Asset Metadata
Introduction
Asset metadata plays a critical role within the Ocean Enterprise ecosystem, enabling the cataloging and management of service offerings. Each asset can include multiple service offerings. The metadata is intended for publication to federated catalogues, ensuring that service offerings are easily discoverable across different data spaces and data ecosystems. To ensure confidentiality and integrity, the metadata is encrypted by default.
Additionally, while most metadata is stored off-chain to optimize performance and scalability, a hash of this metadata is anchored on-chain. This approach combines the benefits of off-chain storage with the immutability and security of blockchain technology, ensuring both scalable data management and verifiable metadata integrity.
Due to privacy and efficiency reasons, the asset metadata is split into two parts:
Off-chain part: it is a W3C-compliant Verifiable Credential (V), encoded in VC-JWT format and stored using IPFS. It is signed by the asset publisher and encrypted.
On-chain part: it is recorded on the blockchain and contains a remote pointer linking to the off‑chain part of the DDO, where the full metadata is stored.
The off-chain part of the DDO
The off‑chain component of the DDO is encoded as a W3C‑compliant Verifiable Credential and signed by the asset’s publisher, ensuring authenticity and integrity.
Verifiable Credential
@context
Array of String
Specifies the W3C data standards utilized to validate the cryptographic security format of the asset document.
[
"https://www.w3.org/ns/credentials/v2"
]
type
Array of Strings
Declares the identity type of this record, systematically marked as a VerifiableCredential.
[
"VerifiableCredential"
]
version
String
Indicates the system configuration template version used to render the document (e.g., 5.0.0).
id
String
The unique Decentralized Identifier (DID) assigned to the asset, serving as its permanent global lookup address on the marketplace.
credentialSubject
Object
The primary container holding all asset profiles, metadata rules, distribution permissions, and pricing stats. The credentialSubject object is detailed in the table credentialSubject.
issuer
String
The verified decentralized identity of the entity that signed off on publishing the asset. (e.g. "did:web:wallet2.demo.oceanenterprise.io:wallet-api:registry:publisher132")
proof
Object
The final cryptographic payload consisting of standard encryption schemas used to verify document authenticity.
credentialSubject
chainId
Integer
The blockchain network identification code where this asset and its related smart contracts reside.
metadata
Object
Contains all human-readable definitions of the asset, such as titles, creation dates, and licensing information. The metadata object is described in the table Metadata.
services
Array of Objects
Configuration details for asset's services, outlining the technical access paths, the node endpoints, time limits, and parameters. The service object is described in the table Service.
credentials
Object
Access rules defining who can access the overall asset. The credentials object is described in the table Credentials
nftAddress
String
The address of the NFT minted in the blockchain, which represents the asset.
additionalDdos
Array
List of additional descriptions of the asset in other formats.
Metadata
There are two types of assets managed in Ocean Enterprise: datasets and algorithms. Each asset type has its specific attributes.
created
String (ISO date/time)
The exact date and time, in ISO8601 format, when the asset profile was first registered (e.g. 2000-10-31T01:30:00Z).
updated
String (ISO date/time)
The exact date and time, in ISO8601 format, when the asset profile was last updated (e.g. 2000-10-31T01:30:00Z).
type
String
Defines the format classification of the asset entry ( dataset or alogorithm).
Each type has a different subset of metadata attributes.
name
String
The public display name of the asset, shown to marketplace buyers.
description
String
Multilingual, direction-aware descriptive text detailing what the dataset contains.The description object is detailed in the table Description
tags
Array of Strings
Categorization keywords used by portal search bars to filter, search, and group relevant assets.
author
String
Name of the entity generating this data (e.g. Ocean Enterprise e.V.).
copyrightHolder
String
The entity holding the legal copyright.
providedBy
string
Verifiable Credential of the entity offering this asset.
links
Object
Mapping of URL titles(key) and URL strings(value)
license
Object
The licenses applied to all services of this asset. The license object is detailed in table License.
algorithm
Object
This object is set only if the asset is an algorithm (the field type is set to algorithm). This algorithm object is described in table Algorithm
Description
@value
String
Description of the asset in one specific language
@direction
String
Text direction, whose value is a base direction string defined by the @direction property in [JSON-LD11] .Example: rtl (ltr or rtl)
Example of a description object:
License
name
String
The primary name, label, or reference link representing the master data license or legal agreement for the asset.
licenseDocuments
Array of Objects
A comprehensive manifest listing individual files, addendums, or reference agreements attached directly to this license profile.
licenseDocuments[].additionalInformation
Object
An extensible metadata bucket for storing operational file properties.
licenseDocuments[].additionalInformation.size
Integer
The physical file size (measured in bytes) of the attached legal or reference document.
licenseDocuments[].sha256
String
A unique cryptographic fingerprint of the document file. This ensures the legal terms cannot be modified or replaced without invalidating the manifest.
licenseDocuments[].mirrors
Array of Objects
A list of alternative hosting locations where the marketplace application can safely retrieve the document file.
licenseDocuments[].mirrors[].method
String
The technical HTTP transmission rule used to download the document (e.g., get).
licenseDocuments[].mirrors[].type
String
The storage infrastructure category hosting this specific copy (e.g., traditional web link url or decentralized storage ipfs).
licenseDocuments[].mirrors[].url
String
The precise URL destination path used to download the file if hosted on standard cloud web servers.
licenseDocuments[].mirrors[].headers
String
Optional protocol header parameters required by secure servers during the file download process.
licenseDocuments[].mirrors[].ipfsCid
String
The cryptographic Content Identifier (CID) used to fetch the file copy if it is stored across decentralized networks.
licenseDocuments[].displayName
Object
A localization container for the file label displayed to consumers in the marketplace portal user interface.
licenseDocuments[].displayName.@direction
String
Layout direction setting for rendering text (e.g., ltr for left-to-right languages).
licenseDocuments[].displayName.@language
String
niversal language standard code indicating the translation of the display text (e.g., en).
licenseDocuments[].name
String
The strict administrative filename matching the document index registry record.
licenseDocuments[].description
Object
A localization container used to provide supplementary details or descriptive footnotes about a specific file attachment.
licenseDocuments[].description.@value
String
Human-readable explanation detailing what a specific attached document or addendum covers.
licenseDocuments[].description.@direction
String
Layout direction setting for parsing the text block (e.g., ltr).
licenseDocuments[].description.@language
String
Universal language standard code specifying the language of the description string (e.g., en).
licenseDocuments[].fileType
String
The official file format layout standard (e.g., png or text/html; charset=utf-8), which informs the marketplace app how to correctly render or display the file to a user.
Example of a license object including the following:
a license file referenced as a URL (https://github.com/MBadea17/testdata/blob/af26d4f968fdb6e1882c2a3cca16a1480ca44a9c/License%20Agreement.pdf)
two additional files:
"test additional file": file uploaded to IPFS
"test additional file 2": file referenced as a URL available at https://github.com/MBadea17/testdata/blob/af26d4f968fdb6e1882c2a3cca16a1480ca44a9c/License%20Agreement.pdf
Algorithm
@language
String
Language to implement the software
container
Object
Describes the Docker container image based on which the container that will run the algorithms will be instantiated. The container object is described in the table Container
Container
image
String
The Docker image name the algorithm will run with.
tag
String
The Docker image tag.
entrypoint
String
The Docker entrypoint. $ALGO is a macro that gets replaced inside the compute job, depending where your algorithm code is downloaded.
Example of a container object for an algorithm written in JavaScript/Node.js, based on Node.js v24:
Service
id
String
Unique ID of the asset's service
name
String
Service name
description
Object
Multilingual, direction-aware descriptive text detailing what the dataset contains.The description object is detailed in the table Description
type
String
Defines the transaction fulfillment style of the service endpoint (e.g., access for direct data file downloading or compute for access to the service endpoint only within a Compute-to-Data job).
datatokenAddress
String
Smart contract address of the specific token assigned to this service.
files
String
Ecrypted access control information of the files associated with this service. When the service is consumed, the files listed here are served to the consumer. The information is encrypted by the node provided in the serviceEndpoint parameter. The structure of the file object encrypted and saved in this field depends on the type of file: HTTP, S3 etc. All file objects are presented in chapter File Types.
serviceEndpoint
String (URL)
Tthe URL of the OE Node responsible for controlling the access to the service: verifying payments for the service and streaming the data files safely to the buyer.
timeout
Integer
The active lifetime window (measured in seconds) a consumer has to utilize or download the service from the purchase moment (e.g., 86400 seconds equals 24 hours). After the timeout is reached, the consumer has to purchase the service again in order to access it once more.
state
Integer
Indicates the operational lifecycle status of the service (e.g., 0 means active and purchaseable; other values designate paused or retired services).
credentials
Object
Access rules defining who can access the service. The credentials object is described in the table Credentials
consumerParameters
Array of Objects
Defines the parameters the consumer has to input before consuming the asset. This object is described in table Consumer Parameters.
compute
Object
This object is defined only for services used in C2D (i.e. service.type is set to compute).
This compute object is described in table Compute.
Compute
For services used in C2D jobs, the compute object is added to the service description. This object includes the following attributes.
allowRawAlgorithm
boolean
Used only for assets of type algorithm.
Specify if passed raw text will be allowed to run. It is by default set to false (do not allow raw algorithms to run).
allowNetworkAccess
boolean
Used only for assets of type algorithm.
Specify if the algorithm job network access.
publisherTrustedAlgorithmPublishers
Array of Strings
Used only for assets of type dataset.
A list of the web3 addresses of algorithm publishers that the service recognizes as trusted.
publisherTrustedAlgorithms
Array of Objects
Used only for assets of type dataset.
Specify the list of algorithms allowed to run on the dataset represented by the service.
publisherTrustedAlgorithms[].did
String
The DID of the asset allowed to run on the dataset
publisherTrustedAlgorithms[].serviceId
String
The ServiceId of the service within the asset that is allowed to run on the dataset.
publisherTrustedAlgorithms[].containerSectionChecksum
String
Hash of algorithm's image details
publisherTrustedAlgorithms[].filesChecksum
String
Hash of algorithm's files.
Example of a compute object for a dataset service. There are two algorithm publishers trusted by this dataset (listed in publisherTrustedAlgorithmPublishers), meaning all algorithms from these two publishers can be executed on the dataset. Moreover, there are three additional trusted algorithms (listed in publisherTrustedAlgorithms), which can also be executed on the dataset.
Consumer Parameters
name
String
The internal technical identifier for the parameter.
type
String
Controls the visual input style generated on the interface screen. Accepted configurations include text (string field), select (a dropdown menu), number (a numeric keypad/input field), or boolean (a true/false checkbox/toggle switch).
label
String
The human-readable title displayed directly above the input field in the marketplace portal.
description
String
Explanatory instructional text or tooltips presented next to the interface field to guide consumers on what their choice affects.
default
String
The standard pre-selected value automatically used if the user skips modifying this parameter or leaves the field empty.
required
boolean
Enforces entry rules. If set to true, the marketplace will block the consumption request until the user explicitly inputs a value. If false, the parameter is optional.
options
Array of Objects
Applicable only when type is set to select. Defines the selectable items inside the dropdown menu, mapping a backend code name (e.g., apac) to its user-friendly display value (e.g., Asia Pacific).
Example of a consumerParameters object:
Credentials
The credentials are specified at the asset level (credentialSubject.credetials) and at the service level (credentialSubject.services[].credentials). Both objects share the same structure. The only difference between the two is that asset-level credentials may include additional clauses regarding the presentation of verifiable credentials. These clauses specific to asset-level credentials are highlighted in the text below.
allow
Array of Objects
The Access Whitelist. A collection of rules defining who is permitted to interact with the asset. If an entity matches any defined rule block here, they are granted baseline access. The allow object is presented in table Allow.
deny
Array of Objects
The Access Blacklist. Explicit ban parameters based on web3 address.
Any wallet address matching criteria in this block will be hard-blocked from accessing the asset or service, even if they qualify under the allow section.
Allow
type
String
Specifies the security mechanism used for evaluation. The supported values are address (crypto-wallet-based gating) or SSIpolicy (decentralized enterprise identity profiles).
values
Array of Objects
Contains the operational parameters and settings assigned to the specific rule type.
allow[].values[].address
String
Used when type is address. Denotes the explicit blockchain wallet address allowed to see the asset. A value of * serves as a wildcard, permitting any connected wallet.
allow[].values[].vc_policies
Array of Strings
Global Verifiable Credential Baselines. Security audits enforced automatically across every submitted credential, such as checking the digital signature or ensuring the timeline is valid via not-before.
allow[].values[].vp_policies
Array of Objects
This field is present only in the asset-level credentials object.
Verifiable Presentation (VP) Bundle Rules. Rules dictating how the overall collection of credentials must behave together, such as enforcing anti-spoofing (holder-binding) or setting a minimum number of valid matching certificates (minimum-credentials).
allow[].values[].request_credentials
Array of Objects
Used when type is SSIpolicy. Outlines the precise digital verifiable credentials the user must present from their corporate identity wallet (e.g., corporate registry records).
allow[].values[].request_credentials[].type
String
The specific schema or classification of the requested certificate, such as gx:LegalPerson (company profile) or gx:LeiCode (Legal Entity Identifier).
allow[].values[].request_credentials[].format
String
The technical data format of the credential package being checked (e.g., jwt_vc_json).
allow[].values[].request_credentials[].policies
Array of Strings or Objects
Targeted validation checks applied to that specific credential. Can range from a simple validity check like expired to complex dynamic rules containing parameters and evaluation servers.
Example of an asset-level allow object. The following access credentials are defined for the asset:
access allowed to any web3 address (field
credentials.allow[{"type":"address"}].values[0].address = "*")access allowed to any consumer who presents the following VCs (the fields
credentials.allow[{"type":"SSIpolicy"}].values[0].request_credentials[].type):gx:LegalPerson
gx:Issuer
gx:LeiCode
all VCs have to comply with the following static policies (the field
credentials.allow[{"type":"SSIpolicy"}].values[0].vc_policies[])not-before: VC is not used before its validity start date
revoked-status-list: VC is not revoked
signature: VC has a valid signature
the Verifiable Presentation (VP) in which the VCs are packed before submission to verification must comply with the following policies (the field
credentials.allow[{"type":"SSIpolicy"}].values[0].vp_policies[]):holder-binding: the identifier that signs the VP must be the subject of each VC included in the VP
minimum-credentials: a minimum of two VCs must be included in the VP
vp_required_credentials: the VP must include gx:LegalPerson VC and optionally one of the following VCs: gx:LeiCode and gx:Issuer
the gx:LegalPerson VC must comply with the following policy (
credentials.allow[{"type":"SSIpolicy"}].values[0].request_credential[0].policies[]):expired: the VC has not expired
the gx:Issuer VC must comply with the following policy (
credentials.allow[{"type":"SSIpolicy"}].values[0].request_credential[1].policies[])allowed-issues: the VC must be issued by the entity identified by did:GXCH
the gx:LeiCode VC must comply with the following policy (
credentials.allow[{"type":"SSIpolicy"}].values[0].request_credential[1].policies[]):a dynamic policy named countryGermany
the dynamic policy verifies if the field gx:countryCode of the VC has the value "DE"
Deny
type
String
Specifies the security mechanism used for evaluation. Currently, the only accepted value is address
values
Array of objects
The list of web3 addresses that are restricted to access the asset/service.
values[].address
String
The web3 address restricteed to access the asset/service (e.g "0xd727fb9be39fa019d7c02fea19e54d688da3a662" - specific address; "*" - all addresses).
Example of a deny object where two web3 addresses are restricted from accessing the asset/service.
Example of a deny object where all addresses are restricted from accessing the asset/service.
Examples of DDOs
Dataset with two services
The asset is of type dataset and has two services of type download : "Service 1" and "Service 2"
Dataset for computing with allowed algorithms and allowed algorithm publishers defined
The asset is of type dataset and has a service of type compute. The service accepts only a list of algorithms (identified by did and serviceID in the field publisherTrustedAlgorithms) and algorithm publishers (identified by web3 address in field publisherTrustedAlgorithmPublishers)
Dataset with SSI credentials
The dataset has a service of type access. SSI access credentials are defined at both the asset level (credentialSubject.credentials field) and service level (credentialsSubject.services[0].credentials field).
Algorithm for computing
The asset is of type algorithm. It has two services - Algo 1 and Algo 2 - both usable only in a compute-to-data environment (credentialSubject.services[].type is "compute").
The algorithms provided by Algo 1 and Algo 2 are written in JavaScript (credentialSubject.algorithm.language is "js") and use the latest node.js image (credentialSubject.algorithm.container.image is "node", credentialSubject.algorithm.container.tagis "latest").
The asset allows network access when the algorithms are executed in a C2D environment (credentialSubject.services[].compute.allowNetworkAccess is true).
The on-chain part of the DDO
On-chain, the following object is saved:
the
typefield is 'ipfs', meaning that the referenced remote object is saved in IPFSthe
hashfield contains the hash of the Content ID (CID) where the asset's DDO is saved in IPFS.
References
SHACL schema
The SHACL schema used by the OE Node's indexer component to validate the DDO's at publishing or editing time is available here: https://github.com/oceanprotocol/ddo.js/blob/main/schemas/5.0.0.ttl
Last updated