zone.stratos.actor.enrollment Documentation (EN)

main record

A record indicating the user is enrolled in a Stratos service. Published to the user's PDS during OAuth enrollment for endpoint discovery by AppViews. Multiple enrollment records are supported — one per Stratos service.

Record Key any Any valid record key

Properties

attestation ref #serviceAttestation Required

Service attestation vouching for the user's enrollment, boundaries, and signing key.

boundaries array of ref zone.stratos.boundary.defs#Domain Optional

Service-qualified boundaries the user has access to on this Stratos service, each in '{serviceDid}/{domainName}' format.

maxLength: 50 items

createdAt string datetime Required

Timestamp when the enrollment was created.

service string uri Required

The Stratos service endpoint URL where this user's private data is stored.

signingKey string Required

The user's P-256 public key as a did:key string, generated by the Stratos service for user-level record signing.

View raw schema

{
  "description": "A record indicating the user is enrolled in a Stratos service. Published to the user's PDS during OAuth enrollment for endpoint discovery by AppViews. Multiple enrollment records are supported — one per Stratos service.",
  "key": "any",
  "record": {
    "properties": {
      "attestation": {
        "description": "Service attestation vouching for the user's enrollment, boundaries, and signing key.",
        "ref": "#serviceAttestation",
        "type": "ref"
      },
      "boundaries": {
        "description": "Service-qualified boundaries the user has access to on this Stratos service, each in '{serviceDid}/{domainName}' format.",
        "items": {
          "ref": "zone.stratos.boundary.defs#Domain",
          "type": "ref"
        },
        "maxLength": 50,
        "type": "array"
      },
      "createdAt": {
        "description": "Timestamp when the enrollment was created.",
        "format": "datetime",
        "type": "string"
      },
      "service": {
        "description": "The Stratos service endpoint URL where this user's private data is stored.",
        "format": "uri",
        "type": "string"
      },
      "signingKey": {
        "description": "The user's P-256 public key as a did:key string, generated by the Stratos service for user-level record signing.",
        "type": "string"
      }
    },
    "required": [
      "service",
      "signingKey",
      "attestation",
      "createdAt"
    ],
    "type": "object"
  },
  "type": "record"
}

serviceAttestation object

An attestation signed by the Stratos service key. The signed payload is DAG-CBOR encoded {boundaries, did, signingKey} with sorted keys.

Properties

sig bytes Required

Raw signature bytes of the DAG-CBOR encoded attestation payload, signed by the service key.

signingKey string Required

The Stratos service's public key as a did:key string, used to verify the attestation signature.

View raw schema

{
  "description": "An attestation signed by the Stratos service key. The signed payload is DAG-CBOR encoded {boundaries, did, signingKey} with sorted keys.",
  "properties": {
    "sig": {
      "description": "Raw signature bytes of the DAG-CBOR encoded attestation payload, signed by the service key.",
      "type": "bytes"
    },
    "signingKey": {
      "description": "The Stratos service's public key as a did:key string, used to verify the attestation signature.",
      "type": "string"
    }
  },
  "required": [
    "sig",
    "signingKey"
  ],
  "type": "object"
}