zone.stratos.space.listBlobs

List the CIDs of blobs referenced by an account's records within a permissioned space, optionally since some revision of that repo. Spec-shaped mirror of com.atproto.space.listBlobs (atproto#5187): callable with standard user auth (the caller must be a member of the space) or with a space credential for that space (for syncing services). Blobs behind permissioned records are never enumerated by an unauthenticated endpoint.

Details · query
Kindquery
Authorityspace.stratos.zone
Indexed

Query

query · GET

Parameters

query string

cursor

string

limit

integer
  • minimum: 1
  • maximum: 1000
  • default: 500

repo

requiredstring · did

The DID of the account whose blobs to list.

since

string · tid

Optional revision of the repo to list blobs since.

space

requiredstring

The space's at:// URI (at://{did}/space/{type}/{skey}). Mirrors the upstream space-ref string format (atproto#5187); declared as a plain string until @atproto/lexicon supports that format. Its space DID must equal this service's DID.

Output

application/json

cids

requiredarray
itemsstring · cid

cursor

string

Errors

RepoNotFound

The requested account has no repo on this service.

UnknownSpace

The requested space URI is malformed or its space DID does not match this service's DID.

AuthRequired

The caller is not admitted to the requested space (not a member, or the presented credential targets a different space).

Similar lexicons

semantic match

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • List blob CIDs for an account, since some repo revision. Does not require auth; implemented by PDS.

  • Every blob a record in a community space references. Effective admins and the community identity only.

  • One blob and the records that reference it. Effective admins and the community identity only.

  • Full-state recovery: enumerate a repo's record paths and their current CIDs, mirroring listRecords semantics. Record values are inlined by default; excludeValues returns metadata only. Boundary-gated: the caller only observes records within its enrolled boundaries. Intended as the fallback when the oplog (listRepoOps) returns OplogTruncated: the caller enumerates paths, diffs locally, and fetches misses. Callers must authenticate with a signed service JWT via the Authorization: Bearer header.

  • Returns a list of missing blobs for the requesting account. Intended to be used in the account migration flow.