Cross-Chain Identity Contracts
The Cross-Chain Identity contracts manage identity registries and credential lifecycles for ACE. They depend on the Policy Management contracts — registries are owned and governed by a PolicyEngine. The source code and full documentation are available in the cross-chain-identity package of the chainlink-ace repository (Business Source License 1.1).
Core interfaces
Interface | Description |
|---|---|
| IIdentityRegistry | Maps wallet addresses to Cross-Chain Identifiers (CCIDs). Supports registering and removing address-to-CCID mappings, and looking up the CCID for a given address or all addresses for a given CCID. |
| ICredentialRegistry | Manages the lifecycle of credentials linked to a CCID — registration, renewal, removal, and expiration checks. Each credential is identified by a credentialTypeId (a keccak256 hash of the credential type string). |
| ICredentialRequirements | Defines which credentials a policy requires, which registries to check, and how many validations must pass. Supports complex rules via credential sources, minimum validation thresholds, and inverted checks. |
| IIdentityValidator | Validates whether an account meets all configured credential requirements. Used by the CredentialRegistryIdentityValidatorPolicy to check identities during policy evaluation. |
| ICredentialValidator | Validates whether specific credentials exist and are valid for a given CCID. Provides both single-credential and batch validation functions. |
| ICredentialDataValidator | Optional interface for inspecting the contents of a credential's credentialData field. Enables granular, data-level checks beyond simple attestation (e.g., verifying a specific claim within the credential payload). |
| ITrustedIssuerRegistry | Manages the list of trusted credential issuers — addresses authorized to register and manage credentials in a credential registry. |
Data validators
Data validators inspect the contents of a credential's credentialData field, enabling checks beyond simple attestation (for example, a jurisdiction allow/deny list). They are attached to a Credential Source and invoked by the identity validator policies after the credential's existence is confirmed. Data validators are a curated catalog maintained by Chainlink — see Beta Scope for details.
Contract | Description |
|---|---|
| AllowDenyListDataValidator | Pre-built ICredentialDataValidator that validates a bytes32[] credential payload against an allowlist and denylist, with optional restriction by credential type. Used for jurisdiction control (ISO 3166-1 alpha-2 country codes). Configuration is versioned for optimistic concurrency. |
| DataValidatorFactory | Deploys deterministic data validator instances (minimal-proxy clones or ERC-1967 proxies) from an implementation, with create and idempotent getOrCreate variants. Verifies the implementation supports the required interfaces via ERC-165. |
| IInitializableDataValidator | Minimal initializer surface (initialize(initialOwner, configData)) implemented by data validators so the factory can deploy and configure them in one step. |
Repository documentation
The cross-chain-identity docs folder contains detailed guides:
- Concepts — CCID model, credential type IDs, privacy, and design rationale
- API Guide — Deploy registries, configure validator policies, and authorize issuers
- API Reference — Complete interface specifications with function signatures, events, and errors
- Credential Flow — End-to-end lifecycle from issuance to validation
- Security Considerations — Issuer trust, PII handling, CCID correlation, and non-reverting requirements
Related pages
- Cross-Chain Identity — Conceptual overview of CCIDs, registries, and credential sources
- Credential Registry Identity Validator Policy — The policy that checks credentials at transaction time