# com.publicdomainrelay.temp.auth.allowlist.rbacDid

> Published by [johnandersen777.bsky.social](https://lexicon.garden/identity/did:plc:5svqtrhheairglgiiyvutzik)

## Links

- [View on Lexicon Garden](https://lexicon.garden/lexicon/did:plc:5svqtrhheairglgiiyvutzik/com.publicdomainrelay.temp.auth.allowlist.rbacDid)
- [Documentation](https://lexicon.garden/lexicon/did:plc:5svqtrhheairglgiiyvutzik/com.publicdomainrelay.temp.auth.allowlist.rbacDid/docs)
- [Examples](https://lexicon.garden/lexicon/did:plc:5svqtrhheairglgiiyvutzik/com.publicdomainrelay.temp.auth.allowlist.rbacDid/examples)

## Definitions

### `com.publicdomainrelay.temp.auth.allowlist.rbacDid`

**Type**: `record`

Self-allowlist granting the record owner's DID access to their own account-scoped operations. Used by bidders and other automated actors to authorize AT Protocol writes (e.g. applyWrites) on their own repo via service-auth tokens.

**Key**: `tid`

| Property | Type | Required | Description |
|----------|------|----------|-------------|
| `allowed` | `unknown` | Yes | Map of label → [did, ...] entries. Lists DIDs authorized under each label. |
| `protects` | `unknown` | Yes | Map of label → { service, scope } entries. Labels are arbitrary keys (e.g. 'allowSelf'). Each value has a service id and optional scope that must match for the protection to apply. |
| `createdAt` | `string` (datetime) | Yes |  |

## Raw Schema

```json
{
  "id": "com.publicdomainrelay.temp.auth.allowlist.rbacDid",
  "defs": {
    "main": {
      "key": "tid",
      "type": "record",
      "record": {
        "type": "object",
        "required": [
          "protects",
          "allowed",
          "createdAt"
        ],
        "properties": {
          "allowed": {
            "type": "unknown",
            "description": "Map of label → [did, ...] entries. Lists DIDs authorized under each label."
          },
          "protects": {
            "type": "unknown",
            "description": "Map of label → { service, scope } entries. Labels are arbitrary keys (e.g. 'allowSelf'). Each value has a service id and optional scope that must match for the protection to apply."
          },
          "createdAt": {
            "type": "string",
            "format": "datetime"
          }
        }
      },
      "description": "Self-allowlist granting the record owner's DID access to their own account-scoped operations. Used by bidders and other automated actors to authorize AT Protocol writes (e.g. applyWrites) on their own repo via service-auth tokens."
    }
  },
  "$type": "com.atproto.lexicon.schema",
  "lexicon": 1
}
```