# openziti/ziti-sdk-c architecture

> Architecture diagram of the GitHub repository openziti/ziti-sdk-c, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/openziti/ziti-sdk-c
- Repository: https://github.com/openziti/ziti-sdk-c

## Overview

OpenZiti C SDK embeds zero-trust service connectivity in client and host applications. The main workflow is to initialize an identity context, authenticate it, then dial or bind an authorized service and exchange data over an SDK connection; applications can also use the higher-level socket-compatible API. Authentication includes certificate, MFA, and external OIDC flows, while posture collection feeds authorization checks. The graph preserves these documented capabilities and the controller, edge transport, and encryption layers. Some subsystem wiring is based on documented behavior and module names; unsampled implementation details are left unlinked.

Main entry points: [`library/ziti.c`](https://github.com/openziti/ziti-sdk-c/blob/main/library/ziti.c) (Identity Context), [`library/channel.c`](https://github.com/openziti/ziti-sdk-c/blob/main/library/channel.c) (Edge Channel), [`library/connect.c`](https://github.com/openziti/ziti-sdk-c/blob/main/library/connect.c) (Service Dial), [`library/bind.c`](https://github.com/openziti/ziti-sdk-c/blob/main/library/bind.c) (Service Bind)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_runtime["SDK Runtime"]
  node_public_api["Public SDK API<br/>[ziti.h]"]
  node_context["Identity Context<br/>[ziti.c]"]
  node_controller["Controller Client<br/>[ziti_ctrl.c]"]
  node_config["Identity Config<br/>[config.c]"]
  node_metrics["Metrics<br/>[metrics.c]"]
end

subgraph group_identity["Identity Security"]
  node_enrollment["Enrollment<br/>[ziti_enroll.c]"]
  node_auth["Authentication<br/>[authenticators.c]"]
  node_legacy_auth["Legacy Auth<br/>[legacy_auth.c]"]
  node_oidc_auth["OIDC Auth<br/>[oidc.c]"]
  node_external_auth["External Login<br/>[external_auth.c]"]
  node_posture["Posture Checks<br/>[posture.c]"]
end

subgraph group_connectivity["Service Connectivity"]
  node_dial["Service Dial<br/>[connect.c]"]
  node_bind["Service Bind<br/>[bind.c]"]
  node_channel["Edge Channel<br/>[channel.c]"]
  node_edge_protocol["Edge Protocol<br/>[edge_protocol.c]"]
  node_e2ee["End-to-End Encryption<br/>[e2ee_common.h]"]
end

subgraph group_sockets["Socket API"]
  node_zitilib["Socket Facade<br/>[zitilib.c]"]
  node_zl_connect["Socket Dial<br/>[zl_connect.c]"]
  node_zl_bind["Socket Bind<br/>[zl_bind.c]"]
end

node_application(("Application"))
node_controller_service(("Ziti Controller"))
node_edge_router(("Edge Router"))
node_socket_app(("Socket Application"))

node_application -->|"calls"| node_public_api
node_public_api -->|"initializes"| node_context
node_context -->|"loads"| node_config
node_context -->|"uses"| node_controller
node_controller -->|"exchanges API data"| node_controller_service
node_context -->|"enrolls identity"| node_enrollment
node_context -->|"authenticates"| node_auth
node_auth -->|"selects method"| node_legacy_auth
node_auth -->|"selects method"| node_oidc_auth
node_context -->|"starts external login"| node_external_auth
node_context -->|"collects posture"| node_posture
node_posture -->|"submits responses"| node_controller
node_application -->|"dials service"| node_dial
node_application -->|"binds service"| node_bind
node_context -->|"provides identity"| node_dial
node_context -->|"provides identity"| node_bind
node_dial -->|"opens connection"| node_channel
node_bind -->|"opens listener"| node_channel
node_channel -->|"frames traffic"| node_edge_protocol
node_channel -->|"exchanges traffic"| node_edge_router
node_channel -->|"encrypts data"| node_e2ee
node_socket_app -->|"uses sockets"| node_zitilib
node_zitilib -->|"dispatches dial"| node_zl_connect
node_zitilib -->|"dispatches bind"| node_zl_bind
node_zl_connect -->|"calls"| node_dial
node_zl_bind -->|"calls"| node_bind
node_context -.->|"records metrics"| node_metrics

click node_public_api "https://github.com/openziti/ziti-sdk-c/blob/main/includes/ziti/ziti.h"
click node_context "https://github.com/openziti/ziti-sdk-c/blob/main/library/ziti.c"
click node_controller "https://github.com/openziti/ziti-sdk-c/blob/main/library/ziti_ctrl.c"
click node_config "https://github.com/openziti/ziti-sdk-c/blob/main/library/config.c"
click node_enrollment "https://github.com/openziti/ziti-sdk-c/blob/main/library/ziti_enroll.c"
click node_auth "https://github.com/openziti/ziti-sdk-c/blob/main/library/authenticators.c"
click node_legacy_auth "https://github.com/openziti/ziti-sdk-c/blob/main/library/legacy_auth.c"
click node_oidc_auth "https://github.com/openziti/ziti-sdk-c/blob/main/library/oidc.c"
click node_external_auth "https://github.com/openziti/ziti-sdk-c/blob/main/library/external_auth.c"
click node_posture "https://github.com/openziti/ziti-sdk-c/blob/main/library/posture.c"
click node_dial "https://github.com/openziti/ziti-sdk-c/blob/main/library/connect.c"
click node_bind "https://github.com/openziti/ziti-sdk-c/blob/main/library/bind.c"
click node_channel "https://github.com/openziti/ziti-sdk-c/blob/main/library/channel.c"
click node_edge_protocol "https://github.com/openziti/ziti-sdk-c/blob/main/library/edge_protocol.c"
click node_e2ee "https://github.com/openziti/ziti-sdk-c/blob/main/library/e2ee/e2ee_common.h"
click node_zitilib "https://github.com/openziti/ziti-sdk-c/blob/main/library/zitilib/zitilib.c"
click node_zl_connect "https://github.com/openziti/ziti-sdk-c/blob/main/library/zitilib/zl_connect.c"
click node_zl_bind "https://github.com/openziti/ziti-sdk-c/blob/main/library/zitilib/zl_bind.c"
click node_metrics "https://github.com/openziti/ziti-sdk-c/blob/main/library/metrics.c"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_public_api,node_context,node_controller,node_config,node_metrics toneBlue
class node_enrollment,node_auth,node_legacy_auth,node_oidc_auth,node_external_auth,node_posture toneAmber
class node_dial,node_bind,node_channel,node_edge_protocol,node_e2ee,node_edge_router toneMint
class node_zitilib,node_zl_connect,node_zl_bind toneRose
class node_application,node_controller_service,node_socket_app toneIndigo
```

## Components

### SDK Runtime

- [Public SDK API](https://github.com/openziti/ziti-sdk-c/blob/main/includes/ziti/ziti.h): `includes/ziti/ziti.h`
- [Identity Context](https://github.com/openziti/ziti-sdk-c/blob/main/library/ziti.c): `library/ziti.c`
- [Controller Client](https://github.com/openziti/ziti-sdk-c/blob/main/library/ziti_ctrl.c): `library/ziti_ctrl.c`
- [Identity Config](https://github.com/openziti/ziti-sdk-c/blob/main/library/config.c): `library/config.c`
- [Metrics](https://github.com/openziti/ziti-sdk-c/blob/main/library/metrics.c): `library/metrics.c`

### Identity Security

- [Enrollment](https://github.com/openziti/ziti-sdk-c/blob/main/library/ziti_enroll.c): `library/ziti_enroll.c`
- [Authentication](https://github.com/openziti/ziti-sdk-c/blob/main/library/authenticators.c): `library/authenticators.c`
- [Legacy Auth](https://github.com/openziti/ziti-sdk-c/blob/main/library/legacy_auth.c): `library/legacy_auth.c`
- [OIDC Auth](https://github.com/openziti/ziti-sdk-c/blob/main/library/oidc.c): `library/oidc.c`
- [External Login](https://github.com/openziti/ziti-sdk-c/blob/main/library/external_auth.c): `library/external_auth.c`
- [Posture Checks](https://github.com/openziti/ziti-sdk-c/blob/main/library/posture.c): `library/posture.c`

### Service Connectivity

- [Service Dial](https://github.com/openziti/ziti-sdk-c/blob/main/library/connect.c): `library/connect.c`
- [Service Bind](https://github.com/openziti/ziti-sdk-c/blob/main/library/bind.c): `library/bind.c`
- [Edge Channel](https://github.com/openziti/ziti-sdk-c/blob/main/library/channel.c): `library/channel.c`
- [Edge Protocol](https://github.com/openziti/ziti-sdk-c/blob/main/library/edge_protocol.c): `library/edge_protocol.c`
- [End-to-End Encryption](https://github.com/openziti/ziti-sdk-c/blob/main/library/e2ee/e2ee_common.h): `library/e2ee/e2ee_common.h`

### Socket API

- [Socket Facade](https://github.com/openziti/ziti-sdk-c/blob/main/library/zitilib/zitilib.c): `library/zitilib/zitilib.c`
- [Socket Dial](https://github.com/openziti/ziti-sdk-c/blob/main/library/zitilib/zl_connect.c): `library/zitilib/zl_connect.c`
- [Socket Bind](https://github.com/openziti/ziti-sdk-c/blob/main/library/zitilib/zl_bind.c): `library/zitilib/zl_bind.c`

### Other components

- **Application**
- **Ziti Controller**
- **Edge Router**
- **Socket Application**

## Connections

- Application → Public SDK API: calls
- Public SDK API → Identity Context: initializes
- Identity Context → Identity Config: loads
- Identity Context → Controller Client: uses
- Controller Client → Ziti Controller: exchanges API data
- Identity Context → Enrollment: enrolls identity
- Identity Context → Authentication: authenticates
- Authentication → Legacy Auth: selects method
- Authentication → OIDC Auth: selects method
- Identity Context → External Login: starts external login
- Identity Context → Posture Checks: collects posture
- Posture Checks → Controller Client: submits responses
- Application → Service Dial: dials service
- Application → Service Bind: binds service
- Identity Context → Service Dial: provides identity
- Identity Context → Service Bind: provides identity
- Service Dial → Edge Channel: opens connection
- Service Bind → Edge Channel: opens listener
- Edge Channel → Edge Protocol: frames traffic
- Edge Channel → Edge Router: exchanges traffic
- Edge Channel → End-to-End Encryption: encrypts data
- Socket Application → Socket Facade: uses sockets
- Socket Facade → Socket Dial: dispatches dial
- Socket Facade → Socket Bind: dispatches bind
- Socket Dial → Service Dial: calls
- Socket Bind → Service Bind: calls
- Identity Context → Metrics: records metrics