town.muni.arbiter.proxy

zicklag.dev

Documentation

Proxied XRPC request through an arbiter's policy. The caller authenticates via serviceAuth (aud = arbiter-server DID, lxm = town.muni.arbiter.proxy). The body specifies the arbiter DID to act on behalf of, the target DID#service to reach, and the inner XRPC request (method, nsid, parameters, body) to evaluate. The server drives the arbiter's Rego policy and proxies the inner request to the target authenticated as the stewarded account. The `nsid` here is the *inner* request NSID, distinct from this procedure's own NSID.

main procedure

Proxied XRPC request through an arbiter's policy. The caller authenticates via serviceAuth (aud = arbiter-server DID, lxm = town.muni.arbiter.proxy). The body specifies the arbiter DID to act on behalf of, the target DID#service to reach, and the inner XRPC request (method, nsid, parameters, body) to evaluate. The server drives the arbiter's Rego policy and proxies the inner request to the target authenticated as the stewarded account. The `nsid` here is the *inner* request NSID, distinct from this procedure's own NSID.

Input

Encodingapplication/json
arbiterDid stringdid Required

The stewarded account's DID to act on behalf of.

body unknown Optional

Optional JSON body for the inner request.

method string Required

HTTP method for the inner XRPC request (GET, POST, etc).

nsid string Required

The inner XRPC request NSID.

parameters unknown Optional

Optional query parameters for the inner request.

target string Required

The destination DID#service for the proxied request (e.g. did:plc:xyz#atproto_pds).

Output

Encodingapplication/json

Errors

ErrPermissionDenied The requesting user is not allowed to proxy through this arbiter.
Try It

Requests are sent directly from your browser. Some servers may block requests due to CORS.

Base URL for XRPC calls (e.g., https://bsky.social)
Enter valid JSON for the request body
View raw schema 
{
  "type": "procedure",
  "input": {
    "schema": {
      "type": "object",
      "required": [
        "arbiterDid",
        "target",
        "method",
        "nsid"
      ],
      "properties": {
        "body": {
          "type": "unknown",
          "description": "Optional JSON body for the inner request."
        },
        "nsid": {
          "type": "string",
          "description": "The inner XRPC request NSID."
        },
        "method": {
          "type": "string",
          "description": "HTTP method for the inner XRPC request (GET, POST, etc)."
        },
        "target": {
          "type": "string",
          "description": "The destination DID#service for the proxied request (e.g. did:plc:xyz#atproto_pds)."
        },
        "arbiterDid": {
          "type": "string",
          "format": "did",
          "description": "The stewarded account's DID to act on behalf of."
        },
        "parameters": {
          "type": "unknown",
          "description": "Optional query parameters for the inner request."
        }
      }
    },
    "encoding": "application/json"
  },
  "errors": [
    {
      "name": "ErrPermissionDenied",
      "description": "The requesting user is not allowed to proxy through this arbiter."
    }
  ],
  "output": {
    "schema": {
      "type": "object",
      "properties": {},
      "description": "The body of the inner XRPC response."
    },
    "encoding": "application/json"
  },
  "description": "Proxied XRPC request through an arbiter's policy.\n\nThe caller authenticates via serviceAuth (aud = arbiter-server DID,\nlxm = town.muni.arbiter.proxy). The body specifies the arbiter DID to act\non behalf of, the target DID#service to reach, and the inner XRPC\nrequest (method, nsid, parameters, body) to evaluate. The server drives\nthe arbiter's Rego policy and proxies the inner request to the target\nauthenticated as the stewarded account.\n\nThe `nsid` here is the *inner* request NSID, distinct from this\nprocedure's own NSID."
}

Lexicon Garden

@