zone.stratos.actor.enrollment

{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "description": "A record indicating the user is enrolled in a Stratos service. Published to the user's PDS during OAuth enrollment for endpoint discovery by AppViews. Multiple enrollment records are supported — one per Stratos service.",
      "key": "any",
      "record": {
        "properties": {
          "attestation": {
            "description": "Service attestation vouching for the user's enrollment, boundaries, and signing key.",
            "ref": "#serviceAttestation",
            "type": "ref"
          },
          "boundaries": {
            "description": "Service-qualified boundaries the user has access to on this Stratos service, each in '{serviceDid}/{domainName}' format.",
            "items": {
              "ref": "zone.stratos.boundary.defs#Domain",
              "type": "ref"
            },
            "maxLength": 50,
            "type": "array"
          },
          "createdAt": {
            "description": "Timestamp when the enrollment was created.",
            "format": "datetime",
            "type": "string"
          },
          "service": {
            "description": "The Stratos service endpoint URL where this user's private data is stored.",
            "format": "uri",
            "type": "string"
          },
          "signingKey": {
            "description": "The user's P-256 public key as a did:key string, generated by the Stratos service for user-level record signing.",
            "type": "string"
          }
        },
        "required": [
          "service",
          "signingKey",
          "attestation",
          "createdAt"
        ],
        "type": "object"
      },
      "type": "record"
    },
    "serviceAttestation": {
      "description": "An attestation signed by the Stratos service key. The signed payload is DAG-CBOR encoded {boundaries, did, signingKey} with sorted keys.",
      "properties": {
        "sig": {
          "description": "Raw signature bytes of the DAG-CBOR encoded attestation payload, signed by the service key.",
          "type": "bytes"
        },
        "signingKey": {
          "description": "The Stratos service's public key as a did:key string, used to verify the attestation signature.",
          "type": "string"
        }
      },
      "required": [
        "sig",
        "signingKey"
      ],
      "type": "object"
    }
  },
  "id": "zone.stratos.actor.enrollment",
  "lexicon": 1
}