[a]authored byinflow
SDKs

Java SDK

Use the official Java modules to call AEP Services as an Agent, enroll Agents at a Service, or host Agent identities on an optional Platform.

Source, integration guides, and runnable examples are in the aep-java GitHub repository. Published artifacts use the foundation.aep Maven Central namespace. AEP integration does not require an InFlow account.

Choose modules by role

The Java SDK separates protocol contracts, Agent behavior, Service behavior, hosted identity, JSON serialization, and HTTP adapters. Add the role modules your application uses; the Bill of Materials manages their versions but does not install them.

ArtifactUse it for
aep-coreProtocol models, validation, identity assertions, and shared wire contracts.
aep-agentInspect, Enroll, Status, Grant, Revoke, credential storage, and protected-resource authentication as an Agent.
aep-serviceInspect publication, command handling, assertion verification, credential issuance, and resource authentication.
aep-platformOptional hosted identity provisioning, delegated signing, and Platform lifecycle operations.
aep-httpserver, aep-servlet, aep-spring-webmvcExpose a Service through the JDK HTTP server, Jakarta Servlet, or Spring Web MVC.

Install compatible dependencies and one JSON provider

The artifacts require Java 17 or newer and share a release version. This Maven example imports aep-bom and selects the Agent role with Jackson 2. It uses version 0.1.1; use the released version you choose consistently across your AEP modules. Gradle can import the same BOM as a platform.

<dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>foundation.aep</groupId>
      <artifactId>aep-bom</artifactId>
      <version>0.1.1</version>
      <type>pom</type>
      <scope>import</scope>
    </dependency>
  </dependencies>
</dependencyManagement>

<dependencies>
  <dependency>
    <groupId>foundation.aep</groupId>
    <artifactId>aep-agent</artifactId>
  </dependency>
  <dependency>
    <groupId>foundation.aep</groupId>
    <artifactId>aep-json-jackson2</artifactId>
  </dependency>
</dependencies>

The BOM only supplies versions for AEP modules that you declare. It neither adds a JSON provider nor selects Jackson for your application. Choose exactly one of aep-json-jackson2 and aep-json-jackson3 to match your application's Jackson generation; AepJson fails initialization if it finds neither or both. Applications without a BOM can specify the same version directly on every AEP dependency. See the repository's installation guide for complete Maven and Gradle forms.

Supply an Agent transport and identity provider

AepAgent.builder() requires an HTTP transport and an identity provider that returns a Service-scoped Agent identity and signs operation-bound assertions. Your application supplies these boundaries and, in production, durable identity and credential stores. The Agent session then inspects the Service, collects advertised Claims, enrolls, checks Status, and may request an advertised credential through Grant. The Agent module guide shows the APIs and optional hosted identity provider.

A successful Enroll call can still leave the Agent pending. Check the returned state or use waitForActive when the Service requires asynchronous approval. Built-in handlers store and present API-key, OAuth Bearer, and Basic credentials; a custom Grant Type needs its own handler. Start with the Agent and Service example, which includes a real JDK HTTP transport, assertion signing, required Claims, Grant, authenticated resource access, and Revoke.

Build a Service, then expose its HTTP routes

aep-service takes an Inspect document, assertion verifier, enrollment policy, and stores. AepServiceHttpHandler provides the shared command boundary; choose aep-httpserver for the JDK server, aep-servlet for Jakarta Servlet, or aep-spring-webmvc for Spring Web MVC. The adapter mounts AEP routes. Your protected application routes must still authenticate the Agent and apply application authorization. Follow the Service module guide for the Service contract and the chosen adapter guide for framework wiring.

Before deploying to production

The examples use process-local state. Production Services need durable enrollment, credential, and idempotency stores and an assertion replay store whose consume operation is atomic across instances. A Service must not accept the same assertion twice during a concurrent replay or execute an idempotent command twice. The Accept enrollment and status page explains the protocol behavior these stores protect.

Keep framework and hosted-identity choices separate

One aep-spring-webmvc artifact supports Spring Framework 6 and 7. The adapter exchanges raw bytes with Spring and delegates AEP JSON to the selected provider. The application chooses its compatible Spring, Servlet, and Jackson generations; the AEP BOM does not make those choices. The Spring adapter guide states the supported combinations.

An Agent can call a hosted Platform through PlatformIdentityProvider instead of holding its own signing key. Implementing a Platform is a different role handled by aep-platform and requires application-owned authorization, storage, and key custody. The repository's Platform example demonstrates provisioning and signing with development-only state.

On this page