Browse lexicons

matching 30 lexicons

Narrow to

stratos30

zone.stratos 30 Narrow ›

zone.stratos.actor.enrollment record A record indicating the user is enrolled in a Stratos service. Published to the user's PDS during OAuth enrollment for endpoint discovery by AppViews. Multiple enrollment records are supported — one per Stratos service.
zone.stratos.admin.addAdmin procedure Grant admin access to a DID. Requires admin authorization.
zone.stratos.admin.listAdmins query List everyone holding admin access. Requires admin authorization.
zone.stratos.admin.listEnrollments query List enrollments in this Stratos service. Requires admin authorization.
zone.stratos.admin.removeAdmin procedure Revoke admin access from a DID. Config-provided admins cannot be revoked here, and an admin cannot revoke their own access.
zone.stratos.admin.setActive procedure Activate or deactivate an enrolled member. Requires admin authorization. Deactivation is reversible and preserves the member's boundaries.
zone.stratos.boundary.defs defs A specific domain to define exposure boundary.
zone.stratos.defs defs Indicates this record requires hydration from an external service. The stub record on the PDS contains minimal data; full content is fetched from the service endpoint.
zone.stratos.embed.images object A set of images embedded in a Stratos post. Similar to app.bsky.embed.images but for private data.
zone.stratos.enrollment.status query Check enrollment status for a DID in this Stratos service.
zone.stratos.enrollment.unenroll procedure Unenroll from the Stratos service, revoking the session and deleting the enrollment record from the user's PDS.
zone.stratos.feed.getTimeline query Fetch a timeline of posts.
zone.stratos.feed.post record Record containing a private Stratos post with domain boundary restrictions. When stored on user's PDS as a stub, only 'source' and 'createdAt' are present. Full content is available from the hydration service.
zone.stratos.feedgen.describeFeed query List feeds offered by this generator.
zone.stratos.feedgen.getFeed query Fetch a boundary-scoped hydrated feed. Requires service-auth.
zone.stratos.identity.resolveEnrollments query Resolve enrollment boundaries for a DID. Returns the boundary domains the user is enrolled in.
zone.stratos.repo.hydrateRecord query Hydrate a single record by URI. Returns the record if viewer has boundary access.
zone.stratos.repo.hydrateRecords procedure Hydrate multiple records by URI. Returns records filtered by viewer's boundary access.
zone.stratos.repo.importRepo procedure Import a repository from a CAR file. Verifies record CID integrity and re-signs with the destination service key. The caller must be enrolled as the DID in the CAR's commit block.
zone.stratos.repo.uploadBlob procedure Upload a new blob, to be referenced from a Stratos repository record. The blob will be deleted if it is not referenced within a time window (eg, minutes). Blob restrictions (mimetype, size, etc) are enforced when the reference is created. Requires auth, implemented by Stratos service.
zone.stratos.server.listDomains query Returns the list of boundary domains available on this Stratos service.
zone.stratos.space.feed space A members-only Stratos post feed
zone.stratos.space.getRecord query Get a single record from a permissioned space. Spec-shaped mirror of com.atproto.space.getRecord (atproto#5187): callable with standard user auth (the caller must be a member of the space) or with a space credential for that space (for syncing services). The record must belong to the requested space; records outside it - including records with no space at all - resolve to RecordNotFound (no existence leak).
zone.stratos.space.getSpaceCredential procedure Issue a space credential (JWT) for a space the caller is a member of. The credential is multi-use until it expires and is bound to the caller's DPoP key (cnf.jkt, RFC 9449): it must be presented under the DPoP auth scheme with a per-request proof signed by that key. It is signed by the space authority's signing key so any repo host can verify it without contacting the authority. Identity is resolved from a delegation token when provided (a standalone DPoP proof in the DPoP header supplies the ke
zone.stratos.space.listBlobs query List the CIDs of blobs referenced by an account's records within a permissioned space, optionally since some revision of that repo. Spec-shaped mirror of com.atproto.space.listBlobs (atproto#5187): callable with standard user auth (the caller must be a member of the space) or with a space credential for that space (for syncing services). Blobs behind permissioned records are never enumerated by an unauthenticated endpoint.
zone.stratos.sync.getBlob query Get a blob by CID with boundary-based access control.
zone.stratos.sync.getRepo query Export the full repository as a CAR file. Returns all record blocks, MST nodes, and the signed commit.
zone.stratos.sync.listRecordPaths query Full-state recovery: enumerate a repo's record paths and their current CIDs, mirroring listRecords semantics. Record values are inlined by default; excludeValues returns metadata only. Boundary-gated: the caller only observes records within its enrolled boundaries. Intended as the fallback when the oplog (listRepoOps) returns OplogTruncated: the caller enumerates paths, diffs locally, and fetches misses. Callers must authenticate with a signed service JWT via the Authorization: Bearer header.
zone.stratos.sync.listRepoOps query Incremental pull sync of a repo's operation log (oplog), mirroring com.atproto.space.listRepoOps semantics. Returns record operations after the `since` revision, with current record values inlined by default. Boundary-gated: the caller only observes operations for records within its enrolled boundaries. The response reaches the head of the oplog when `cursor` is absent; the repo's current signed commit is then included (unless the repo has no commits yet), consistent with the operations returned
zone.stratos.sync.subscribeRecords subscription Subscribe to stratos events. When 'did' is provided, subscribes to record updates for that account. When omitted, subscribes to service-level events (enrollments). Callers must authenticate with a signed service JWT via the Authorization: Bearer header.