Agent Enrollment Protocol for Java

Official Java software development kit for the Agent Enrollment Protocol, the open protocol for Agent enrollment, Service-issued credentials, and authenticated Agent access.

Modules

Goal	Module
Align compatible AEP dependency versions	aep-bom
Use protocol contracts and validation directly	aep-core
Inspect, enroll with, authenticate to Services, and use hosted identities	aep-agent
Integrate enrollment into a Service	aep-service
Expose a Service with the JDK HTTP server	aep-httpserver
Expose a Service with Jakarta Servlet	aep-servlet
Expose a Service with Spring Web MVC	aep-spring-webmvc
Host managed Agent identities	aep-platform
Integrate with Jackson 2	aep-json-jackson2
Integrate with Jackson 3	aep-json-jackson3

All artifacts use Maven group foundation.aep, require Java 17 or newer, and share one release version. Role modules depend on Core. Shared Platform wire contracts belong to Core, while Agent and Platform remain sibling modules. Framework integrations, persistence, and key custody stay outside Core.

Installation

Import aep-bom once to keep every AEP module on a compatible version:

<dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>foundation.aep</groupId>
      <artifactId>aep-bom</artifactId>
      <version>0.1.1</version>
      <type>pom</type>
      <scope>import</scope>
    </dependency>
  </dependencies>
</dependencyManagement>

<dependencies>
  <dependency>
    <groupId>foundation.aep</groupId>
    <artifactId>aep-agent</artifactId>
  </dependency>
  <dependency>
    <groupId>foundation.aep</groupId>
    <artifactId>aep-json-jackson2</artifactId>
  </dependency>
</dependencies>

Gradle can import the same BOM as a platform:

implementation(platform("foundation.aep:aep-bom:0.1.1"))
implementation("foundation.aep:aep-agent")
implementation("foundation.aep:aep-json-jackson2")

The BOM is optional. Applications that do not use dependency management can put the same version on each AEP dependency directly:

<dependency>
  <groupId>foundation.aep</groupId>
  <artifactId>aep-agent</artifactId>
  <version>0.1.1</version>
</dependency>

The BOM aligns AEP module versions; it does not add dependencies to an application. Select exactly one JSON provider explicitly:

• aep-json-jackson2 for an application using Jackson 2
• aep-json-jackson3 for an application using Jackson 3

AepJson fails during initialization when it finds zero providers or more than one provider. The framework adapter does not choose a JSON provider for the application.

aep-spring-webmvc supports Spring Framework 6 and 7 from one artifact. It exchanges raw bytes with Spring and delegates AEP serialization to the selected AepJson provider, keeping the framework generation and Jackson generation as explicit application choices.

Start with the examples

The examples module contains two programs that run as part of the Maven reactor:

• an Agent and a JDK HTTP Service that complete Inspect, Enroll, API-key Grant, protected-resource authentication, and Revoke operations with required claim values;
• an ephemeral Platform that provisions a Service-scoped Agent identity and signs a client assertion with application-owned key custody.

Run both programs from a clean checkout:

./mvnw -pl examples -am verify

The examples use process-local state and loopback HTTP so the complete flow is runnable without external infrastructure. Follow the role-module guides before replacing those development boundaries in a production application.

Development

The Maven Wrapper provides the complete repository gate:

./mvnw verify
./scripts/verify-consumer.sh

The shared Agent, Service, Platform, and credential-profile conformance reports can be generated against a local aep-specs checkout:

./scripts/run-conformance.sh

Set AEP_SPECS_DIR when the specifications repository is not located at ../aep-specs. Reports are written to .conformance/reports/.

Format Java sources with:

./mvnw spotless:apply

See DEVELOPMENT.md for repository conventions and aep-specs for the normative drafts, schemas, registries, examples, and test vectors.

Security

See SECURITY.md for vulnerability reporting.

License

MIT.