to Transit Point edge.
Glad to hear it! Please tell us how we can improve more.
Sorry to hear that. Please tell us how we can improve.
Thank you for sharing your feedback so we can improve your experience.