# ch.indiemusi.alpha.grant

> Published by [indiemusi.ch](https://lexicon.garden/identity/did:plc:lcmrbur2pydmpelfcs7fjbdx)

✓ This is the authoritative definition for this NSID.

## Links

- [View on Lexicon Garden](https://lexicon.garden/lexicon/did:plc:lcmrbur2pydmpelfcs7fjbdx/ch.indiemusi.alpha.grant)
- [Documentation](https://lexicon.garden/lexicon/did:plc:lcmrbur2pydmpelfcs7fjbdx/ch.indiemusi.alpha.grant/docs)
- [Examples](https://lexicon.garden/lexicon/did:plc:lcmrbur2pydmpelfcs7fjbdx/ch.indiemusi.alpha.grant/examples)

## Definitions

### `ch.indiemusi.alpha.grant`

**Type**: `record`

A cryptographic grant allowing a streaming service to decrypt the artist's music catalog. This record contains the master content key encrypted with the service's public key.

**Key**: `tid`

| Property | Type | Required | Description |
|----------|------|----------|-------------|
| `createdAt` | `string` (datetime) | Yes | When the grant was created |
| `expiresAt` | `string` (datetime) | No | Optional expiration date. After this, the grant should be considered revoked. |
| `serviceDid` | `string` (did) | Yes | The DID of the streaming service being authorized |
| `wrappedMasterKey` | `string` | Yes | The Master Content Key (32 bytes) encrypted with the service's public key, base64-encoded. Only the service can decrypt this with their private key. |
| `wrappingAlgorithm` | `string` | No | The algorithm used to wrap the master key. Currently RSA-OAEP (asymmetric, using the service's public key). |
| `wrappedMasterKeyIv` | `string` | No | Base64-encoded IV (12 bytes) used to encrypt the master key. Only present for AES-GCM wrapping; empty for RSA-OAEP. |

## Raw Schema

```json
{
  "id": "ch.indiemusi.alpha.grant",
  "defs": {
    "main": {
      "key": "tid",
      "type": "record",
      "record": {
        "type": "object",
        "required": [
          "serviceDid",
          "wrappedMasterKey",
          "createdAt"
        ],
        "properties": {
          "createdAt": {
            "type": "string",
            "format": "datetime",
            "description": "When the grant was created"
          },
          "expiresAt": {
            "type": "string",
            "format": "datetime",
            "description": "Optional expiration date. After this, the grant should be considered revoked."
          },
          "serviceDid": {
            "type": "string",
            "format": "did",
            "maxLength": 256,
            "description": "The DID of the streaming service being authorized"
          },
          "wrappedMasterKey": {
            "type": "string",
            "maxLength": 512,
            "description": "The Master Content Key (32 bytes) encrypted with the service's public key, base64-encoded. Only the service can decrypt this with their private key."
          },
          "wrappingAlgorithm": {
            "type": "string",
            "default": "RSA-OAEP",
            "maxLength": 50,
            "description": "The algorithm used to wrap the master key. Currently RSA-OAEP (asymmetric, using the service's public key)."
          },
          "wrappedMasterKeyIv": {
            "type": "string",
            "maxLength": 32,
            "description": "Base64-encoded IV (12 bytes) used to encrypt the master key. Only present for AES-GCM wrapping; empty for RSA-OAEP."
          }
        }
      },
      "description": "A cryptographic grant allowing a streaming service to decrypt the artist's music catalog. This record contains the master content key encrypted with the service's public key."
    }
  },
  "$type": "com.atproto.lexicon.schema",
  "lexicon": 1
}
```