zone.stratos.space.getSpaceCredential

{
  "type": "procedure",
  "input": {
    "schema": {
      "type": "object",
      "required": [
        "space"
      ],
      "properties": {
        "space": {
          "type": "string",
          "description": "The space's at:// URI (at://{did}/space/{type}/{skey}). Mirrors the upstream space-ref string format (atproto#5187); declared as a plain string until @atproto/lexicon supports that format. Its space DID must equal this service's DID."
        },
        "delegationToken": {
          "type": "string",
          "description": "Optional space-delegation JWT. When present, the caller's identity is taken from this token (its target space must equal `space`) instead of the DPoP session."
        },
        "clientAttestation": {
          "type": "string",
          "description": "Optional client-attestation JWT (an OAuth private_key_jwt client assertion to the space authority). Required only for spaces gated on client app identity (appAccess allowList); the allow-list is evaluated against the attested client_id. Ignored for open spaces."
        }
      }
    },
    "encoding": "application/json"
  },
  "errors": [
    {
      "name": "InvalidToken",
      "description": "The supplied delegation token failed verification, or its target space does not match the requested space."
    },
    {
      "name": "NotEnrolled",
      "description": "The identified user is not enrolled in the boundary corresponding to the requested space."
    },
    {
      "name": "UnknownSpace",
      "description": "The requested space URI is malformed or its space DID does not match this service's DID."
    },
    {
      "name": "AttestationRequired",
      "description": "The requested space gates on client app identity (appAccess allowList) but no valid client attestation was supplied."
    },
    {
      "name": "ClientNotAllowed",
      "description": "A valid client attestation was supplied but its attested client_id is not in the space's app allow-list."
    },
    {
      "name": "ProofRequired",
      "description": "No DPoP key was available to bind the credential to: the delegation path requires a standalone DPoP proof in the DPoP header, and unbound credentials are refused outside development mode."
    }
  ],
  "output": {
    "schema": {
      "type": "object",
      "required": [
        "credential",
        "expiresAt"
      ],
      "properties": {
        "expiresAt": {
          "type": "string",
          "format": "datetime",
          "description": "The credential's expiry time (matches the JWT `exp` claim)."
        },
        "credential": {
          "type": "string",
          "description": "The compact-serialized space-credential JWT."
        }
      }
    },
    "encoding": "application/json"
  },
  "description": "Issue a space credential (JWT) for a space the caller is a member of. The credential is multi-use until it expires and is bound to the caller's DPoP key (cnf.jkt, RFC 9449): it must be presented under the DPoP auth scheme with a per-request proof signed by that key. It is signed by the space authority's signing key so any repo host can verify it without contacting the authority. Identity is resolved from a delegation token when provided (a standalone DPoP proof in the DPoP header supplies the key to bind), otherwise from the DPoP-authenticated user (the session proof key is bound). Membership is checked live against the enrollment store. App-axis (client attestation) gating is enforced here: spaces configured with an app allow-list require a valid client attestation whose attested client_id is listed; spaces that are open ignore any attestation supplied."
}