Lexicon Garden

fyi.opensocial.getAuthorization

An app's pending request to sign in as a group, as the caller would approve it: the app, the groups the caller may act for, and for each one what the caller's roles let the app do. Called by the console's approval page, with service auth from the caller's own PDS.

Repository @lexicons.opensocial.fyi did:plc:2gqnilpksz2e7faj3bwvo6qc namespace authority
Details · query
Kindquery
Authorityopensocial.fyi
Indexed

Showing version bafyreia4rb3swb3gkg4siqxvuou2oujcdsdswcw7wxze5wrzytanszwyqe. Show the latest

Compare Edit in builder → Fork →

Query

query · GET

Parameters

query string

requestUri

requiredstring

The request_uri the app received from this host's pushed authorization request endpoint.

Output

application/json

client

requiredref
Reference

groups

requiredarray

The groups the caller may sign in as: the one the app named, or every group on this host where the caller holds a role.

itemsref
Reference

labels

array

What each permission set the app asked for says it is for, in its own words.

itemsref
Reference

loginHint

string

The group the app named, if it named one.

requested

requiredarray

The scope values the app asked for.

itemsstring

Errors

ExpiredRequest

No description in schema.

#client

object

Properties

id

requiredstring

name

string

uri

string · uri

#group

object

Properties

avatar

string · uri

did

requiredstring · did

displayName

string

granted

requiredarray

The requested scope values the caller's roles let the app have.

itemsstring

handle

requiredstring

roles

requiredarray
itemsstring

withheld

requiredarray

The requested scope values the app will not get.

itemsstring

#label

object

Properties

scope

requiredstring

text

requiredstring

Similar lexicons

semantic match

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • fyi.opensocial.approveAuthorization

    procedure

    Approve an app's pending request to sign in as a group. The app gets what the caller's roles in the group allow and nothing more, and every token it obtains is recorded as the caller's. Returns the URL to send the browser back to the app with.

  • fyi.opensocial.getGroupAuth

    procedure

    Obtain a DPoP-bound OAuth access token to act as the group DID. The host is the group's PDS and authorization server: the caller authenticates with their personal account (service auth) and presents a DPoP proof; the host issues a short-lived token for the group DID whose space: scopes are exactly what the caller's roles are granted by the space's access record. No group password is involved. The same token may write those kinds of record in the group's public repo too (repoCollections): publish