{
"id": "zone.stratos.space.getSpaceCredential",
"defs": {
"main": {
"type": "procedure",
"input": {
"schema": {
"type": "object",
"required": [
"space"
],
"properties": {
"space": {
"type": "string",
"description": "The space's at:// URI (at://{did}/space/{type}/{skey}). Mirrors the upstream space-ref string format (atproto#5187); declared as a plain string until @atproto/lexicon supports that format. Its space DID must equal this service's DID."
},
"delegationToken": {
"type": "string",
"description": "Optional space-delegation JWT. When present, the caller's identity is taken from this token (its target space must equal `space`) instead of the DPoP session."
},
"clientAttestation": {
"type": "string",
"description": "Optional client-attestation JWT (an OAuth private_key_jwt client assertion to the space authority). Required only for spaces gated on client app identity (appAccess allowList); the allow-list is evaluated against the attested client_id. Ignored for open spaces."
}
}
},
"encoding": "application/json"
},
"errors": [
{
"name": "InvalidToken",
"description": "The supplied delegation token failed verification, or its target space does not match the requested space."
},
{
"name": "NotEnrolled",
"description": "The identified user is not enrolled in the boundary corresponding to the requested space."
},
{
"name": "UnknownSpace",
"description": "The requested space URI is malformed or its space DID does not match this service's DID."
},
{
"name": "AttestationRequired",
"description": "The requested space gates on client app identity (appAccess allowList) but no valid client attestation was supplied."
},
{
"name": "ClientNotAllowed",
"description": "A valid client attestation was supplied but its attested client_id is not in the space's app allow-list."
},
{
"name": "ProofRequired",
"description": "No DPoP key was available to bind the credential to: the delegation path requires a standalone DPoP proof in the DPoP header, and unbound credentials are refused outside development mode."
}
],
"output": {
"schema": {
"type": "object",
"required": [
"credential",
"expiresAt"
],
"properties": {
"expiresAt": {
"type": "string",
"format": "datetime",
"description": "The credential's expiry time (matches the JWT `exp` claim)."
},
"credential": {
"type": "string",
"description": "The compact-serialized space-credential JWT."
}
}
},
"encoding": "application/json"
},
"description": "Issue a space credential (JWT) for a space the caller is a member of. The credential is multi-use until it expires and is bound to the caller's DPoP key (cnf.jkt, RFC 9449): it must be presented under the DPoP auth scheme with a per-request proof signed by that key. It is signed by the space authority's signing key so any repo host can verify it without contacting the authority. Identity is resolved from a delegation token when provided (a standalone DPoP proof in the DPoP header supplies the key to bind), otherwise from the DPoP-authenticated user (the session proof key is bound). Membership is checked live against the enrollment store. App-axis (client attestation) gating is enforced here: spaces configured with an app allow-list require a valid client attestation whose attested client_id is listed; spaces that are open ignore any attestation supplied."
}
},
"$type": "com.atproto.lexicon.schema",
"lexicon": 1
}