Lexicon Garden

fyi.opensocial.provisionGroup

Host-level: an app creates a group for a person and gets its own OAuth session on it. Authenticated twice: the person asking, by service auth from their PDS (they become the founder), and the app, by OAuth client authentication in the body (a client assertion for a confidential client) with a DPoP proof in the `DPoP` header, exactly as at the token endpoint. The app must be one this host provisions for. Returns the group and a token response bound to the proof's key, issued to the app's client id: refreshed, listed and revoked like any other session on the group.

Repository @lexicons.opensocial.fyi did:plc:2gqnilpksz2e7faj3bwvo6qc namespace authority
Details · procedure
Kindprocedure
Authorityopensocial.fyi
Indexed
Compare Edit in builder → Fork →

Procedure

procedure · POST

Input

application/json

clientAssertion

string
  • maxLength: 8192

clientAssertionType

string
  • maxLength: 256

clientId

requiredstring

The app's OAuth client id, its client metadata's URL.

  • maxLength: 2048

description

string
  • maxLength: 3000
  • maxGraphemes: 300

displayName

requiredstring
  • maxLength: 640
  • maxGraphemes: 64

handle

requiredstring · handle

joinPolicy

string
  • knownValues: fyi.opensocial.profile#open | fyi.opensocial.profile#request | fyi.opensocial.profile#invite

scope

requiredstring

The OAuth scope the app wants on the group. Must include `atproto`, and every entry must be one the app's client metadata declares.

  • maxLength: 2048

stewards

array

Accounts that run the group alongside the founder.

itemsref
Reference

Output

application/json

did

requiredstring · did

members

requiredstring · space-ref

meta

requiredstring · space-ref

session

requiredunknown

An OAuth token response (access_token, token_type, refresh_token, expires_in, scope, sub), as /oauth/token returns it.

Errors

UntrustedApp

No description in schema.

InvalidScope

No description in schema.

use_dpop_nonce

No description in schema.

HandleTaken

No description in schema.

Similar lexicons

semantic match

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • fyi.opensocial.createGroup

    procedure

    Host-level: create a new group on this host. Authenticated as the founder (service auth from their PDS). The founder and any listed stewards become its first admins. Mints the group DID, creates the meta and members spaces, writes the bootstrap records and, for a discoverable group, a declaration. Modality spaces are left to the apps that use them (createSpace).

  • fyi.opensocial.getGroupAuth

    procedure

    Obtain a DPoP-bound OAuth access token to act as the group DID. The host is the group's PDS and authorization server: the caller authenticates with their personal account (service auth) and presents a DPoP proof; the host issues a short-lived token for the group DID whose space: scopes are exactly what the caller's roles are granted by the space's access record. No group password is involved. The same token may write those kinds of record in the group's public repo too (repoCollections): publish

  • social.grain.unspecced.createGroup

    procedure not from the namespace authority

    Start a group on Grain's group host. The host creates the group with the viewer as its founder and hands Grain its own session on it (fyi.opensocial.provisionGroup); Grain then gives the group its pool and its Grain profile. The viewer never leaves Grain.