At this level
com.getorbyt · 4- com.getorbyt.authFullApp permission-set
- com.getorbyt.getLiveFeatures query The release features live for the viewer right now, including any the service turns on for this account before launch so it can be tested. A feature absent from the answer is off, and so is every feature when a client cannot reach this method or reads an older service that does not serve it. Anonymous callers get the features live for everyone. Never cached: the answer depends on who asks.
- com.getorbyt.getServiceInfo query What this deployment of the Orbyt service can currently do, for clients that cannot be upgraded in step with it. Clients feature-detect against `capabilities` rather than comparing version numbers: only one version of this service is ever live, while many client builds run for months. Every field is optional and the whole call is optional — a client that cannot reach it, or reads an older service that does not serve it, must behave exactly as it did before. Unauthenticated.
- com.getorbyt.profile record
- com.getorbyt.actor.defs defs One box on the profile header's second page. The service composes it: what it says, its size and where it goes.
- com.getorbyt.actor.getColorPalette query The server-owned profile foreground/background pairs shared with Byte.
- com.getorbyt.actor.getProfile query An actor's Orbyt profile. Unauthenticated; a service-auth viewer adds `viewer` state.
- com.getorbyt.actor.getProfiles query not from the namespace authority Several Orbyt profiles in request order. Unknown actors are omitted.
- com.getorbyt.actor.profile record The account's Orbyt profile, separate from its profile on any connected network. Every field is optional: an absent field falls back to the network profile, so an account that never edits here still renders. The profile's colours and app preferences stay in com.getorbyt.profile; how each Highlight box looks is here, with the boxes.
- com.getorbyt.community.beginDeletion procedure Begins permanent deletion for an unpublished Community and returns the current PDS declaration to delete. Requires authenticated service authorization by the current declaration holder.
- com.getorbyt.community.cancelDeletion procedure Cancels deletion before the current declaration has been deleted from its PDS. Requires authenticated service authorization by the current declaration holder.
- com.getorbyt.community.checkName query Whether a lowercase Community name is free. Names are globally unique at the AppView, and a record whose name is taken is rejected at projection time rather than at write time, so clients check before writing.
- com.getorbyt.community.createAppeal procedure Creates the post author's single private appeal for a specific Community removal action. Requires authenticated service authorization.
- com.getorbyt.community.createReport procedure Creates a private Community-moderator report for a linked post. Requires authenticated service authorization.
- com.getorbyt.community.declaration record The canonical public descriptor for an Orbyt Community, and the record that declares the Community exists. Its AT-URI is the Community's identity everywhere else in the protocol. The record key is a TID, including for the replacement declaration an accepted ownership transfer produces: the recipient mints it before accepting and names it to the AppView, which stores it as the only URI the continuation may be written at. Every Community is public: the record is world-readable, and the directory a
- com.getorbyt.community.defs defs Recent activity in a Community, so its page can show the people in it and not only its counts.
- com.getorbyt.community.deleteRole procedure Deletes a role the Community defined, or, for the key moderator, puts the built-in moderator role back to its default permissions. A role someone holds cannot be deleted; move them to another role first. Only an administrator may delete roles. Recorded in the moderation log.
- com.getorbyt.community.getCommunity query A single Community by AT-URI or by name, hydrated with viewer state when the request is authenticated. Exactly one of `community` and `name` is required: the AT-URI is the Community's identity, while the name is what a public link can carry.
- com.getorbyt.community.getFeed query A Community's native feed skeleton, served from projected com.getorbyt.community.post links. Clients hydrate post URIs through their authenticated Bluesky AppView. Removed posts are only included for their author and Community moderators.
- com.getorbyt.community.getModmailThread query One Modmail thread and its messages, newest first. Without member, the caller's own thread, which is absent until they first write. With another account's member, the caller needs manage-mail. Viewer-specific and never cached; reading does not mark the thread read (see updateModmailSeen).
- com.getorbyt.community.getPostCommunities query The Community each post was published to, for a batch of posts. A post in no visible Community is omitted. A Community post record outranks a legacy channel tag on the post itself.
- com.getorbyt.community.getWriteStatus query Whether the AppView accepted records the caller wrote to their own repository. Community records are projected from the firehose, not written through this service, so a record that violates a rule this service enforces — a name already taken, a post link the Community's postPolicy forbids — lands in the author's repository and is then silently dropped. This is how the author finds out. Only the caller's own records may be queried.
- com.getorbyt.community.listAuditLog query Lists append-only Community audit events visible to the authenticated moderator or administrator.
- com.getorbyt.community.listCommunities query The public Community directory. Unauthenticated; an authenticated request additionally receives viewer state on each Community.
- com.getorbyt.community.listMembers query A Community's members. Anyone may list active members; listing muted or banned members requires a moderator role.
- com.getorbyt.community.listModerationQueue query Lists private reports and appeals for one Community. Requires authenticated moderator authorization.
- com.getorbyt.community.listModmailThreads query The mod team's Modmail inbox: one thread per member, most recent message first, each marked unread when the member wrote since this moderator last read it. Requires manage-mail. Viewer-specific and never cached.
- com.getorbyt.community.listMyCommunities query The authenticated account's own Community memberships. Defaults to active and muted memberships.
- com.getorbyt.community.listReportedPosts query The moderation queue grouped by post: each reported post once, with how many reports it has and why, newest report first. Requires manage-reports.
- com.getorbyt.community.listRoles query The Community's roles: the built-in owner and moderator roles, then the roles the Community defined, in order. Requires manage-roles. Viewer-specific and never cached.
- com.getorbyt.community.listTransfers query Lists ownership transfers visible to the authenticated caller as current holder, target, or Community administrator.
- com.getorbyt.community.manageMember procedure Mute, ban, or re-role a member. Only an administrator may set a role; a moderator may mute and ban, but never a peer or an administrator. Administration is service state and may be granted to an account that does not hold the declaration record; authority over the record itself is never transferable and always belongs to the repository that holds it.
- com.getorbyt.community.manageModmailThread procedure Archives a member's Modmail thread out of the open inbox, or brings it back. Requires manage-mail. A new message from the member reopens an archived thread on its own.
- com.getorbyt.community.manageTransfer procedure Invites, accepts, declines, or cancels an ownership transfer. Requires authenticated service authorization; only the current declaration holder may invite or cancel and only the target may accept or decline.
- com.getorbyt.community.membership record not from the namespace authority A user-owned canonical membership link, one record per Community. The record key MUST be base32(sha256(community AT-URI)) truncated to 24 characters, lowercase and unpadded, so writing it twice replaces the record instead of adding a second one and a repo can never hold two memberships for the same Community. The AppView rejects a record whose key is not that derivation, so the invariant is enforced rather than assumed. The key is derived from the AT-URI rather than the Community name, which its
- com.getorbyt.community.moderatePost procedure A moderator action on one post's Community-level state. Removal is scoped to the Community; only actions that change state are journaled.
- com.getorbyt.community.post record not from the namespace authority A user-owned canonical link between a Bluesky post and an Orbyt Community. A sidecar record: it lives in the post author's own repository and its record key MUST be the record key of the linked app.bsky.feed.post, exactly as app.bsky.feed.threadgate does. That makes one link per post structural rather than enforced after the fact, and lets the link be fetched with a single com.atproto.repo.getRecord once the post URI is known. The linked post remains canonical in app.bsky.feed.post.
- com.getorbyt.community.replyModmail procedure Replies to a member's Modmail thread as the mod team. Requires manage-mail. Moderators cannot start a thread: they answer one a member opened. The member sees the reply in the thread and in Activity, from the team rather than from the moderator.
- com.getorbyt.community.requestSync procedure Wake the existing Community ingester after a repository write. Acknowledgment is not projection success; use getWriteStatus to check acceptance. Only the caller's own Community record URIs are accepted. Rate limited and coalesced with scheduled ingestion.
- com.getorbyt.community.resolveAppeal procedure Permanently upholds or restores one appealed Community removal. Requires authenticated moderator authorization.
- com.getorbyt.community.resolveReport procedure Resolves one Community report by removing its post or dismissing the report. Requires authenticated moderator authorization.
- com.getorbyt.community.resolveReportedPost procedure Resolves every open report about one post at once: remove the post, or dismiss the reports and keep it. Requires manage-reports, and manage-posts to remove.
- com.getorbyt.community.saveRole procedure Creates a Community role, or changes one. Without a key it creates a role; with one it replaces that role's name and permissions. The key moderator changes what the built-in moderator role may do, and keeps its name. Only an administrator may define roles. Recorded in the moderation log.
- com.getorbyt.community.sendModmail procedure "Message the mods": opens the caller's private thread with the Community's mod team, or continues it. Each account has one thread per Community, and a message reopens it if the mod team archived it. Anyone signed in may write, including a muted or banned member; whoever holds manage-mail answers with replyModmail instead. Rate-limited per sender.
- com.getorbyt.community.setAnnouncement procedure Sets or clears the Community's announcement, shown on its page and, when set or changed, in its members' activity as `communityAnnouncement`. Requires manage-settings. The announcement is service state rather than part of the declaration record, so a moderator granted manage-settings can set it without writing the owner's repository. Setting and clearing are both recorded in the moderation log.
- com.getorbyt.community.updateModmailSeen procedure Marks a Modmail thread read for the caller up to seenAt. Read state is per reader: the member's own, and each moderator's own. The mark only moves forward and never past now. Sending a message marks the thread read for its sender.
- com.getorbyt.community.updatePublication procedure Publishes or unpublishes a Community. Requires authenticated service authorization and a manager action advertised by the Community view.
- com.getorbyt.graph.block record not from the namespace authority An Orbyt block. Hides the subject's Orbyt content and relationship views from the blocker, and the blocker's from the subject.
- com.getorbyt.graph.follow record Deprecated: Orbyt's follow is the account's app.bsky.graph.follow, and the service no longer reads these records for any rule. Older clients still write them. An Orbyt follow, independent of any follow on a connected network. Clients write it under the record key derived from `subject` (base32 of its SHA-256, 24 characters, as community.membership does), so importing the same follow from two clients writes one record. The service accepts any key and keeps one follow per pair.
- com.getorbyt.graph.getFollowers query Legacy: accounts following the actor with the deprecated `com.getorbyt.graph.follow`, newest first. Orbyt's follow is the network follow; this stays for older builds and goes once `minimumClient` passes the last build that writes Orbyt follows. Unauthenticated; a service-auth viewer adds `viewer` state.
- com.getorbyt.graph.getFollows query Legacy: accounts the actor follows with the deprecated `com.getorbyt.graph.follow`, newest first. Orbyt's follow is the network follow; this stays for older builds and goes once `minimumClient` passes the last build that writes Orbyt follows. Unauthenticated; a service-auth viewer adds `viewer` state.
- com.getorbyt.graph.getNetworkFriends query Orbyt accounts the viewer follows on the connected network, as of their last follow sync: the find-friends list. Requires service auth.
- com.getorbyt.graph.syncNetworkFollows procedure Read the viewer's follow and block records on the connected network from their own repository and refresh the service's copy, which is Orbyt's follow graph and, with Orbyt blocks, its block list: Sends, Your Mix, find-friends and friend-joined alerts are computed from it. Follows are read incrementally, with a full reconciliation when due; blocks are read in full each time. Repeated calls within a short interval return the previous result, unless they name a `subject`. Requires service auth.
- com.getorbyt.notification.defs defs A server-written Activity row.
- com.getorbyt.notification.getPushStatus query not from the namespace authority
- com.getorbyt.notification.getUnreadCount query not from the namespace authority How many Orbyt activity items are newer than the viewer's last updateSeen. Requires service auth.
- com.getorbyt.notification.listNotifications query not from the namespace authority The viewer's Orbyt activity, newest first. Requires service auth.
- com.getorbyt.notification.registerPush procedure not from the namespace authority Opt this account and installation into native Orbyt notifications. A separate read-only notification grant may require consent.
- com.getorbyt.notification.unregisterPush procedure not from the namespace authority Disable this account installation. Accepts method-scoped service authentication or its registration-specific revocation capability for retries after logout.
- com.getorbyt.notification.updateSeen procedure not from the namespace authority Mark Orbyt activity up to `seenAt` as read. Never moves the mark backwards. Requires service auth.
- com.getorbyt.send.create procedure not from the namespace authority Sends a post to up to eight accounts, with an optional note. It reaches a recipient who follows the sender, on Orbyt or the connected network, and who neither blocks nor is blocked by them; a send of the same post to the same account again is not delivered twice. The answer says who it reached, never why it did not reach the rest. Rate-limited per sender.
- com.getorbyt.send.defs defs not from the namespace authority One choice for `preferences.allowFrom`, in the service's words.
- com.getorbyt.send.getPreferences query not from the namespace authority The viewer's Sends preferences, with the choices and wording the service offers for them.
- com.getorbyt.send.getSuggestions query not from the namespace authority Who the viewer is likely to send a video to, best first: people they recently sent to, then mutual follows, then people who follow them. Everyone listed can receive a send from the viewer. Viewer-specific and never cached.
- com.getorbyt.send.list query not from the namespace authority Videos sent to the viewer, or by them, newest first. Viewer-specific and never cached.
- com.getorbyt.send.putPreferences procedure not from the namespace authority Changes the viewer's Sends preferences; a field left out keeps its value. Turning receipts off also hides what the viewer already watched, and nothing watched while they are off is recorded.
- com.getorbyt.send.react procedure not from the namespace authority A recipient answers a send with one of the reactions the service offers, or takes their reaction back by leaving it out. The sender sees it in Activity.
- com.getorbyt.send.undo procedure not from the namespace authority The sender takes back a send they just made, within a short time of making it. It is removed for every recipient, with its Activity item; the post itself is untouched.
- com.getorbyt.video.defs defs not from the namespace authority
- com.getorbyt.video.getAccountLoopStats query Canonical public earned and consumed loop totals for accounts.
- com.getorbyt.video.getAutoDeletes query Public expiration metadata for requested post URIs. Private execution credentials and errors are never returned.
- com.getorbyt.video.getLoopCounts query not from the namespace authority
- com.getorbyt.video.getMix query The viewer's Your Mix, as a skeleton of post URIs to hydrate through the viewer's Bluesky AppView. It blends the viewer's personal generator, their circle (Channels they joined, Channels the people they follow are in, friends of friends) and the people they follow, and it ends: the last page has no cursor and carries `end`. A fresh Mix opens with videos sent to the viewer that they have not watched yet, each with its `send`.
- com.getorbyt.video.listAutoDeletes query Read unfinished auto-deletion schedules belonging to the authenticated account, including overdue failures.
- com.getorbyt.video.pauseAutoDelete procedure Sign a gateway session out with a narrowly scoped capability, after the device has removed its credentials. Device access ends at once; pending self-destructs still delete on schedule, then the grant is revoked.
- com.getorbyt.video.recordLoop procedure
- com.getorbyt.video.reserveAutoDelete procedure Reserve or confirm auto-deletion before a create-only video publication. Requires a server-backed Orbyt gateway session. Repeating a reservation preserves its deadline.
- com.getorbyt.video.tuneMix procedure The viewer asks Your Mix for more or less like a video it served. The service applies it to the Channel the video was shown for when given, or else to the video's author, for 30 days: more moves their videos to the front of a Mix page, less skips them. A newer signal for the same author or Channel replaces the older one, and clear takes it back. Videos sent to the viewer are never skipped. A video served by the personal generator should also be reported to that generator with app.bsky.feed.sendI