How openziti/ziti-sdk-c works
OpenZiti C SDK embeds zero-trust service connectivity in client and host applications. The main workflow is to initialize an identity context, authenticate it, then dial or bind an authorized service and exchange data over an SDK connection; applications can also use the higher-level socket-compatible API. Authentication includes certificate, MFA, and external OIDC flows, while posture collection feeds authorization checks. The graph preserves these documented capabilities and the controller, edge transport, and encryption layers. Some subsystem wiring is based on documented behavior and module names; unsampled implementation details are left unlinked.
Main entry points: ziti.c Identity Context · channel.c Edge Channel · connect.c Service Dial · bind.c Service Bind
Components 23
SDK Runtime
- Public SDK API
includes/ziti/ziti.h - Identity Context
library/ziti.c - Controller Client
library/ziti_ctrl.c - Identity Config
library/config.c - Metrics
library/metrics.c
Identity Security
- Enrollment
library/ziti_enroll.c - Authentication
library/authenticators.c - Legacy Auth
library/legacy_auth.c - OIDC Auth
library/oidc.c - External Login
library/external_auth.c - Posture Checks
library/posture.c
Service Connectivity
- Service Dial
library/connect.c - Service Bind
library/bind.c - Edge Channel
library/channel.c - Edge Protocol
library/edge_protocol.c - End-to-End Encryption
library/e2ee/e2ee_common.h
Socket API
- Socket Facade
library/zitilib/zitilib.c - Socket Dial
library/zitilib/zl_connect.c - Socket Bind
library/zitilib/zl_bind.c
Other components
- Application
- Ziti Controller
- Edge Router
- Socket Application
Connections 27
- Application → Public SDK API: calls
- Public SDK API → Identity Context: initializes
- Identity Context → Identity Config: loads
- Identity Context → Controller Client: uses
- Controller Client → Ziti Controller: exchanges API data
- Identity Context → Enrollment: enrolls identity
- Identity Context → Authentication: authenticates
- Authentication → Legacy Auth: selects method
- Authentication → OIDC Auth: selects method
- Identity Context → External Login: starts external login
- Identity Context → Posture Checks: collects posture
- Posture Checks → Controller Client: submits responses
- Application → Service Dial: dials service
- Application → Service Bind: binds service
- Identity Context → Service Dial: provides identity
- Identity Context → Service Bind: provides identity
- Service Dial → Edge Channel: opens connection
- Service Bind → Edge Channel: opens listener
- Edge Channel → Edge Protocol: frames traffic
- Edge Channel → Edge Router: exchanges traffic
- Edge Channel → End-to-End Encryption: encrypts data
- Socket Application → Socket Facade: uses sockets
- Socket Facade → Socket Dial: dispatches dial
- Socket Facade → Socket Bind: dispatches bind
- Socket Dial → Service Dial: calls
- Socket Bind → Service Bind: calls
- Identity Context → Metrics: records metrics