Lexicon Garden
full diff

fyi.opensocial.getGroupAuth

lexicons.opensocial.fyi +6 −4

← Back to CompareLexicon page

From
bafyreihrdktphzq6yhngcyue5atbcholptav6pa2iyjyslnzv4m2oelvvy indexed 2026-10-09 00:22 UTC View this version
To
bafyreig6hzefnukswg7pofikebu2lo37v5lz7ero6ys36ib5y2quqop6ru indexed 2026-11-05 16:25 UTC View this version

Compatibility

breaking 4 breaking changes, 3 non-breaking changes.

Breaking changes (4)
  • KindChanged KindChanged { vertex_id: "fyi.opensocial.getGroupAuth:output.collections:items", old_kind: "string", new_kind: "ref" }
  • KindChanged KindChanged { vertex_id: "fyi.opensocial.getGroupAuth:output.repoCollections:items", old_kind: "string", new_kind: "ref" }
  • ConstraintAdded ConstraintAdded { vertex_id: "fyi.opensocial.getGroupAuth:output.repoCollections:items", sort: "ref", value: "fyi.opensocial.defs#collectionRef" }
  • ConstraintAdded ConstraintAdded { vertex_id: "fyi.opensocial.getGroupAuth:output.collections:items", sort: "ref", value: "fyi.opensocial.defs#collectionRef" }
Non-breaking changes (3)
  • AddedVertex AddedVertex { vertex_id: "fyi.opensocial.defs#collectionRef" }
  • AddedEdge AddedEdge { src: "fyi.opensocial.getGroupAuth:output.collections:items", tgt: "fyi.opensocial.defs#collectionRef", kind: "ref", name: None }
  • AddedEdge AddedEdge { src: "fyi.opensocial.getGroupAuth:output.repoCollections:items", tgt: "fyi.opensocial.defs#collectionRef", kind: "ref", name: None }

Migration guidance

Added

  • AddedVertex { vertex_id: "fyi.opensocial.defs#collectionRef" }

Constraint changes

  • ConstraintAdded ConstraintAdded { vertex_id: "fyi.opensocial.getGroupAuth:output.repoCollections:items", sort: "ref", value: "fyi.opensocial.defs#collectionRef" }
  • ConstraintAdded ConstraintAdded { vertex_id: "fyi.opensocial.getGroupAuth:output.collections:items", sort: "ref", value: "fyi.opensocial.defs#collectionRef" }

Notes

  • Breaking: KindChanged { vertex_id: "fyi.opensocial.getGroupAuth:output.collections:items", old_kind: "string", new_kind: "ref" }
  • Breaking: KindChanged { vertex_id: "fyi.opensocial.getGroupAuth:output.repoCollections:items", old_kind: "string", new_kind: "ref" }
  • Non-breaking: AddedEdge { src: "fyi.opensocial.getGroupAuth:output.collections:items", tgt: "fyi.opensocial.defs#collectionRef", kind: "ref", name: None }
  • Non-breaking: AddedEdge { src: "fyi.opensocial.getGroupAuth:output.repoCollections:items", tgt: "fyi.opensocial.defs#collectionRef", kind: "ref", name: None }

Changes

11{
22 "$type": "com.atproto.lexicon.schema",
33 "defs": {
44 "main": {
5 "description": "Obtain a DPoP-bound OAuth access token to act as the group DID. The host is the group's PDS and authorization server: the caller authenticates with their personal account (service auth) and presents a DPoP proof; the host issues a short-lived token for the group DID whose space: scopes are exactly what the caller's roles are granted by the space's access record. No group password is involved. The same token may write those kinds of record in the group's public repo too (repoCollections): publishing them, as the group.",
5 "description": "Obtain a DPoP-bound OAuth access token to act as the group DID. The host is the group's PDS and authorization server: the caller authenticates with their personal account (service auth) and presents a DPoP proof; the host issues a short-lived token for the group DID whose space: scopes are exactly what the caller's roles are granted by the space's access record. No group password is involved. The same token may write those kinds of record in the group's public repo too (repoCollections): publishing them, as the group. For someone's inbox (fyi.opensocial.invites), a caller whose roles may invite gets a token to write the group's invite there, and nothing in the group's repo.",
66 "errors": [
77 {
88 "name": "Forbidden"
99 }
1010 ],
1111 "input": {
1212 "encoding": "application/json",
1313 "schema": {
1414 "properties": {
1515 "group": {
1616 "format": "did",
1717 "type": "string"
1818 },
1919 "space": {
20 "description": "The space the caller intends to write into; its access record's credentialScopes bound the grant.",
20 "description": "The space the caller intends to write into: one of the group's, where the scopes its access record grants the caller's roles bound the grant, or someone's inbox, to invite them.",
2121 "format": "space-ref",
2222 "type": "string"
2323 }
2424 },
2525 "required": [
2626 "group",
2727 "space"
2828 ],
2929 "type": "object"
3030 }
3131 },
3232 "output": {
3333 "encoding": "application/json",
3434 "schema": {
3535 "properties": {
3636 "accessJwt": {
3737 "type": "string"
3838 },
3939 "collections": {
4040 "description": "Collections the caller's roles may write as the group in that space ('*' for any).",
4141 "items": {
42 "type": "string"
42 "ref": "fyi.opensocial.defs#collectionRef",
43 "type": "ref"
4344 },
4445 "type": "array"
4546 },
4647 "did": {
4748 "format": "did",
4849 "type": "string"
4950 },
5051 "expiresAt": {
5152 "format": "datetime",
5253 "type": "string"
5354 },
5455 "pds": {
5556 "description": "Where to use it: the group's PDS (this host).",
5657 "format": "uri",
5758 "type": "string"
5859 },
5960 "repoCollections": {
6061 "description": "Public-repo collections this token may also write.",
6162 "items": {
62 "type": "string"
63 "ref": "fyi.opensocial.defs#collectionRef",
64 "type": "ref"
6365 },
6466 "type": "array"
6567 },
6668 "scope": {
6769 "description": "The token's OAuth scope string; the PDS enforces it.",
6870 "type": "string"
6971 }
7072 },
7173 "required": [
7274 "did",
7375 "accessJwt",
7476 "pds",
7577 "collections",
7678 "expiresAt"
7779 ],
7880 "type": "object"
7981 }
8082 },
8183 "type": "procedure"
8284 }
8385 },
8486 "id": "fyi.opensocial.getGroupAuth",
8587 "lexicon": 1
8688}

Compare other versions