Lexicon Garden

social.colibri.beta.actor.grantSpaceAccess

Hands the AppView access to one of the requesting user's personal spaces. The client mints a delegation token on its own PDS for the space and passes it here, because a delegation token is single-use and short-lived and the AppView has no OAuth session of its own. The AppView exchanges the token for a space credential and syncs the space.

Repository @colibri.social did:plc:mprdjqjluoswa7awzggaggj3 namespace authority
Details · procedure
Kindprocedure
Authorityactor.beta.colibri.social
Indexed
Compare Edit in builder → Fork →

Procedure

procedure · POST

Input

application/json

delegationToken

requiredstring

A delegation token minted by the user's PDS for the space.

space

requiredstring · space-ref

The space to grant access to.

Output

application/json

expiresAt

requiredstring · datetime

When the resulting space credential expires. The client should call this again before then to keep access current.

Errors

AuthRequired

The request has no valid service auth.

InvalidRequest

The arguments are inconsistent or malformed beyond schema validation.

InvalidDelegationToken

The delegation token is malformed, expired, or already used.

SpaceNotFound

No space matches the given space reference.

NotAuthorized

The delegation token does not grant access to the given space.

UpstreamFailure

The user's PDS failed while the AppView exchanged the delegation token or synced the space.

Similar lexicons

semantic match

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • space.highport.manage.grantSpaceAccess

    procedure

    Give bard a delegation token so it can keep reading a space. Any member can call this with a token they issued. Bard trades it for a credential, renews its notification registration when due, and catches up on anything it missed.

  • space.highport.manage.connectSpace

    procedure

    Connect a space so bard can read and publish the authority's site and tile records from it. Only the authority can call this, with a delegation token it issued. Bard trades the token for a credential, registers for notifications, and pulls the authority's repo. Safe to repeat.

  • zone.stratos.space.getSpaceCredential

    procedure

    Issue a space credential (JWT) for a space the caller is a member of. The credential is multi-use until it expires and is bound to the caller's DPoP key (cnf.jkt, RFC 9449): it must be presented under the DPoP auth scheme with a per-request proof signed by that key. It is signed by the space authority's signing key so any repo host can verify it without contacting the authority. Identity is resolved from a delegation token when provided (a standalone DPoP proof in the DPoP header supplies the ke

  • fyi.opensocial.getGroupAuth

    procedure

    Obtain a DPoP-bound OAuth access token to act as the group DID. The host is the group's PDS and authorization server: the caller authenticates with their personal account (service auth) and presents a DPoP proof; the host issues a short-lived token for the group DID whose space: scopes are exactly what the caller's roles are granted by the space's access record. No group password is involved. The same token may write those kinds of record in the group's public repo too (repoCollections): publish